peframe

======= peframe peframe is a open source tool to perform static analysis on Portable Executable malware and generic suspicious file. It can help malware researchers to detect packer, xor, digital signature, mutex, anti debug, anti virtual machine, suspicious sections and functions, macro and much...

CobaltStrikeParser

CobaltStrikeParser Python parser for CobaltStrike Beacon's configuration Description Use parsebeaconconfig.py for stageless beacons, memory dumps or C2 urls with metasploit compatibility mode default true. Many stageless beacons are PEs where the beacon code itself is stored in the .data section...

hashdb-ida

HashDB IDA Plugin Malware string hash lookup plugin for IDA Pro. This plugin connects to the OALABS HashDB Lookup Service. Adding New Hash Algorithms The hash algorithm database is open source and new algorithms can be added on GitHub here. Pull requests are mostly automated and as long as our...

headscale

An open source, self-hosted implementation of the Tailscale control server. Join our Discord server for a chat. Note: Always select the same GitHub tag as the released version you use to ensure you have the correct example configuration. The main branch might contain unreleased changes. The...

VULNERAVEL-CVE-2018-14847---CREDENCIAIS-EXTRAIDAS

Pentest Tools — /network Repository of scripts for auditing and penetration testing of networks. Use only on devices with formal authorization. CVE-2018-14847 — MikroTik Winbox Credential Extractor Description Exploits the unauthenticated file read vulnerability in the MikroTik RouterOS Winbox...

Sharperner

Sharperner Sharperner is a tool written in CSharp that generate .NET dropper with AES and XOR obfuscated shellcode. Generated executable can possibly bypass signature check but I cant be sure it can bypass heuristic scanning. Features PE binary Process Hollowing PPID Spoofing Random generated AES...

xortool

xortool.py A tool to do some xor analysis: guess the key length based on count of equal chars guess the key base on knowledge of most frequent char Notice: xortool is now only running on Python 3. The old Python 2 version is accessible at the py2 branch. The pip package has been updated...

NoMoreXOR

NoMoreXOR.py Tool to help guess a files 256 byte XOR key by using frequency analysis. Usage usage: NoMoreXOR.py -h -a -c -xor key -g -o outfile -y YARARULES Path Tool to help guess a files 256 byte XOR key by using frequency analysis. positional arguments: Path Path to file to be analyzed optiona...

dark-doh

dark-doh.exe public version Purpose: Download files via DoH, or download and execute a shellcode not implemented in the public version Run example: dark-doh.exe file1 download google yourdomain.com The supporting python script for DNS zone generation added py-prepzones.py. !!! Disclaimer !!! The...

KasperMeow

Kaspersky arkmon.sys KASLR Bypass via Kernel Debug Log Leak Kaspersky's anti-rootkit monitor driver arkmon.sys stores a kernel debug log containing raw kernel pointers. The log is "encrypted" with XOR 0xCC + ROT13 - trivially reversible. Any admin user can read and decrypt this log via IOCTL,...

forticrack_v8

Forticrack v8.0.0 Decrypt and extract FortiOS 8.0.0 firmware images. This script extends Bishop Fox's Forticrack to support 8.0.0 firmware images. Also, RandoriSec's article on FortiGate 7.4.7 firmware encryption was really helpful to reverse the encryption for FortiOS 8.0.0, since it looks like ...

Killer

KILLER TOOL EDR Evasion It's a AV/EDR Evasion tool created to bypass security tools for learning, until now the tool is FUD. Features: Module Stomping for Memory scanning evasion DLL Unhooking by fresh ntdll copy IAT Hiding and Obfuscation & API Unhooking ETW Patchnig for bypassing some security...

peda

peda PEDA - Python Exploit Development Assistance for GDB Key Features: Enhance the display of gdb: colorize and display disassembly codes, registers, memory information during debugging. Add commands to support debugging and exploit development for a full list of commands use peda help: aslr --...

NorthStarC2

NorthStarC2 is an open-source command and control framework developed for penetration testing and red teaming purposes by Engin Demirbilek. NorthStar C2 Framework consists of two applications, a server-side GUI web application for managing sessions and a client-side stager to communicate with C2...

svg_phishing_tools

SVG Security Analysis Toolkit - Tool Documentation This toolkit contains specialized Python tools for analyzing potentially malicious SVG files and detecting security mechanisms. Overview The toolkit consists of four main tools: 1. extract.py - Static analysis for obfuscated URL extraction 2...

SHGenOb

SHGenOB: Shellcode Generator from PIC C Code Introduction SHGenOB is a Python-based tool designed to generate shellcode from Position Independent Code PIC written in C. It automates the process of compiling C code, extracting the .text section, and optionally encrypting the resulting shellcode...

PULSE-C2

PULSE C2 Framework HTTPS Command & Control infrastructure with web dashboard for remote Windows agent management. ⚠️ Educational Use Only - Illegal use = your responsibility. Features HTTPS C2 server with TLS encryption Flask Real-time web dashboard XOR + Base64 encrypted protocol SQLite database...

cryptovenom

CryptoVenom CryptoVenom: The Cryptography Swiss Army knife What is CryptoVenom? CryptoVenom is an OpenSource tool which contains a lot of cryptosystems and cryptoanalysis methods all in one, including classical algorithms, hash algorithms, encoding algorithms, logic gates, mathematical functions,...

KPOT-string-decrypter

KPOT-string-decrypter IDA python scripts for decrypting KPOT stealer's strings and setting those as comments next to the var that would receive them during runtime. It works as follows: Gets the offset that's passed on eax to either decryption function there are two, which is why this repo has tw...

LoadReload

LoadReload Shellcode Loader based on what i did for my Master Thesis, designed for Sliver-Shellcode smaller than 25MB..... !Note Features: Multibyte-XOR Decryption of Payload Fetches Payload locally Anti-Emulation by BusySleep-Function via KUSERSHAREDDATA RW-RX-Loop for EDR-Deconditioning / Wasti...