process_overwriting

Process Overwriting Process Overwriting is a PE injection technique, closely related to Process Hollowing and Module Overloading. With its help, you can replace the main executable not a DLL of the target process. It works only for a newly created process - injection to existing processes is not...

InlineExecute-Assembly

InlineExecute-Assembly InlineExecute-Assembly is a proof of concept Beacon Object File BOF that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module. InlineExecute-Assembly will execute any...

link

link link is a command and control framework written in rust. Currently in beta. Table of Contents Introduction Features Feedback Build Process Acknowledgments Introduction...

KSLDBYOVDARK

KSLDBYOVD Reference: KslKatz and KslDump. KslD.sys, a.k.a. MpKslDrv.sys, used to be one of the anti-rootkit tool drivers of Microsoft Antimaware which includes Microsoft Defender Antivirus, Windows Defender Antivirus in the old Windows versions, Microsoft Security Essentials, System Center Endpoi...

Aegis

AEGIS Independent, OS-level observability for AI coding agents Watches what AI agents actually do on your machine — processes, files, network — from outside the agents, no hooks required. AEGIS is an independent, OS-level observer for AI agents. It watches agent processes, file access, and networ...

TrueTree

TrueTree About Read all about the TrueTree concept here TrueTree is more than just a pstree command for macOS. It is used to display a process tree for current running processes while using a hierarchy built on additoinal pids that can be collected from the operating system. The standard process...

toothpicker

ToothPicker ToothPicker is an in-process, coverage-guided fuzzer for iOS. It was developed to specifically targets iOS's Bluetooth daemon bluetoothd and to analyze various Bluetooth protocols on iOS. As it is built using FRIDA, it can be adapted to target any platform that runs FRIDA. This...

resmack-fuzz-test

Resmack Fuzz Test This project is an exploration of a feedback-driven fuzzer that uses: ptrace for instrumentation with dynamic memory breakpoints specified by the target process process snapshotting/restoring using /proc/pid/map, /proc/pid/clearrefs, and /proc/pid/pagemap using processvmwritev...

uac

Unix-like Artifacts Collector UAC About • Documentation • Main Features • Supported Operating Systems • Usage • Contributing • Support • License 🔎 About UAC UAC Unix-like Artifacts Collector is a powerful and extensible incident response tool designed for forensic investigators, security analysts...

memhunter

Memhunter Automated hunting of memory resident malware at scale This project is WORK IN PROGRESS. Expect feature changes and binary releases on the upcoming weeks. Overview Memhunter is an endpoint sensor tool that is specialized in detecing resident malware, improving the threat hunter analysis...

lfi

Lightweight Fault Isolation LFI Welcome to the top-level repository for the Lightweight Fault Isolation LFI project. What is LFI? LFI is a system for sandboxing native code. Like WebAssembly and Native Client, LFI isolates sandboxed code in-process i.e., in the same address space as a host...

dlinject

dlinject.py Inject a shared library i.e. arbitrary code into a live linux process, without ptrace. Inspired by Cexigua and linux-inject, among other things. Usage root@kitploit: .. . | /| | || || / | .. / | | | | |/ \ | |/ / \ \ \ | \ | |/|| /| |\ \ | /| // | / /| / / /|| / source:...

Diamorphine

Diamorphine Diamorphine is a LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x x86/x8664 and ARM64 Features When loaded, the module starts invisible; Hide/unhide any process by sending a signal 31; Sending a signal 63to any pid makes the module become invisible; Sending a signal 64to any pid...

CVE-2021-33044

CVE-2021-33044 Dahua IPC/VTH/VTO devices auth bypass exploit About: The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. root@kitploit: use - python3...

PichichiH0ll0wer

PichichiH0ll0wer PichichiH0ll0wer About Features Injection methods Installation Usage Credits About --== Process hollowing loader written in Nim for PEs only ==-- I built PichichiH0ll0wer to learn and contribute, sure. but also because I'm quite tired of shellcodes everywhere. Loading PEs might b...

fuxploider

fuxploider Fuxploider is an open source penetration testing tool that automates the process of detecting and exploiting file upload forms flaws. This tool is able to detect the file types allowed to be uploaded and is able to detect which technique will work best to upload web shells or any...

SharpBlock

SharpBlock A method of bypassing EDR's active projection DLL's by preventing entry point execution. Features Blocks EDR DLL entry point execution, which prevents EDR hooks from being placed. Patchless AMSI bypass that is undetectable from scanners looking for Amsi.dll code patches at runtime. Hos...

bat

Behavioral Adversary Tracer BAT BAT is a realistic, evolving adversary threat model for Linux and Windows. It is not a C2 framework and it is not a rootkit. It is a complete threat simulation platform that integrates C2 communication, kernel-level stealth rootkit modules, userspace evasion,...

frida-ui

Frida UI A modern, lightweight, web-based user interface for Frida, designed for Android application penetration testing. It allows you to interact with devices, processes, and scripts directly from your browser. Quick Start root@kitploit: Install using uv recommended or pipx/pip uv tool install...

peetch

peetch peetch is a collection of tools aimed at experimenting with different aspects of eBPF to bypass TLS protocol protections. Currently, peetch includes three subcommands. The first called dump aims to sniff network traffic by associating information about the source process with each packet...