UnhookMe

UnhookMe - Dynamically unhooking imports resolver In the era of intrusive AVs and EDRs that introduce hot-patches to the running processes for their enhanced optics requirements, modern adversaries must have a robust tool to slide through these watchguards. The propsed implementation of dynamic...

RedTeaming-Tactics-and-Techniques

description: - These are notes about all things focusing on, but not limited to, red teaming and offensive security. What is ired.team notes? This is publicly accessible personal red teaming notes at https://ired.team and https://github.com/mantvydasb/RedTeam-Tactics-and-Techniques about my...

Awesome-WAF

Awesome WAF Everything about web application firewalls WAFs from a security perspective. 🔥 Foreword: This was originally my own collection on WAFs. I am open-sourcing it in the hope that it will be useful for pentesters and researchers out there.As the saying goes, "the community just learns from...

micr0_shell

micr0 shell Micr0shell is a lightweight and efficient Python script designed for dynamically generating Windows X64 Position-Independent Code PIC Null-Free reverse shell shellcode. Depending on the options selected, the generated shellcode can be up to 27 bytes smaller than comparable shellcode...

CrystalSliver

crystal-kit-sliver Crystal Palace evasion kit ported to Sliver C2. This is the first public port of rasta-mouse's Crystal-Kit Cobalt Strike to Sliver. It follows the same cross-C2 pattern proven by Crystal-Kit-Xenon Mythic. License: MIT — Copyright c 2026 Simone Licitra Target: Windows x64 only...

Chimera

Chimera Unlea$ed Tool Background While DLL sideloading can be used for legitimate purposes, such as loading necessary libraries for a program to function, it can also be used for malicious purposes. Attackers can use DLL sideloading to execute arbitrary code on a target system, often by exploitin...

Project-Onyx

Project Onyx Advanced EDR Evasion via AI Telemetry Spoofing & WASM Sandboxing. Project Onyx is a PoC Red Team pipeline designed to demonstrate advanced evasion techniques against modern EDR systems. It shifts away from traditional signature-based obfuscation towards behavioral camouflage and stri...

upx

ooooo ooo ooooooooo. ooooooo ooooo 888' 8' 888 Y88. 8888 d8' 888 8 888 .d88' Y888..8P 888 8 888ooo88P' 8888' 888 8 888 .8PY888. 88. .8' 888 d8' 888b YbodP' o888o o888o o88888o root@kitploit: The Ultimate Packer for eXecutables Copyright c 1996-2026 Markus Oberhumer, Laszlo Molnar & John Reiser...

Singularity

Singularity - Stealthy Linux Kernel Rootkit "Shall we give forensics a little work?" This project was inspired by a very special woman to me: Mocinha Singularity is a powerful Linux Kernel Module LKM rootkit designed for modern 6.x kernels. It provides comprehensive stealth capabilities through...

NoDPI

NoDPI Say NO to blocking!...

TelemetrySourcerer

Telemetry Sourcerer Introduction Telemetry Sourcerer can enumerate and disable common sources of telemetry used by AV/EDR on Windows. Red teamers and security enthusiasts can use this tool in a lab environment to: Identify collection-based blind spots in the products they're up against. Determine...

al-khaser

Al-Khaser v0.81 Content Introduction Possible uses Features Anti-debugging attacks Anti-Dumping Timing Attacks Human Interaction Anti-VM Anti-Disassembly Requirements License Introduction al-khaser is a PoC "malware" application with good intentions that aims to stress your anti-malware system. I...

SharpHide

SharpHide Just a nice persistence trick to confuse DFIR investigation. Uses NtSetValueKey native API to create a hidden null terminated registry key. This works by adding a null byte in front of the UNICODESTRING key valuename. More info about this technique can be found in the following...

mhr-cfw

MHR-CFW MITM Domain-Fronted HTTP Relay + Cloudflare Worker Exit English| Persian ---|--- How It Works 1 - GAS + Cloudflare Worker Exit root@kitploit: Client - Local Relay - Google/CDN Front - GAS Google Apps Script Relay - Cloudflare Worker - Exit | +- Shows www.google.com to network DPI filter 2...

NixImports

NixImports A .NET malware loader, using API-Hashing and dynamic invoking to evade static analysis How does it work? NixImports uses my managed API-Hashing implementation HInvoke, to dynamically resolve most of it's called functions at runtime. To resolve the functions HInvoke requires two hashes...

foolav

foolav Executable compiled with this code is useful during penetration tests where there is a need to execute some payload meterpreter maybe? while being certain that it will not be detected by antivirus software. The only requirement is to be able to upload two files: binary executable and paylo...

Coldfire

ColdFire II Golang malware development framework Table of Contents Table of Contents Introduction Installation Types of functions included Requirements Disclaimer License Introduction ColdFire II provides various methods useful for malware and security infra development in Golang. Most functions...

SecML

SecML: A library for Secure and Explainable Machine Learning SecML is an open-source Python library for the security evaluation of Machine Learning ML algorithms. It comes with a set of powerful features: Wide range of supported ML algorithms. All supervised learning algorithms supported by...

Forensia

Forensia Anti Forensics Tool For Red Teamers, Used For Erasing Some Footprints In The Post Exploitation Phase. Reduces Payload Burnout And Increases Detection Countdown. Can Be Used To Test The capabilities of Your Incident Response / Forensics Teams. Capabilities Unloading Sysmon Driver. Gutmann...

CLR-Unhook

CLR Unhooking Tool Note: For this to have the effect of a clean CLR, you’d need to manually map the DLL from disk into memory. You cannot use LoadLibraryA/W, because antivirus solutions will detect the DLL load event and may hook it immediately. If you want this behavior, you can look up existing...