apiscope

ApiScope ApiScope is a Windows x64 research tool for tracing selected API calls in a new or running process. It follows DLL load events through the Windows debugger API and installs hooks before the debuggee continues from each event. Included hooks: ntdll.dll!NtCreateFile records the target path...

CVE-2024-32002

CVE-2024-32002: Exploiting Git RCE via git clone This repository contains a PoC for exploiting CVE-2024-32002, a vulnerability in Git that allows RCE during a git clone operation. By crafting repositories with submodules in a specific way, an attacker can exploit symlink handling on...

RedTeamCCode

RedTeamCCode Red Team C code repo Want to know what is the syscall ID been used by your system getsyscall.exe ntdll.dll NtProtectVirtualMemory ntdll.dll!NtProtectVirtualMemory at 0x00007FFDE568D010 NtProtectVirtualMemory syscall ID 0x00000050 80 CrowdStrike hooked ntdll.dll APIs...

CVE-2026-52813-Gogs-RCE

CVE-2026-52813 — Gogs Path Traversal Leading to Git Hooks Remote Code Execution Defensive Analysis Security research / Blue team writeup. This repository does not contain weaponized PoC. Researchers needing reproduction should use the public PoC referenced in the official advisory. Item| Content...

Hulios

Hulios Hardened Universal Linux Invisibility and Onion System Hulios is an eBPF-powered, transparent Tor VPN gateway for Linux. It secures outbound network traffic by redirecting TCP sockets and DNS queries through an embedded Arti Tor client instance and a localized Hickory-based DNS resolver. B...

TitanHide

Do not come here and open issues about problems with installation, crashes with bug check 0x109: CRITICALSTRUCTURECORRUPTION or questions on how to disable PatchGuard. I will permanently ban you from the issue tracker. If you don't know how to properly install the tool you don't know enough to us...

CVE-2021-21300

CVE-2021-21300 In multiple versions of git, the handling of symbolic links is not strict. After uploading files to git on a case-sensitive file system e.g., Linux, cloning a malicious repository on a host using a case-insensitive file system e.g., Windows may lead to remote command execution...

NTDLLReflection

NTDLLReflection Bypass Userland EDR hooks by Loading Reflective Ntdll in memory from a remote server based on Windows ReleaseID to avoid opening a handle to ntdll , and trigger exported APIs from the export table...

IPCDump

ipcdump Announcement post ipcdump is a tool for tracing interprocess communication IPC on Linux. It covers most of the common IPC mechanisms -- pipes, fifos, signals, unix sockets, loopback-based networking, and pseudoterminals. It's a useful tool for debugging multi-process applications, and it'...

PyHook

PyHook PyHook is the python implementation of my SharpHook project, It uses various API hooks in order to give us the desired credentials. PyHook Uses frida to inject it's dependencies into the target process Supported Processes Process| API Call| Description| Progress ---|---|---|--- mstsc|...

BadExclusionsNWBO

BadExclusions Now With Better Opsec BadExclusionsNWBO is an evolution from BadExclusions to identify folder custom or undocumented exclusions on AV/EDR. How it works? BadExclusionsNWBO copies and runs HookChecker.exe in all folders and subfolders of a given path. You need to have HookChecker.exe ...

ksentinel

ksentinel - Kernel Syscalls Integrity Monitor Overview ksentinel monitors critical kernel functions and the syscall table for unauthorized modifications. It detects common syscalls that are targeted by most rootkits including ftrace hooks, kprobes, and syscall table hijacking. Features Function...

trape

trape stable v2.0 People tracker on the Internet: Learn to track the world, to avoid being traced. Trape is an OSINT analysis and research tool, which allows people to track and execute intelligent social engineering attacks in real time. It was created with the aim of teaching the world how larg...

SharpHook

SharpHook SharpHook is inspired by the SharpRDPThief project, It uses various API hooks in order to give us the desired credentials. In the background it uses the EasyHook project, Once the desired process is up and running SharpHook will automatically inject its dependencies into the target...

agent

Bomfather Agent Bomfather Agent is an eBPF-based agent that runs in the kernel space to block actions based on a policy. We built this agent to solve the problems we had with existing solutions. 1. They were too complex to set up and use. 2. They were too slow and inefficient. 3. And even if they...

claude-code-backdoor

Claude Code Backdoor PoC A Proof of Concept demonstrating how Claude Code Anthropic's CLI AI agent hooks can be leveraged for Initial Access and Persistence. ⚠️ Disclaimer This project is for educational and ethical security testing purposes only. Unauthorized access to computer systems is illegal...

TelemetrySourcerer

Telemetry Sourcerer Introduction Telemetry Sourcerer can enumerate and disable common sources of telemetry used by AV/EDR on Windows. Red teamers and security enthusiasts can use this tool in a lab environment to: Identify collection-based blind spots in the products they're up against. Determine...

usbsnoop

usbsnoop — live USB transfer sniffer from two fentry hooks A real-time, colorized feed of USB traffic system-wide — built on the two universal URB chokepoints every host-controller driver funnels through, so it works on xHCI/EHCI/OHCI/dwc alike with no per-controller tracepoints and no usbmon...

Shinigami

Shinigami Shinigami is an experimental tool designed to detect and unpack malware implants that are injected via process hollowing or generic packer routines. How this works The tool operates by hooking NT functions related to Process Hollowing and marking newly executable memory pages with the...

git_rce

CVE-2024-32002: Exploiting Git RCE via git clone This repository contains a PoC for exploiting CVE-2024-32002, a vulnerability in Git that allows RCE during a git clone operation. By crafting repositories with submodules in a specific way, an attacker can exploit symlink handling on...