Tools

google/honggfuzz

Security oriented software fuzzer. Supports evolutionary, feedback-driven fuzzing based on code coverage (SW and HW based)

sigmahq/sigma-cli

The Sigma command line interface based on pySigma

idov31/cronos

PoC for a sleep obfuscation technique leveraging waitable timers to evade memory scanners.

crowdstrike/supermem

A python script developed to process Windows memory images based on triage type.

airbus-cert/vbsparkle

VBScript & VBA source-to-source deobfuscator with partial-evaluation

0xballpoint/load

Lord Of Active Directory - automatic vulnerable active directory on AWS

saadahla/ntdllreflection

Bypass Userland EDR hooks by Loading Reflective Ntdll in memory from a remote server based on Windows ReleaseID to avoid opening a handle to ntdll ,…

sh0ckfr/lockbit3.0-mpclient-defender-poc

DLL hijacking proof-of-concept that weaponizes Microsoft Defender's MpClient.dll to load Cobalt Strike, demonstrating LockBit-style defense evasion.

rvrsh3ll/rendezvousrat

Minimal proof-of-concept remote access trojan in Go using libp2p rendezvous and pubsub for self-healing command-and-control over Linux and Windows…

pard0p/callstackspoofingpoc

C++ self-Injecting dropper based on various EDR evasion techniques.

1837620622/cloudflare-bypass-2026

Cloudflare Turnstile 绕过工具 | Cloudflare Bypass Tool based on SeleniumBase UC Mode | 支持 Mac/Windows/Linux

nccgroup/mimikatz-detector-condrv

Kernel-mode filter driver that monitors ConDrv traffic to detect mimikatz execution in real-time, logging detection events via ETW for incident…

spiralbl0ck/kernel-arbitrary-read-vulnerability-superfetch-eop

Windows kernel exploit leveraging an arbitrary read vulnerability combined with Superfetch to achieve elevation of privilege from low integrity.

d0rb/packetpirate

A headless , scriptable, command-line based MITM proxy designed for network traffic interception, analysis, and modification on Windows systems.

lsw29475/cve-2020-17057

Windows kernel exploit for CVE-2020-17057 using palette objects with dangling data pointers, targeting type isolation bypass for privilege escalation.

razureink/cve-2024-49113-ldap_nightmare_reproduction

Proof-of-concept exploit for CVE-2024-49113 (LDAP Nightmare), a critical heap-based buffer overflow in Windows LDAP client (wldap32.dll). Includes a…

advancedhacker101/android-c-sharp-rat-server

This is a plugin for the c# R.A.T server providing extension to android based phone systems