blenny

Blenny is a proof-of-concept payload obfuscation tool for Windows which hides executable payload data within the icon of the executable. It is named after the sabre-toothed blenny fish, which mimmicks the behavior and looks of cleaner fish to prey on unsuspecting fish. Why? I can't recall exactly...

dark-doh

dark-doh.exe public version Purpose: Download files via DoH, or download and execute a shellcode not implemented in the public version Run example: dark-doh.exe file1 download google yourdomain.com The supporting python script for DNS zone generation added py-prepzones.py. !!! Disclaimer !!! The...

ropfuscator

Disclaimer ROPfuscator is a research proof of concept and is not intended for production use. The authors do not take any responsibility or liability for the use of the software. Please exercise caution and use at your own risk. ROPfuscator ROPfuscator is a fine-grained code obfuscation framework...

PowerShell-Deobfuscation-Exercise

PowerShell Deobfuscation Exercise An exercise to practice deobfuscating PowerShell Scripts. The variable and function name make sense once you deobfuscate a little bit! I think I'm funny 🤣 You can cheat and take out the last line and run the script to get the answer. The PowerPoint walks through...

D1rkSleep

D1rkSleep Improved version of EKKO by @5pider that Encrypts only Image Sections. Sleep obfuscation technique that uses CreateTimerQueueTimer Win32 API. Credits: https://github.com/Cracked5pider/Ekko...

garble

garble go install mvdan.cc/garble@latest or @master Offusca il codice Go eseguendo il wrapping della toolchain di Go. Richiede Go 1.27 o successivo. garble build build flags packages Lo strumento supporta anche garble test per eseguire i test con codice offuscato, garble run per offuscare ed...

Lastenzug

LastenZug This project implements a Socka4a proxy based on websockets. The client component is implemented in C compiling down to fully position independent code PIC. During the compilation process, obfuscation is applied on assembly level by leveraging a second tool: SpiderPIC located in...

PowerShell-Obfuscation-Bible

PowerShell Obfuscation Bible A collection of techniques, examples and a little bit of theory for manually obfuscating PowerShell scripts to bypass signature-based detection, compiled for educational purposes. The contents of this repository are the result of personal research, including reading...

Bin-Finder

Description This tool looks for either the processes that have a certain binary loaded or the processes that don't. This is useful in the following scenarios: It allows to detect processes where an specific EDR/AV dll is not loaded. This could lead to EDR's exception detection. It allows to obtai...

GoBfuscator

🛡️ GoBfuscator - Advanced Go Code Obfuscation Tool 🔍 Overview GoBfuscator is a professional-grade obfuscation tool specifically designed for Go Golang source code. It provides multiple layers of protection to make reverse engineering difficult while maintaining 100% runtime functionality. Key...

msynth

msynth Author: Tim Blazytko and Moritz Schloegel msynth is a code deobfuscation framework to simplify Mixed Boolean-Arithmetic MBA expressions. Given a pre-computed simplification oracle, it walks over a complex expression represented as an abstract syntax tree AST and tries to simplify subtrees...

Follina-CVE-2022-30190-Sample

Follina-CVE-2022-30190-Sample-by-ethical-blue Educational Follina Tool Version history v1.1 — JavaScript payload obfuscation v1.0 — Initial release Features .RTF payload generator Simple HTTP Server for payload Mitigation tips Configuration extractor Easy to use for learning Exploit Executed...

Malicious code in ig-gox (PyPI)

Source: kam193 780638a0747103eb44a85312a2cfb552981e498655f638c5baf86eb4a5f74042 Package hides obfuscated code aimed to avoid analysis and downloading the remote stage. The remote code is used to abuse Instagram service for mass fake account registration. --- Category: MALICIOUS - The campaign has...

qvm-tool

Driver scripts These are the analysis drivers used to produce the measurements quoted in the README and in the case notes. They are argument-driven and reusable : each takes the PE path and output paths on the command line. Run from the repository root, e.g.: python scripts/extendedcensus.py...

conf-presentations

Table of Contents Quarkslab Lectures at Conferences and Seminars Quarkslab Publications in Journals or Conference Proceedings and Preprints Quarkslab Publications in Specialized Magazines Quarkslab Hardware CTFs Quarkslab Lectures at Conferences and Seminars 2026 2026-09: Pwning bluetooth devices...

WebSafeCompiler

WebSafeCompiler WSC WebSafeCompiler WSC is an advanced utility websites compiler designed for the optimization, minification, and obfuscation if you need it of web applications and websites using Node.js. It enhances your web assets by reducing file sizes or providing durable protection against...

Obfuscapk

!IMPORTANT This project is archived and no longer maintained. Some of the most common questions are answered in FAQ and troubleshooting. A black-box obfuscation tool for Android apps. Obfuscapk is a modular Python tool for obfuscating Android apps without needing their source code, since apktool ...

SpookFlare

SpookFlare SpookFlare has a different perspective to bypass security measures and it gives you the opportunity to bypass the endpoint countermeasures at the client-side detection and network-side detection. SpookFlare is a loader/dropper generator for Meterpreter, Empire, Koadic etc. SpookFlare h...

ThunderShell

ThunderShell ThunderShell is a C RAT that communicates via HTTP requests. All the network traffic is encrypted using a second layer of RC4 to avoid SSL interception and defeat network detection on the target system. RC4 is a weak cipher and is used to help obfuscate the traffic. HTTPS options...

DKMC

Don't Kill My Cat DKMC WINDOWS 10 now limit the shellcode payload from running properly due to the need of a RWX page to decode and execute the shellcode. DKMC can be update the set a memory page with properly permission. Don't kill my cat is a tool that generates obfuscated shellcode that is...