pybeacon

PyBeacon PyBeacon is a collection of scripts for dealing with Cobalt Strike's encrypted traffic. It can encrypt/decrypt beacon metadata, as well as parse symmetric encrypted taskings Scripts included There is a small library which includes encryption/decoding methods, however some example scripts...

neurax

A framework that aids in creation of self-spreading software Overview With help of Neurax, Golang binaries can spread on LAN/WAN without using any external servers. Diverse config options and command stagers allow rapid propagation across various wireless environments. Example code package main...

WSC2

WSC2 LAST/CURRENT VERSION: 0.1 Author: Arno0x0x - @Arno0x0x WSC2 is a PoC of using the WebSockets and a browser process to serve as a C2 communication channel between an agent, running on the target system, and a controller acting as the actuel C2 server. The tool is distributed under the terms o...

Lucky-Spark

LUCKY-SPARK ⟪ LUCKY-SPARK ⟫ is a stager designed for shellcode payloads staged with http/https like sliver or on github raw. It uses modern obfuscation and evaion methods like sliding window just-in-time decryption of the payload and cpu instruction patching. By default it creates an executable...

Sandman

Sandman Sandman is a backdoor that is meant to work on hardened networks during red team engagements. Sandman works as a stager and leverages NTP a protocol to sync time & date to get and run an arbitrary shellcode from a pre-defined server. Since NTP is a protocol that is overlooked by many...

java-stager

java-stager A PoC Java Stager which can download, compile, and execute a Java file in memory. This is for research purposes only, do not use this where you are unauthorised to do so. What is this? This is based on the work of James Williams from his talk "Next Gen AV vs My Shitty Code" available...

NorthStarC2

NorthStarC2 is an open-source command and control framework developed for penetration testing and red teaming purposes by Engin Demirbilek. NorthStar C2 Framework consists of two applications, a server-side GUI web application for managing sessions and a client-side stager to communicate with C2...

CVE-2022-42475

CVE-2022-42475 Background This is the exploit for the blog post here: https://bishopfox.com/blog/exploit-cve-2022-42475 Redacted Version This version of the exploit will not work without you, the hacker, supplying the necessary memory addresses for ROP gadgets, etc. The work to determine these da...

veneficus

@abraxasnull · [email protected] · abraxaslabs.tech · github.com/abraxas/veneficus Credit: @YoSoth0 Veneficus Mini v3.0 Windows 10/11 x64 implant kit: a PowerShell stager , a Rust PE , and a Cloudflare Worker that pages the operator on Telegram. The stager resources/loader.ps1 is meant to...

java-stager

java-stager Un Stager Java de PoC que puede descargar, compilar y ejecutar un archivo Java en memoria. Esto es solo para fines de investigación, no lo uses donde no estés autorizado. ¿Qué es esto? Esto se basa en el trabajo de James Williams de su charla "Next Gen AV vs My Shitty Code" disponible...

NewPowerDNS

NewPowerDNS NewPowerDNS is an updated version of @domchell's PowerDNS. The main feature added is support for transferring files using DNS A records. See below for a complete list of the modifications made: Support for transfer over DNS A records Gzip compression to reduce file transfer size Suppo...

jscpwn

CVE-2016-4622 PoC exploit for CVE-2016-4622. Find a detailed writeup of the bug on phrack...

MAL-2026-16463 Malicious code in godzzz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39f05673527822a16dc88d65a9ff9471548f8046fc28c7930fd8958dbcc38f3a The npm package [email protected] ships cdpinject.js which imports http, https, childprocess and fs at the top of the file, reads process.env including...

SideCopy Threat Intel: MSHTA-driven Execution and RAT Deployment

SideCopy Threat Intel: MSHTA-driven Execution and RAT Deployment By Boggavarapu R S S Srinivas Gupta and Ravishankar N C · September 17, 2026 Introduction The modern cyber warfare landscape has evolved significantly as threat actors pivot toward simple yet highly effective and evasive malware...

SideCopy Threat Intel: MSHTA-driven Execution and RAT Deployment

SideCopy Threat Intel: MSHTA-driven Execution and RAT Deployment By Boggavarapu R S S Srinivas Gupta and Ravishankar N C · September 17, 2026 Introduction The modern cyber warfare landscape has evolved significantly as threat actors pivot toward simple yet highly effective and evasive malware...

Malicious code in tailwindcss-contact-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc68c81374c5b78e36fea2f599c5e0004ead6e56dfd02b40cec4f73c62193b30 The package presents itself as a Tailwind CSS forms plugin README, repository field, and installation docs are copied verbatim from @tailwindcss/form...

veneficus

@abraxasnull · [email protected] · abraxaslabs.tec...

Malicious code in 2fasecretkey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 776f74322ea1fc554c37d759c1a038d8647779b1e2b3ce51e3fd4c865118e094 On npm install, the package's postinstall script performs an HTTP GET to http://185.14.92.233:7777/p.js, writes the response to a temp file, and...

MAL-2026-15548 Malicious code in 2fasecretkey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 776f74322ea1fc554c37d759c1a038d8647779b1e2b3ce51e3fd4c865118e094 On npm install, the package's postinstall script performs an HTTP GET to http://185.14.92.233:7777/p.js, writes the response to a temp file, and...

Malicious code in streak-key-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c569633a277a8a3374b8ca058ec451a726d110cca3599f429bfe72d6d2b7a7b6 index.mjs advertises itself as a dependency-free, browser-safe day-math helper that 'touches no network and no filesystem,' but the file body contain...