APKLab

APKLab The ultimate Android RE experience right inside your VS Code. APKLab seamlessly integrates the best open-source tools: Apktool, smali-lsp, Jadx, uber-apk-signer, apk-mitm and more to the excellent VS Code so you can focus on app analysis and get it done without leaving the IDE. Features...

HookCase

HookCase HookCase is a tool for debugging and reverse engineering applications on macOS aka OS X, and the operating system itself. It re-implements and extends Apple's DYLDINSERTLIBRARIES functionality. It can be used to hook any method in any module even non-exported ones, and even those that...

NoArgs

NoArgs: Manipulating and Hiding Process Arguments Twitter: @AzizWho Disclaimer: Educational Use Only This tool is intended solely for educational purposes. I am not liable for any misuse and all users must adhere to applicable laws. Illegal use is prohibited. Introduction NoArgs is a tool designe...

NetRipper

Description NetRipper is a post exploitation tool targeting Windows systems which uses API hooking in order to intercept network traffic and encryption related functions from a low privileged user, being able to capture both plain-text traffic and encrypted traffic before encryption/after...

ThievingFox

ThievingFox ThievingFox is a collection of post-exploitation tools to gather credentials from various password managers and windows utilities. Each module leverages a specific method of injecting into the target process, and then hooks internals functions to gather crendentials. The accompanying...

makin

I create makin to make initial malware assessment little bit easier for me, I think it's useful for others as well, It helps to reveal a debugger detection techniques used by a sample. Any feedback is greatly appreciated: @qazqaz How does it work? makin opens a sample as a debuggee and injects...

RdpThief

RdpThief RdpThief by itself is a standalone DLL that when injected in the mstsc.exe process, will perform API hooking, extract the clear-text credentials and save them to a file. An aggressor script accompanies it, which is responsible for managing the state, monitoring for new processes and...

ring3-kit

ring3-kit Hides Process From Task Manager Using NT Hooking NtQuerySystemInformation. A simple Ring-3 user mode rootkit. How Hook the API function NtQuerySystemInformation with our own function that hides a process from task manager Hooked function gets called instead The DLL is injected into...

r77-rootkit

r77 Rootkit Fileless ring 3 rootkit r77 is a ring 3 rootkit that hides everything: Files, directories Processes & CPU/GPU usage Registry keys & values Services TCP & UDP connections Junctions, named pipes, scheduled tasks Hiding by prefix Everything that starts with "$77" is hidden. Configuration...

RunAs-Stealer

RunAs-Stealer RunAs Utility Credential Stealer implementing 3 techniques : Hooking CreateProcessWithLogonW, Smart Keylogging, Remote Debugging Usage The stealers are running in a while loop the injector also in Hooking case in the background, to kill them use Task Manager. The stolen credentials...

CS-MemoryEvasion

MemoryEvasion A Cobalt Strike memory evasion loader for redteamers,Support x86/x64 stager/stagerless payload with profiletested on windows7/10,winserver 2012 How Evasion? Hook Sleep,CreateProcessA,CreateHeap,GetProcessHeap functions before the shellcode is loaded into memory. Create a new heap fo...

hookchain

Hookchain Abstract - EN In the current digital security ecosystem, where threats evolve rapidly and with complexity, companies developing Endpoint Detection and Response EDR solutions are in constant search for innovations that not only keep up but also anticipate emerging attack vectors. In this...

Hooketh

Hooketh A set of scripts that ease working with Frida, tailored to help finding the correct function to hook to and then modify it. Usage For both of the scripts, I assume you have a device connected via USB or have an emulator running on the same machine. Install frida on your machine and ensure...

Frida-Labs

This repository contains a series of challenges designed for learning Frida for Android. These are not like hardcore Capture The Flag CTF applications but will help you to start with Frida and its commonly used APIs. If you are entirely new to Frida, this is the perfect repository to get started....

xnuspy

xnuspy Output from the kernel log after compiling and running example/open1hook.c xnuspy is a pongoOS module that installs a new system call, xnuspyctl, which allows you to hook kernel functions from userspace. It supports iOS 13.x, iOS 14.x, and iOS 15.x on checkra1n 0.12.2 and up. 4K devices ar...

RMS-Runtime-Mobile-Security

Runtime Mobile Security RMS 📱🔥 by @mobilesecurity Runtime Mobile Security RMS , powered by FRIDA, is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime. With RMS you can easily dump all loaded classes and relative methods, hook everything on the fly, trace metho...

frida-wshook

frida-wshook frida-wshook is an analysis and instrumentation tool which uses frida.re to hook common functions often used by malicious script files which are run using WScript/CScript. The tool intercepts Windows API functions and doesn't implement function stubs or proxies within the targeted...

pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

KernelPatch

KernelPatch Patching and hooking the Linux kernel with only stripped Linux kernel image. | |/ / | | \ | | | | | ' // \ '| ' \ / \ | | / | / | ' \ | . \ / | | | | | / | / | | || | | | | ||\|| || ||||| ,|\|| || Obtain all symbol information without source code and symbol information. Inject...

Introspy-iOS

Introspy-iOS Blackbox tool to help understand what an iOS application is doing at runtime and assist in the identification of potential security issues. See http://isecpartners.github.io/Introspy-iOS/ for a quick introduction. Description This is the repository for the Introspy-iOS tracer. The...