CustomC2ChannelTemplate

IAT Hooking for custom C2 channels This is a simple PoC and template for developing custom C2 channels for Cobalt Strike using IAT hooks applied by a reflective loader. Blog post: https://codex-7.gitbook.io/codexs-terminal-window/red-team/cobalt-strike/building-custom-c2-channels-by-hooking-winin...

BasicHook

BasicHook Hooks functions using 32-bit relative jump, writing is done atomically to avoid race conditions. Uses hde32 from instruction length disassembly...

dll-injector

About As the name suggests, the application primarily performs injecting a DLL into any process running on Windows. With the power of this, it is able to perform several operations on a process such as loading a DLL, unloading a DLL, and hooking primary WinAPI functions e.g., CreateFileW, ReadFil...

LazyHook

Overview LazyHook is a stealthy API hooking framework that bypasses Host Intrusion Prevention Systems HIPS through call stack spoofing. By leveraging CPU-level hardware breakpoints and Vectored Exception Handling, it executes arbitrary code as if it originated from trusted, Microsoft-signed...

DLLHSC

DLLHSC DLL Hijack SCanner - A tool to generate leads and automate the discovery of candidates for DLL Search Order Hijacking Index of this page Contents of this repository Modes of operation Compile and Run Guidance Help menu Example Runs Feedback Contents of this repository This repository hosts...

HookCase

HookCase HookCase is a tool for debugging and reverse engineering applications on macOS aka OS X, and the operating system itself. It re-implements and extends Apple's DYLDINSERTLIBRARIES functionality. It can be used to hook any method in any module even non-exported ones, and even those that...

RdpThief

RdpThief RdpThief by itself is a standalone DLL that when injected in the mstsc.exe process, will perform API hooking, extract the clear-text credentials and save them to a file. An aggressor script accompanies it, which is responsible for managing the state, monitoring for new processes and...

frida-wshook

frida-wshook frida-wshook is an analysis and instrumentation tool which uses frida.re to hook common functions often used by malicious script files which are run using WScript/CScript. The tool intercepts Windows API functions and doesn't implement function stubs or proxies within the targeted...

Introspy-iOS

Introspy-iOS Blackbox tool to help understand what an iOS application is doing at runtime and assist in the identification of potential security issues. See http://isecpartners.github.io/Introspy-iOS/ for a quick introduction. Description This is the repository for the Introspy-iOS tracer. The...

r77-rootkit

r77 Rootkit Fileless ring 3 rootkit r77 is a ring 3 rootkit that hides everything: Files, directories Processes & CPU/GPU usage Registry keys & values Services TCP & UDP connections Junctions, named pipes, scheduled tasks Hiding by prefix Everything that starts with "$77" is hidden. Configuration...

sogen

...

frida-ios-hook

Frida iOS hook 📍 Una herramienta que te ayuda a usar Frida fácilmente. Soporta scripts para rastrear clases, funciones y modificar los valores de retorno de métodos en la plataforma iOS. 👉 Para la plataforma Android: frida-android-hook 👉 Para interceptar API cifradas en aplicaciones iOS:...

Frida-Labs

This repository contains a series of challenges designed for learning Frida for Android. These are not like hardcore Capture The Flag CTF applications but will help you to start with Frida and its commonly used APIs. If you are entirely new to Frida, this is the perfect repository to get started....

NtDetours

NTSTATUS NTAPI TrInitPVOID ImageBase = &ImageBase; hacer que la IAT sea escribible. busca simple.cpp TimedSleepEx llama a la API SleepEx real a través del puntero de función TrueSleepEx. static DWORD WINAPI TrueSleepExDWORD dwMilliseconds, BOOL bAlertable = SleepEx; DWORD WINAPI TimedSleepExDWORD...

project-rvbbit

Project RVBBIT: Linux Kernel Rootkit Proof-of-Concept 📖 Overview Project RVBBIT is an educational proof-of-concept demonstrating advanced stealth techniques used by Linux kernel rootkits. It is intended exclusively for cybersecurity research, defensive training, and understanding how modern...

thats_no_pipe

Thats no pipe Proyecto basado en Frida para interceptar la comunicación por named pipes de Windows Objetivos Este proyecto tiene como objetivo interceptar comunicaciones IPC mediante el hooking de funciones WinAPI específicas y reenviarlas a un proxy HTTP utilizando un websocket. Arquitectura La...

APKLab

APKLab The ultimate Android RE experience right inside your VS Code. APKLab seamlessly integrates the best open-source tools: Apktool, smali-lsp, Jadx, uber-apk-signer, apk-mitm and more to the excellent VS Code so you can focus on app analysis and get it done without leaving the IDE. Features...

CVE-2024-3094

CVE-2024-3094 CVE-2024-3094 Lab Environment Setup and Report CVE-2024-3094 Practice Reproduced the backdoor inserted in XZ Utils 5.6.0 and 5.6.1 in a lab environment, analyzing SSH authentication hooking status and risks. Environment Host OS : - Windows 11 Docker : Docker Desktop 28.0.1 Dockerfil...

pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

NetRipper

Description NetRipper is a post exploitation tool targeting Windows systems which uses API hooking in order to intercept network traffic and encryption related functions from a low privileged user, being able to capture both plain-text traffic and encrypted traffic before encryption/after...