sonar

██████ ███ ██████ ██ ██████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ████ ██ ██ ██ ██ ██ ██ ██ ██ ██████ ███ ██ ██ ██ ██ ██ ██ Know what's running on your machine. Sonar shows everything listening on localhost and puts it in order: every port belongs to a group — normally th...

ring3-kit

ring3-kit Hides Process From Task Manager Using NT Hooking NtQuerySystemInformation. A simple Ring-3 user mode rootkit. How Hook the API function NtQuerySystemInformation with our own function that hides a process from task manager Hooked function gets called instead The DLL is injected into...

Hollow

Hollow hollow is a shellcode loader generator. You give it a raw shellcode binary and a profile, and it spits out a compiled Windows PE loader with your shellcode encrypted inside. Getting Started Binaries are available on the releases page, or build from source: go build -o hollow . Requires...

WinDefenderKiller

WinDefenderKiller PermanentDisablefromRegistry C++ Code for Permanently Disabling Windows Defender via Registry Keys Just compile and execute it! And when i restart it: BYOVDWindowsDefenderKiller This module implements a BYOVD Bring Your Own Vulnerable Driver technique to disable Windows Defender...

FalconEye

FalconEye: Real-time detection software for Windows process injections FalconEye is a windows endpoint detection software for real-time process injections. It is a kernel-mode driver that aims to catch process injections as they are happening real-time. Since FalconEye runs in kernel mode, it...

Vegile

Vegile - Ghost In The Shell Vegile is a tool for Post exploitation Techniques in linux. Post Exploitation techniques will ensure that we maintain some level of access and can potentially lead to deeper footholds into our targets trusted network. Donate If this project is very helpful to your...

sandbox-attacksurface-analysis-tools

sandbox-attacksurface-analysis-tools version 2. c Google LLC. 2015 - 2024 Developed by James Forshaw This is a small suite of PowerShell tools to test various properties of sandboxes on Windows. Many of the tools take a -ProcessId flag which is used to specify the PID of a sandboxed process. The...

RedPeanut

RedPeanut oooooooooooooooooo ooooooooooooooooooooooooooooooooooooooo ooooooooooooooooooooooooooooooooo ooooooooooooooooooooooooooooooooooooooooooo oooooooooooooooooooooooooooo oooooooooooooooooooooooooooooooooooooo RedPeanutv0.3.0@b4rtik Currently being tested. Known modules Issues: process -...

boopkit

================================================================ ██████╗ ██████╗ ██████╗ ██████╗ ██╗ ██╗██╗████████╗ ██╔══██╗██╔═══██╗██╔═══██╗██╔══██╗██║ ██╔╝██║╚══██╔══╝ ██████╔╝██║ ██║██║ ██║██████╔╝█████╔╝ ██║ ██║ ██╔══██╗██║ ██║██║ ██║██╔═══╝ ██╔═██╗ ██║ ██║ ██████╔╝╚██████╔╝╚██████╔╝██║ ██║...

jailer

Jailer - eBPF Mandatory Access Control Warning : This project is under heavy development and is NOT ready for production use. APIs, policy formats, and behavior may change without notice. Use for testing and experimentation only. Acknowledgments Note : This is an independent implementation and is...

toothpicker

ToothPicker ToothPicker is an in-process, coverage-guided fuzzer for iOS. It was developed to specifically targets iOS's Bluetooth daemon bluetoothd and to analyze various Bluetooth protocols on iOS. As it is built using FRIDA, it can be adapted to target any platform that runs FRIDA. This...

Process-Dump

Process Dump Process Dump is a Windows reverse-engineering command-line tool to dump malware memory components back to disk for analysis. Often malware files are packed and obfuscated before they are executed in order to avoid AV scanners, however when these files are executed they will often...

MemITM

What's the MemITM tool? The MemITM Mem In The Middle tool has been developped in order to easily intercept "messages" in Windows processes memory. We developped a lot of custom memory interception tools in order to capture network messages before encryption, or IPC messages, and to be able to...

DCOMUploadExec

DCOM Upload & Execute DCOM Lateral movement POC abusing the IMsiServer interface https://www.deepinstinct.com/blog/forget-psexec-dcom-upload-execute-backdoor The solution contains 2 projects DCOMUploadExec - A C++ project which hosts the lateral movement attack code AssemblyPayload - A .NET DLL...

process-inject-kit

Process Inject Kit This is a port of Cobalt Strike's Process Inject Kit from C to the C++ BOF template. How it works The built in fork and run process injection techniques can be change with the PROCESSINJECTSPAWN and PROCESSINJECTEXPLICIT hooks. This repo provides the following: Source code...

LsassReflectDumping

LsassReflectDumping This tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone is created, it utilizes MINIDUMPCALLBACKINFORMATION callbacks to generate a memory dump of the cloned process. Steps Getting the handle of...

CobaltStrikeScan

CobaltStrikeScan Scan files or process memory for Cobalt Strike beacons and parse their configuration. CobaltStrikeScan scans Windows process memory for evidence of DLL injection classic or reflective injection and/or performs a YARA scan on the target process' memory for Cobalt Strike v3 and v4...

antispy

AntiSpy English | 简体中文 A powerful anti rootkit toolkit AntiSpy is a free but powerful anti virus and rootkits toolkit. It offers you the ability with the highest privileges that can detect,analyze and restore various kernel modifications and hooks. With its assistance,you can easily spot and...

ProcDump-for-Linux

ProcDump ProcDump is a Linux and Mac reimagining of the classic ProcDump tool from the Sysinternals suite of tools for Windows. ProcDump provides a convenient way for Linux and Mac developers to create core dumps of their application based on performance triggers. ProcDump for Linux and Mac is pa...

QLOG

Update July, 2022 We started QLOG as an experiment to learn more about Windows ETW. QLOG provides enriched Logging for process creation events on Windows. We have stopped development of QLOG because in the meantime free tools were published which use ETW for telemetry and do a way better job than...