Tools

ccob/threadlessinject

Threadless Process Injection using remote function hooking.

nettitude/runpe

C# Reflective loader for unmanaged binaries.

mgeeky/shellcodefluctuation

An advanced in-memory evasion technique fluctuating shellcode's memory protection between RW/NoAccess & RX and then encrypting/decrypting its contents

rizinorg/rizin

UNIX-like reverse engineering framework and command-line toolset.

keystone-engine/keystone

Multi-architecture assembler framework that converts assembly source into machine code for Arm, x86, MIPS, PowerPC, RISC-V, and more, with a…

watchtowrlabs/watchtowr-vs-citrix-netscaler-preauth-rce-cve-2026-8452

CVE-2026-8452 PreAuth RCE

godoy-sec/cve-2017-14980

Study of a classic stack-based buffer overflow vulnerability in a controlled lab environment for educational purposes.

bc-security/empire

Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers.

techryptic/pokemon-shellcode-loader

Tired of looking at hex all day and popping '\x41's? Rather look at Lugia/Charmander? I have the solution for you.

daem0nc0re/tangledwinexec

PoCs and tools for investigation of Windows process execution techniques

cybereason/siofra

Simulates the Windows PE loader to identify DLL hijacking vulnerabilities, generates weaponized DLLs with shellcode payloads, and detects UAC…

d3lb3/keefarcereborn

A standalone DLL that exports databases in cleartext once injected in the KeePass process.

deepinstinct/dirty-vanity

A POC for the new injection technique, abusing windows fork API to evade EDRs. https://www.blackhat.com/eu-22/briefings/schedule/index.html#dirty-vani…

netspooky/scare

A multi-arch assembly REPL and emulator for your command line.

epi052/osed-scripts

bespoke tooling for offensive security's Windows Usermode Exploit Dev course (OSED)

petitoto/chromium-exploit-dev

Toolkit to weaponize Chromium vulnerabilities into reliable, cross-platform, full-chain exploits

sam00/poc-cve-2026-0300-exploit

Palo Alto - CVE-2026-0300 exploit

saerxcit/libtp_gadget

Crystal Palace library for proxying Nt API calls via the Threadpool. Updated for call gadgets.