PULSE-C2

PULSE C2 Framework HTTPS Command & Control infrastructure with web dashboard for remote Windows agent management. ⚠️ Educational Use Only - Illegal use = your responsibility. Features HTTPS C2 server with TLS encryption Flask Real-time web dashboard XOR + Base64 encrypted protocol SQLite database...

LoadReload

LoadReload Shellcode Loader based on what i did for my Master Thesis, designed for Sliver-Shellcode smaller than 25MB..... !Note Features: Multibyte-XOR Decryption of Payload Fetches Payload locally Anti-Emulation by BusySleep-Function via KUSERSHAREDDATA RW-RX-Loop for EDR-Deconditioning / Wasti...

hashdb-ida

HashDB IDA Plugin Malware string hash lookup plugin for IDA Pro. This plugin connects to the OALABS HashDB Lookup Service. Adding New Hash Algorithms The hash algorithm database is open source and new algorithms can be added on GitHub here. Pull requests are mostly automated and as long as our...

xortool

xortool.py A tool to do some xor analysis: guess the key length based on count of equal chars guess the key base on knowledge of most frequent char Notice: xortool is now only running on Python 3. The old Python 2 version is accessible at the py2 branch. The pip package has been updated...

Simple-Polymorphic-Engine-SPE32

Simple Polymorphic Engine — SPE32 Simple Polymorphic Engine SPE32 is a simple polymorphic engine for encrypting code and data. SPE32 allows you to encrypt any data and generate a unique decryption code for this data. The encryption algorithm uses randomly selected instructions and encryption keys...

cypher

🌹 CYPHER TOOLS 🌹 Written by TMRSWRR Version 1.0.0 All in one tools for CRYPTOLOGY. Instagram: Capture the Root 🖼️ Screenshots 🖼️ 📹 How to use 📹 Click on the image... 🧰 Features 🧰 This tool include: 📍 HASH 📍 RSA 📍 XOR 📍 AES ECC 📍 AES CBC 📍 DES ECB 📍 FERNET 📍 RC2 📍 RC4 📍 CHACHA20POLY1305 📍...

XorStringsNET

XorStringsNET A tool for simple and quick XOR based string encryption of .NET binaries XORStrings implements a simple XOR based cipher, I call RXOR. RXOR does not only encrypt the string but also reverses its character order. Each string is encrypted with a unique key. The arguments used by the...

Vidar-Stealer-Chrome-Injection-Malicious-JS-Targeting-Google-Reddit-Sessions-Analysis

1. Binary Ninja – Obfuscation & In-Memory Payload Construction The Vidar Stealer sample loaded in Binary Ninja displays heavily obfuscated code within the main.vxormo function. The analysis reveals that the malware relies on string encryption, custom XOR routines, and runtime memory assembly to...

encdecshellcode

Shellcode-Encrypter-Decrypter A Shellcode Encrypter & Decrypter, Using XOR Cipher to enc and dec shellcode. Installation git clone https://github.com/blacknbunny/Shellcode-Encrypter-Decrypter.git && cd Shellcode-Encrypter-Decrypter/ python encdecshellcode.py --help Usage Example Encryption: pytho...

wsh

wsh wsh pronounced woosh is a web shell generator and command line interface. This started off as just an http client since interacting with webshells is a pain. There's a form, to send a command you have to type in an input box and press a button. I wanted something that fits into my workflow...

Sharperner

Sharperner Sharperner is a tool written in CSharp that generate .NET dropper with AES and XOR obfuscated shellcode. Generated executable can possibly bypass signature check but I cant be sure it can bypass heuristic scanning. Features PE binary Process Hollowing PPID Spoofing Random generated AES...

Shellcrypt

Shellcrypt A single-file cross-platform quality of life tool to obfuscate a given shellcode file and output in a useful format for pasting directly into your source code. Contributors These are going here because they deserve it An00bRektn github twitter ♥ 0xtejas github Encryption Methods...

FUD-UUID-Shellcode

FUD-UUID-Shellcode Introduction Another shellcode injection technique using C++ that attempts to bypass Windows Defender using XOR encryption sorcery and UUID strings madness :. How it works Shellcode generation Firstly, generate a payload in binary format using either Havoc, CobaltStrike or...

HeapCrypt

HeapCrypt Encypting the Heap while sleeping by hooking and modifying Sleep with our own function that encrypts the heap , sleeps for a moment then decrypts the heap : 16bit key xor heap encryption : 16bit key xor heap decryption : References : https://www.arashparsa.com/hook-heaps-and-live-free/...

NoMoreXOR

NoMoreXOR.py Tool to help guess a files 256 byte XOR key by using frequency analysis. Usage usage: NoMoreXOR.py -h -a -c -xor key -g -o outfile -y YARARULES Path Tool to help guess a files 256 byte XOR key by using frequency analysis. positional arguments: Path Path to file to be analyzed optiona...

cryptovenom

CryptoVenom CryptoVenom: The Cryptography Swiss Army knife What is CryptoVenom? CryptoVenom is an OpenSource tool which contains a lot of cryptosystems and cryptoanalysis methods all in one, including classical algorithms, hash algorithms, encoding algorithms, logic gates, mathematical functions,...

headscale

An open source, self-hosted implementation of the Tailscale control server. Join our Discord server for a chat. Note: Always select the same GitHub tag as the released version you use to ensure you have the correct example configuration. The main branch might contain unreleased changes. The...

NorthStarC2

NorthStarC2 is an open-source command and control framework developed for penetration testing and red teaming purposes by Engin Demirbilek. NorthStar C2 Framework consists of two applications, a server-side GUI web application for managing sessions and a client-side stager to communicate with C2...

DAws

Hello everyone, About There's multiple things that makes DAws better than every Web Shell out there: 1. Bypasses Security SystemsIPS, WAFs,etc like Suhosinuses up to 20 php functions just to get a command executed. 2. Drops CGI Shells and communicate with them to bypass Security Systems. 3. Uses...

doublepulsar-c2-traffic-decryptor

Author: Luke Jennings [email protected] - @jukelennings Company: Countercept @countercept Website: https://countercept.com A python2 script for decrypting the C2 traffic used by the DOUBLEPULSAR SMB implant from a PCAP file. The encryption used is a simple 4-byte XOR, which you can often see...