peCloakCapstone

peCloak - Capstone This is a simple fork of SecuritySift's peCloak that uses Capstone. The intention is to provide a fork based on a well-maintained, up-to-date disassembly library and to make the script multi-platform. Here's what I did so far: Replaced pydasm with Capstone Included a patched...

morty

Morty Web content sanitizer proxy as a service Morty rewrites web pages to exclude malicious HTML tags and attributes. It also replaces external resource references to prevent third party information leaks. The main goal of morty is to provide a result proxy for searx, but it can be used as a...

Unwinder

Content SilentMoonWalk Description Credits Usage callfunction! macro indirectsyscall! macro Parameter passing Examples Calling kernel32.dll!Sleep Calling kernel32.dll!OpenProcess Calling NtDelayExecution as indirect syscall Concatenate macro calls Considerations Initial frame PoC Stack replacemen...

Liferay Portal - Open Redirect

HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' U+FFFD, which allows remote...

ExtensionSpoofer

ExtensionSpoofer ExtensionSpoofer is a Visual Basic .NET desktop app that demonstrates how file names and icons can be visually manipulated on Windows while the underlying executable file type remains unchanged. It uses the Unicode Right-to-Left Override character U+202E to reverse displayed...

Smartphone-Pentest-Framework

Smartphone-Pentest-Framework The Smartphone Pentest-Framework has been deprecated by the Dagah Mobile Penetration Testing Software available at: https://www.shevirah.com/dagah. For those simply looking to follow the exercises in my book, download the Kali image on my book site at:...

SyscallRevenant

Surpassing EDRs & AVs SyscallRevenant SyscallRevenant is a new method of performing clean indirect syscalls. The main component resolves System Service Numbers SSNs and syscall instruction addresses dynamically. This is done by enabling the trap flag during execution. The secondary component is...

Out-FINcodedCommand

Out-FINcodedCommand v1.0 Introduction Out-FINcodedCommand is a PowerShell v2.0+ compatible PowerShell POC script designed to highlight several obfuscation techniques used by FIN threat actors. The primary obfuscation techniques highlighted in this tool are: 1. cmd.exe's variable char/string...

PINKPANTHER

PINKPANTHER Brief Windows x64 kernel-mode handcrafted shellcode to replace primary access token of executing process with SYSTEM process token for Elevation of PrivilegeEoP. Supported OS Versions Windows 7/Windows Server 2008 R2 Build 7601 Windows 8/Windows Server 2012 Build 9200 Windows...

massdns

MassDNS A high-performance DNS stub resolver MassDNS is a simple high-performance DNS stub resolver targeting those who seek to resolve a massive amount of domain names in the order of millions or even billions. Without special configuration, MassDNS is capable of resolving over 350,000 names per...

rebrowser-patches

🪄 Patches for undetectable browser automation This repo contains patches to enhance popular web automation libraries. Specifically, it targets the puppeteer and playwright packages. Some aspects of automation libraries or browser behavior cannot be adjusted through settings or command-line...

privesc-CVE-2010-0426

Sudo 1.6.x=1.6.9p21 and 1.7.x=1.7.2p4 Local Privilege Escalation Sudo su "do" allows a system administrator to give certain users or groups of users the ability to run some or all commands as root while logging all commands and arguments. Vulnerable environment To setup a vulnerable environment f...

userland-exec

Userland Exec Userland exec replaces the existing process image within the current address space with a new one. It mimics the behavior of the system call execve, but the process structures describing the process image remain unchanged. In other words, the process name reported by system utilitie...

qubes-mirage-firewall

qubes-mirage-firewall A unikernel that can run as a QubesOS ProxyVM, replacing sys-firewall. It uses the mirage-qubes library to implement the Qubes protocols. See A Unikernel Firewall for QubesOS for more details. Binary releases Pre-built binaries are available from the releases page. See the...

pig_CS4.4

Note: For security research and learning purposes only. If the tool is used for any other purpose, the user shall bear all legal and joint liabilities. The author and publisher assume no legal or joint liability. Cobalt Strike 4.4 Zhuzhu Edition This version is a pre-release beta version; the...

radmin-vpn-linux

Radmin VPN for Linux Run Radmin VPN on Linux through Wine: join networks, see peers, host and join game servers, no Windows VM. I did not build this because it was easier than a VM. I built it because I thought it was easier than a VM. Written by a human and Claude Anthropic, with a lot of...

jsch

Fork of JSch-0.1.55 See original README Why should you use this library? As I explained in a blog post the main points are: OpenSSH has disabled ssh-rsa in release 8.8 per default and you need a library which supports rsa-sha2-256 and rsa-sha2-512. Drop in replacement: just change dependency...

Crystal-Kit

Crystal Kit This repo is a technical and social experiment to explore whether replacing Cobalt Strike's evasion primitives Sleepmask/BeaconGate with a Crystal Palace PICO is feasible or even desirable for advanced evasion scenarios. Usage 1. Disable the sleepmask and stage obfuscations in Malleab...

ator

Authentication Token Obtain and Replace Extender Introduction In the world of web security testing, automation is key, and Burp Suite is the go to choice. However, to truly harness the power of Burp for automated scanning, you need the right plugins. That's where ATOR comes in. This open-source...

pySigma

pySigma pySigma is a python library that parses and converts Sigma rules into queries. It is a replacement for the legacy Sigma toolchain sigmac with a much cleaner design and is almost fully tested. Backends for support of conversion into query languages and processing pipelines for transforming...