udpack

UDPack UDPack is an extensible generic UDP packet obfuscator. The purpose of this application is to sit in the path of a UDP data stream, and obfuscate, deobfuscate or otherwise modify the packets. Python 3.4 or above is required, since this script uses the asyncio library. Using the latest Pytho...

udpack

UDPack UDPackは拡張可能な汎用UDPパケット難読化ツールです。このアプリケーションの目的は、UDPデータストリームの経路上に配置され、パケットの難読化、復号化、またはその他の変更を行うことです。 Python 3.4以上が必要です。このスクリプトはasyncioライブラリを使用しているためです。常に最新のPythonリリースを使用することを強く推奨します。基本機能はサードパーティの依存関係を必要としませんが、XChaCha20Poly1305PackerはPyNaClを必要とします。 警告: このアプリケーションの目的は 難読化 であり、 暗号化...

trueseeing

README trueseeing is a fast, accurate and resillient vulnerability scanner for iOS/Android apps. We operate on the Dalvik VM level for Android -- i.e. we don't care if the target app is obfuscated or not. Capability Currently we can: Automatically scan app for vulnerabilities, reporting in...

powershell-reverse-tcp

PowerShell Reverse TCP PowerShell scripts for communicating with a remote host. Remote host will have a full control over the client and all the underlying system commands. Check shells based on: Invoke-Expression PowerShell command here, process pipes here. Tested with PowerShell v5.1.19041.2673...

Out-FINcodedCommand

Out-FINcodedCommand v1.0 Introduction Out-FINcodedCommand is a PowerShell v2.0+ compatible PowerShell POC script designed to highlight several obfuscation techniques used by FIN threat actors. The primary obfuscation techniques highlighted in this tool are: 1. cmd.exe's variable char/string...

skyhook

Skyhook Skyhook は、IDS 実装によって防御されたネットワークとの間でファイルを密かにやり取りするために使用される REST 駆動型ユーティリティです。付属の Web クライアントは React、バニラ JS、WebAssembly を組み合わせてファイル転送を管理します。 主要リンク こちらからダウンロード 始めるにはユーザードキュメントをご覧ください 特徴 ファイルコンテンツの往復難読化 ユーザー設定可能な難読化チェーン 自己署名証明書および Let's Encrypt 証明書の調達方法 設定とファイル転送のための組み込み Web アプリケーション...

skyhook

Skyhook Skyhook is a REST-driven utility used to smuggle files into and out of networks defended by IDS implementations. It comes with a pre-packaged web client that uses a blend of React, vanilla JS, and web assembly to manage file transfers. Key Links Download here See the user documentation to...

powershell-backdoor-generator

/ DISCLAIMER: This program is intended for educational purposes only. By using this program, you agree that you understand the potential risks associated with its use. - This program should not be used on any system or network without proper authorization. Unauthorized use is strictly prohibited....

Invoke-ArgFuscator

░█░█▄░█░█▒█░▄▀▄░█▄▀▒██▀░▒░ ▄▀▄▒█▀▄░▄▀▒▒█▀░█▒█░▄▀▀░▄▀▀▒▄▀▄░▀█▀░▄▀▄▒█▀▄░ ░█░█▒▀█░▀▄▀░▀▄▀░█▒█░█▄▄░▀▀░█▀█░█▀▄░▀▄█░█▀░▀▄█▒▄██░▀▄▄░█▀█░▒█▒░▀▄▀░█▀▄░ Invoke-ArgFuscator Invoke-ArgFuscator は、Windows、Linux、macOS で一般的なシステム標準の実行可能ファイル向けの難読化コマンドラインの生成を支援する、オープンソースのクロスプラットフォーム PowerShell モジュールです。 👉 ArgFuscator...

HTMLSmuggler

HTMLSmuggler ✉️ HTMLSmuggler - JS payload generator for IDS bypass and payload delivery via HTML smuggling. Description The full explanation what is HTML Smuggling may be found here. The primary objective of HTML smuggling is to bypass network security controls, such as firewalls and intrusion...

