shellen

Shellen General Shellen is an interactive shellcoding environment. If you want a handy tool to write shellcodes, then shellen may be your friend. Shellen can also be used as an assembly or disassembly tool. keystone and capstone engines are used for all of shellen's operations. Shellen only works...

RogueAssemblyHunter

. . \ / \ | | | .. | // \ / | | / \ / / \ \ / // // \ / | | | // | /\ / / | \ \ \ /| Y Y \ \ \ | | || // /|/ | / || / // | / // / / / / / / / / / | \ / | / \ | / \ / \ Y / | / | \ | \ /| | / | /|/|| /| | / / / Rogue Assembly Hunter Rogue Assembly Hunter is a utility for discovering 'interesting'...

ADSearch

ADSearch A tool written for cobalt-strike's execute-assembly command that allows for more efficent querying of AD. Key Features List all Domain Admins Custom LDAP Search Connect to LDAPS Servers Output JSON data from AD instances Retrieve custom attributes from a generic query i.e. All computers...

shellme

shellme لأنك في بعض الأحيان تحتاج فقط إلى شيلكود shellcode وأوبكود opcodes بسرعة. هذا يغلّف في الأساس بعض استدعاءات nasm/objdump في سكريبت أنيق. root@kitploit: bryan@devbox:/shellme$ python shellme.py usage: shellme.py -h -n FILE -o OUTPUT -i INSTRUCTION -a ARCH optional arguments: -h, --help sho...

shellcode2assembly

ShellcodeToAssembly Replace in shellcodetoasm.py with your shellcode. Endian type is little endian. root@kitploit: shellcode = '' Installation git clone https://github.com/blacknbunny/ShellcodeToAssembly.git && cd ShellcodeToAssembly/ && pip2 install -r requirements.txt && python2 shellcodetoasm....

BOF_ExecuteAssembly

BOF Execute-Assembly Beacon Object File for Cobalt Strike that executes .NET assemblies in beacon with evasion techniques. Overview Core Architecture root@kitploit: ┌──────────────────────────────────────────────────────────────────────────────┐ │ Cobalt Strike Beacon │ │ Parent Process │...

dnSpy

dnSpyEx dnSpyEx is an unofficial continuation of the dnSpy project which is a debugger and .NET assembly editor. You can use it to edit and debug assemblies even if you don't have any source code available. Main features: Debug .NET and Unity assemblies Edit .NET and Unity assemblies Light and da...

Z0FCourse_ReverseEngineering

Reverse Engineering Course This course aims to take an individual from beginner to intermediate advanced is really only achieved through experience in reverse engineering. While this course focuses on Windows 64-bit, the technical knowledge applies to 32-bit Windows and the theory to any OS. The...

Mergen

Project Overview: Mergen is a tool engineered to convert Assembly code into LLVM Intermediate Representation IR. This tool is designed for: The deobfuscation or devirtualization of obfuscated binary code The enhancement of the reverse engineering process, making it more efficient and effective,...

mssqlproxy

mssqlproxy mssqlproxy هي مجموعة أدوات تهدف إلى القيام بحركة جانبية في بيئات مقيدة عبر خادم Microsoft SQL Server مخترق عبر إعادة استخدام المقابس socket reuse. يتطلب العميل impacket وامتيازات sysadmin على خادم SQL. يرجى قراءة هذه المقالة بعناية قبل المتابعة. تتكون من ثلاثة أجزاء: تجميع CLR : قم...

mssqlproxy

mssqlproxy mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse. The client requires impacket and sysadmin privileges on the SQL server. Please read this article carefully before continuing. It consists of...

NovaHypervisor

NovaHypervisor Description NovaHypervisor is a defensive x64 Intel host based hypervisor. The goal of this project is to protect against kernel based attacks either via Bring Your Own Vulnerable Driver BYOVD or other means by safeguarding defense products AntiVirus / Endpoint Protection and kerne...

inject-assembly

inject-assembly - Exécuter .NET dans un processus existant Cet outil est une alternative à l'exécution traditionnelle fork and run pour Cobalt Strike. Le chargeur peut être injecté dans n'importe quel processus, y compris le Beacon actuel. Les assemblys de longue durée continueront à s'exécuter e...

ICMP-Ghost-A-Fileless-x64-Assembly-C2-Agent

root@kitploit: |\ |\ |\ |\ |\ |\ \ |\ |\ \ \ \ | \ \ \\ \ \ |\ \ \ || \ | \ \ |||\ \ \ \ \ \ \ \ \ \\ \ \ \ \ \ \ \ \ \ \ \ \ \ |\ \ \ \ \ \ \ \\ ||\ \ \ \ \ \ \ |\ \ \ \ \ \ \ \\ \ \ \ \ \\ ||||||||\ || ||| || Fileless, pure x64 Assembly C2 implant utilizing a...

aether

Aether version : 0.9 stable release Aether is a Windows memory-forensics and threat hunting tool that scans live process memory for malicious pattern, detect injection techniques, implant signatures, reflectively loaded .NET assemblies. it works with a multi-layer confidence model that dramatical...

dllspy

DllSpy Scans compiled .NET assemblies to discover input surfaces HTTP endpoints, SignalR hubs, WCF services, gRPC services, Razor Pages, Blazor components, Azure Functions, OData endpoints, check authorization configuration, and flag security issues — all without running the application. Availabl...

GadgetToJScript

Description Un outil pour générer des gadgets sérialisés .NET capables de déclencher le chargement/l'exécution d'assemblys .NET lors de la désérialisation via BinaryFormatter à partir de scripts JS/VBS/VBA. Le gadget actuel déclenche un appel à Activator.CreateInstance lors de la désérialisation...

scare

scare - REPL et émulateur d'assemblage simple et configurable scare est un REPL et émulateur d'assemblage multi-architecture pour votre ligne de commande. Il n'existe pas beaucoup de REPL d'assemblage modernes. Ceux qui existent sont soit des applications web opaques, soit liés à une...

ropfuscator

Avertissement ROPfuscator est une preuve de concept de recherche et n'est pas destiné à une utilisation en production. Les auteurs déclinent toute responsabilité quant à l'utilisation du logiciel. Veuillez faire preuve de prudence et l'utiliser à vos propres risques. ROPfuscator ROPfuscator est u...

Lastenzug

LastenZug Этот проект реализует Socka4a-прокси на основе websockets. Клиентская часть реализована на C и компилируется в полностью позиционно-независимый код PIC. В процессе компиляции на уровне ассемблера применяется обфускация с помощью второго инструмента: SpiderPIC , расположенного в...