TangledWinExec

Tangled WinExec This repository is for investigation of Windows process execution techniques. Most of PoCs are given a name corresponding to the technique. Projects BlockingDLL : This toolset is for testing blocking DLL process. See README.md. CloneProcess : This directory is for process forking...

laZzzy

laZzzy laZzzy is a shellcode loader that demonstrates different execution techniques commonly employed by malware. laZzzy was developed using different open-source header-only libraries. Features Direct syscalls and native Nt functions not all functions but most Import Address Table IAT evasion...

dnschef

| | version 0.4 | | / | | | | | | | / | ' / |/| ' \ / \ | | | | | | \ | | | | / | ,|| | |/ || ||| | D O C U M E N T A T I O N DNSChef is a highly configurable DNS proxy for Penetration Testers and Malware Analysts. A DNS proxy aka "Fake DNS" is a tool used for application network traffic analysis...

TamperingSyscalls

TamperingSyscalls TamperingSyscalls is a 2 part novel project consisting of argument spoofing and syscall retrival which both abuse EH in order to subvert EDRs. This project consists of both of these projects in order to provide an alternative solution to direct syscalls. Tampering with syscalls...

Espionage

Espionage - A Network Traffic Interceptor For Linux Featured In About Espionage Espionage is a network packet sniffer that intercepts large amounts of data being passed through an interface. The tool allows users to to run normal and verbose traffic analysis that shows a live feed of traffic,...

TokenPlayer

TokenPlayer Manipulating and Abusing Windows Access Tokens. TokenPlayer is just a small tool i made to learn win32 api programming and understand better the access token model of windows. Features: Stealing and Impersonating primary tokens. Impersonating Protected Processes. Bypassing UAC by usin...

Shelter

Shelter Shelter is a completely weaponized sleep obfuscation technique that allows to fully encrypt your in-memory payload making an extensive use of ROP. This crate comes with the following characteristics: AES-128 encryption. Whole PE encryption capability. Removal of execution permission durin...

hacktronian

Pentesing Tools That All Hacker Needs. HACKTRONIAN Menu : Information Gathering Password Attacks Wireless Testing Exploitation Tools Sniffing & Spoofing Web Hacking Private Web Hacking Post Exploitation Install The HACKTRONIAN Information Gathering: Nmap Setoolkit Port Scanning Host To IP wordpre...

kickthemout

KickThemOut KickThemOut - Kick Devices Off Your Network A tool to kick devices out of your network and enjoy all the bandwidth for yourself. It allows you to select specific or all devices and ARP spoofs them off your local area network. Compatible with Python 3+ 🎉. Not compatible with Windows...

ppid-spoofing

https://www.countercept.com/blog/detecting-parent-pid-spoofing/...

Project-Onyx

Project Onyx Advanced EDR Evasion via AI Telemetry Spoofing & WASM Sandboxing. Project Onyx is a PoC Red Team pipeline designed to demonstrate advanced evasion techniques against modern EDR systems. It shifts away from traditional signature-based obfuscation towards behavioral camouflage and stri...

IG-Detective

IG-Detective 🕵️‍♂️📸 Created by@shredzwho | 💖 Sponsor this project IG-Detective is a high-performance, Python-based Open Source Intelligence OSINT tool for Instagram. It offers a premium interactive shell to perform deep analysis on Instagram accounts, extract location history, mapping interactions,...

CVE-2018-25031

CVE-2018-25031 Description: Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Screenshot before attack: PoC:...

CallStackMasker

CallStackMasker This repository demonstrates a PoC technique for dynamically spoofing call stacks using timers. Prior to our implant sleeping, we can queue up timers to overwrite its call stack with a fake one and then restore the original before resuming execution. Hence, in the same way we can...

CVE-2025-24071

CVE-2025-24071 CNA: Microsoft Corporation Published: 2025-03-11 Updated: 2025-03-13 Title: Microsoft Windows File Explorer Spoofing Vulnerability Description Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing ove...

bonesi

BoNeSi BoNeSi , the DDoS Botnet Simulator is a Tool to simulate Botnet Traffic in a testbed environment on the wire. It is designed to study the effect of DDoS attacks. What traffic can be generated? BoNeSi generates ICMP, UDP and TCP HTTP flooding attacks from a defined botnet size different IP...

cve-2022-28944

CVE-2022-28944 EMCO Software Multiple Products Unauthenticated Update Remote Code Execution Vulnerability. Usage: python3 cve-2022-28944poc.py Details in the report at gerr.re. Steps to reproduce 1. Install an affected product of EMCO Software; 2. Set spoof storage.emcosoftware.com to our attacke...

ExtensionSpoofer

ExtensionSpoofer ExtensionSpoofer is a Visual Basic .NET desktop app that demonstrates how file names and icons can be visually manipulated on Windows while the underlying executable file type remains unchanged. It uses the Unicode Right-to-Left Override character U+202E to reverse displayed...

Spoofy

Spoofy WHAT Spoofy is a program that checks if a list of domains can be spoofed based on SPF and DMARC records. You may be asking, "Why do we need another tool that can check if a domain can be spoofed?" Well, Spoofy is different and here is why: 1. Custom, manually tested spoof logic No guessing...

SMSOTPBOT

ghost-OTPBOT ghost-OTPBOT is the most advanced and versatile OTP & SMS capture bot that is capable of getting OTP & SMS codes from victims by impersonating a company or bank. You can use this to get OTP for logins, banks, credit cards, apple pay, and more. Join...