BetterXencrypt

\ \ / |/ | \ / / ../ | | | // \ \ / \ \ // \ / / \ | | /\ | || \ | //\ \ | /\ | / || /|| / / / / / / / / || BetterXencrypt A better version of Xencrypt.Xencrypt it self is a Powershell runtime crypter designed to evade AVs. cause Xencrypt is not FUD anymore and easily get caught by...

GhostDriver

GhostDriver 👻 About GhostDriver is a Rust-built AV killer tool using BYOVD. Get Started 1. Install Rust from rust-lang.org 2. Clone: git clone https://github.com/BlackSnufkin/GhostDriver.git 3. Build: cargo build --release --target=x8664-pc-windows-msvc 4. Run: Execute the GhostDriver binary Usag...

nimcrypt

nimcrypt Nimcrypt is a .NET PE Crypter written in Nim, based entirely on the work of @byt3bl33d3r's OffensiveNim project: https://github.com/byt3bl33d3r/OffensiveNim This tool was inspired by @S3cur3Th1sSh1t's blog post a few months ago, as it's essentially just a full PoC of what he presented:...

PSSW100AVB

⚡ PSSW100AVB ⚡ PowerShell Detection Evasion & Sandbox Research PowerShell Scripts With 100% AV Bypass PSSW100AVB Repository Behavioral Analysis • AV Research • Adversary Simulation PSSW100AVB Repository Description This repository contains PowerShell scripts designed for penetration testing...

wmiexec-Pro

wmiexec-Pro New generation of wmiexec.py. Table of Contents 1. Info 2. Special thanks 3. Features 4. Getting Started Installation 5. Usage 6. Screenshots 7. How it works? 8. Disclaimer 9. References Info The new generation of wmiexec.py, more new features, whole the operations only work with port...

ThreatCheck

ThreatCheck Modified version of Matterpreter's DefenderCheck. Takes a binary as input either from a file on disk or a URL, splits it until it pinpoints that exact bytes that the target engine will flag on and prints them to the screen. This can be helpful when trying to identify the specific bad...

PolyEngine

PolyEngine — Polymorphic PE Packer 📦 PolyEngine is a research-grade, evasive PE packer designed for CTF challenges and low-level Windows security education. It focuses on bypassing EDR and AV heuristics through a layered stack of in-memory execution and obfuscation techniques. This is a side...

BypassUAC

README This program is based on whitelist bypassuac. Using CS's AV-bypassing payload, you can directly get a session with UAC privileges. Usage: bypassuac.exe The demo effect is as follows whoami /priv as follows hashdump captures passwords as follows Bypass-AV Effect Windows Defender test passed...

zombie-zip

Zombie ZIP ZIP format confusion technique that evades 98% of antivirus engines. CVE-2026-0866 | VU976247 | Published March 10, 2026 The Technique Create a ZIP file where: Compression Method = 0 STORED Actual data = DEFLATE compressed CRC-32 = Checksum of uncompressed payload AV Engine: Reads Meth...

UnhookMe

UnhookMe - Dynamically unhooking imports resolver In the era of intrusive AVs and EDRs that introduce hot-patches to the running processes for their enhanced optics requirements, modern adversaries must have a robust tool to slide through these watchguards. The propsed implementation of dynamic...

AggressorScripts

Aggressor Scripts Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources AllInOne.cna v1 - Removed and outdated All purpose script to enhance the user's experience with cobaltstrike. Custom menu creation, Logging, Persistence, Enumeration, and 3rd party script...

CobaltWhispers

CobaltWhispers Author: @Cerbersec CobaltWhispers is an aggressor script that utilizes a collection of Beacon Object Files for Cobalt Strike to perform process injection, persistence and more, leveraging direct syscalls to bypass EDR/AV. CobaltWhispers is powered by SysWhispers2 and InlineWhispers...

LightsOut

LightsOut LightsOut will generate an obfuscated DLL that will disable AMSI & ETW while trying to evade AV. This is done by randomizing all WinAPI functions used, xor encoding strings, and utilizing basic sandbox checks. Mingw-w64 is used to compile the obfuscated C code into a DLL that can be...

Java-Shellcode-Loader

Java ShellCode Loader A ShellCode loader implemented in Java, compatible with 32-bit and 64-bit platforms. The core principle is to use Jna to call Windows APIs to achieve shellcode injection. Runtime environment: Jre = 1.5 Note: This project is already integrated into the ShellCodeLoader module ...

inceptor

🚩 This is the public repository of Inceptor, for latest version and updates please consider supporting us through https://porchetta.industries/ 🚩 Sponsors If you want to sponsors this project and have the latest updates on Inceptor, latest issues fixed, latest features, please support us on...

blindsight

blindsight "There's no such things as survival of the fittest. Survival of the most adequate, maybe. It doesn't matter whether a solution's optimal. All that matters is whether it beats the alternative." -- Peter Watts, Blindsight 2006 Red teaming tool to dump LSASS memory, bypassing basic...

TheFatRat

TheFatRat A Massive Exploiting Tool TheFatRat is an exploiting tool which compiles a malware with famous payload, and then the compiled maware can be executed on Linux , Windows , Mac and Android. TheFatRat Provides An Easy way to create Backdoors and Payload which can bypass most anti-virus...

OffensiveCpp

OffensiveCpp Offensive C++ is a collection of offensive security snippets written in C++. It includes various tools for penetration testing and exploit development. Table of Contents OffensiveCpp Introduction Why C/C++? Compiling Reference Libraries Contributing License Introduction The purpose o...

hades

About Hades is a proof of concept loader that combines several evasion technques with the aim of bypassing the defensive mechanisms commonly used by modern AV/EDRs. Usage The easiest way, is probably building the project on Linux using make. git clone https://github.com/f1zm0/hades && cd hades ma...

Insanity-Framework

Insanity-Framework THIS PROJECT ARE CLOSED NOW - FEEL FREE TO CONTINUE IT Copyright 2017 Insanity Framework IF 2.0 END Written by: Alisson Moretto - 4w4k3 Special Thanks to Thomas Perkins - Ekultek Insanity Payload consists of encrypting your code and decrypting it in memory, thus avoiding a...