Tools

hwbp/clr-unhook

Modern security products (CrowdStrike, Bitdefender, SentinelOne, etc.) hook the nLoadImage function inside clr.dll to intercept and scan in-memory…

malwaretech/edrception

A proof of concept for abusing exception handlers to hook and bypass user mode EDR hooks.

oldkingcone/byosi

Evade EDR's the simple way, by not touching any of the API's they hook.

rweijnen/createdump

Leverage WindowsApp createdump tool to obtain an lsass dump

lockness-ko/xz-vulnerable-honeypot

An ssh honeypot with the XZ backdoor. CVE-2024-3094

oalabs/frida-wshook

Script analysis tool based on Frida.re

hook-s3c/cve-2018-11776-python-poc

Working Python test and PoC for CVE-2018-11776, includes Docker lab

aetsu/neton

Agent-based tool that collects OS, hardware, file, and hook data from internet-connected sandboxes via HTTPS exfiltration, aiding Red Team artifact…

santhreal/keyhog

Open-source secret scanner in Rust

hook-s3c/cve-2018-18852

CERIO RCE CVE-2018-18852, authenticated (vendor defaults) web-based RCE as root user.

nishitm/gobox

GO sandbox to run untrusted code

p0dalirius/cve-2020-14144-gitea-git-hooks-rce

A script to exploit CVE-2020-14144 - GiTea authenticated Remote Code Execution using git hooks

dsnezhkov/octohook

Git Web Hook Tunnel for C2

tayyabt/trustlock

A Git-native dependency admission controller. Evaluates trust signals on every dependency change and blocks commits or builds when packages fail your…

nccgroup/windowsfirewallhookdriverenumeration

Tools to enumerate Windows Firewall Hook Drivers on Windows 2000, XP and 2003

t43wiu6/cve-2019-0887

exp for CVE-2019-0887

amalmurali47/hook

Hook for the PoC for exploiting CVE-2024-32002

ma4the/omae-wa-cheese-da

CVE-2025-21479 PoC for ZFlip5 with Knox in the way!(˶˃ ᵕ ˂˶)