GoAround

GoAround A tool that allows the generation of AMSI bypasses and the automatic obfuscation of PowerShell scripts using three different obfuscation methods. GoAround is licensed under the MIT license. Refer to LICENSE for more information. GoAround Liability disclaimer Installation User's guide How...

Flerken

Flerken Introduction Command Line Obfuscation CLOB has been proved to be a non-negligible factor in fileless malware or malicious actors that are "living off the land". With dozens of obfuscation tools seen in the wild, by contrast few proper countermeasures can be found. In this talk, we present...

obfus.h

obfus.h obfus.h is a macro-only library for compile-time obfuscating C applications, designed specifically for the Tiny C tcc you can download it here - Tiny-C-Compiler/releases. It is tailored for Windows x86 and x64 platforms and supports almost all versions of the compiler. Very reliable armor...

Killer

KILLER TOOL EDR Evasion It's a AV/EDR Evasion tool created to bypass security tools for learning, until now the tool is FUD. Features: Module Stomping for Memory scanning evasion DLL Unhooking by fresh ntdll copy IAT Hiding and Obfuscation & API Unhooking ETW Patchnig for bypassing some security...

onelinepy

onelinepy FUD PythonコードのためのPython難読化ツール ダウンロードと実行 git clone https://github.com/spicesouls/onelinepy cd onelinepy chmod +x setup.sh ./setup.sh onelinepy 使い方ガイド | || | . | | -| | | | -| . | | |Python |||||||||| | |Obfuscator || || usage: oneline.py -h -m M -i I --script SCRIPT --code CODE --list...

Sharperner

Sharperner Sharperner is a tool written in CSharp that generate .NET dropper with AES and XOR obfuscated shellcode. Generated executable can possibly bypass signature check but I cant be sure it can bypass heuristic scanning. Features PE binary Process Hollowing PPID Spoofing Random generated AES...

obfuscation_detection

난독화 탐지 v2.4 저자: Tim Blazytko 자동으로 난독화된 코드 및 기타 흥미로운 코드 구조를 탐지합니다 설명: 난독화 탐지Obfuscation Detection는 바이너리에서 난독화된 코드와 흥미로운 코드 구조예: 상태 머신를 탐지하는 Binary Ninja 플러그인입니다. 바이너리가 주어지면 이 플러그인은 리버스 엔지니어링 중에 더 자세히 살펴볼 가치가 있는 코드 위치를 식별하여 분석을 용이하게 합니다. 다양한 휴리스틱을 기반으로 이 플러그인은 복잡하거나 일반적이지 않은 코드 구조를 포함하는 함수를 식별합니다...

TrojanSourceFinder

TrojanSourceFinder TrojanSourceFinder helps developers detect "Trojan Source" vulnerability in source code. Trojan Source vulnerability allows an attacker to make malicious code appear innocent. In general, the attacker tries to lure by passing his code off as a comment visually. It is a serious...

ByteCaster

ByteCaster ペイロードの暗号化、難読化、バイト配列への変換を、たった 1 つのコマンドで実現するスイスアーミーナイフです！ 3 つの暗号化アルゴリズム、4 つのエンコード / 難読化アルゴリズム、14 の出力形式に対応しています。 インストール コンパイル済みバイナリをダウンロードするか、Go ソースコードをコンパイルしてください。 使用方法 例: Convert .bin file into C bytes array with XOR encryption and IPv4Fuscation ./ByteCaster -i shellcode.bin -f c -x xor...

Yara-Rules

対象のYaraルール: Aurora Stealer Bandit Stealer Ducktail Meduza Stealer MetaStealer Nitrogen PSWSTEALER RaccoonStealerv2 SolarMarker Vidar Stealer WhiteSnake Stealer SwaetRAT DanaBot FakeBat Ande Loader WorkersDevBackdoor Pure Logs Stealer PikaBot JinxLoader GaryStealer Illyrian Stealer PureCrypter...