InjectProc

InjectProc Process injection is a very popular method to hide malicious behavior of code and are heavily used by malware authors. There are several techniques, which are commonly used: DLL injection, process replacement a.k.a process hollowing, hook injection and APC injection. Most of them use...

aircrack-ng

Aircrack-ng Badges GitHub CI Others !Codespellhttps://github.com/a...

prefetch-hash-cracker

Prefetch Hash Cracker Motivation During the forensic analysis of a Windows machine, you may find the name of a deleted prefetch file. While its content may not be recoverable, the filename itself is often enough to find the full path of the executable for which the prefetch file was created. Usin...

ShellCodeEmulator

Windows shellcode emulation tool based upon unicorn framework. ShellcodeEmulator emulates Windows shellcode with the help of windbg process memory dumps. You can provide shellcode to analyze with any Windows process dump image. The tool will emulate as much as of the userland code using the...

ophcrack

OPHCRACK 3.6.0 Time-Memory-Trade-Off-Crack A windows password cracker based on the faster time-memory trade-off using rainbow tables. This is an evolution of the original ophcrack 1.0 developed at EPFL http://lasecwww.epfl.ch/oechslin/projects/ophcrack Ophrack 3.6.0 comes with a Qt Graphical User...

MalwareTracesGenerator

MalwareTracesGenerator Generate malware traces for detection tests Report Bug · Request Feature 📋 Table of content 📋 Table of content 👀 About the project ❓ Why 🚀 Getting started ⚙️ Prerequisites 📦 Installation 🥷 Quick examples 👷 Contributing 🙌 Acknowledgments 📚 Licenses 👀 About the project...

windbg-mcp

WinDbg MCP An MCP Model Context Protocol server that exposes every pybag Windows debugger function as a native MCP tool. It gives any MCP-compatible client Claude Desktop, Claude Code, Cowork, OpenAI Codex CLI, Cursor, and custom agents full control over user-mode processes, kernel sessions, and...

CVE-2023-28252

Since February 2022 was reported a new ransomware that appears to be using a Windows 0-day vulnerability, according to the research conducted by Trend Micro. More information about this ransomware can be found at this link. According to analysis by Kaspersky, the Nokoyawa ransomware group has use...

CVE-2023-21768

CVE-2023-21768 Windows Ancillary Function Driver for WinSock According to the detailed description of CVE-2023-21768 published by the Microsoft Security Response Center MSRC, the vulnerability exists in the Ancillary Function Driver AFD, whose system file is afd.sys. The AFD module is the kernel...

CVE-2021-1675

CVE-2021-1675 - PrintNightmare LPE PowerShell Caleb Stewart | John Hammond | July 1, 2021 CVE-2021-1675 is a critical remote code execution and local privilege escalation vulnerability dubbed "PrintNightmare." Proof-of-concept exploits have been released Python, C++ for the remote code execution...

IPBan

IPBan - Free software to block out attackers quickly and easily on Linux and Windows Helpful Links Get a discount on IPBan Pro by visiting https://ipban.com/upgrade-to-ipban-pro/. Integrate IPBan with IPThreat, a 100% free to use website and service of community submitted bad ip addresses. Help...

CVE-2020-0787-EXP-ALL-WINDOWS-VERSION

CVE-2020-0787-EXP-ALL-WINDOWS-VERSION Disclaimer The author's PoC is for research purposes only. If readers use this PoC for other actions, the author is not responsible. Introduction CVE-2020-0787-EXP Support ALL Windows Version...

NodeGoat

NodeGoat Being lightweight, fast, and scalable, Node.js is becoming a widely adopted platform for developing web applications. This project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them. Getti...

ConTroll_Remote_Access_Trojan

DISCLAIMER ConTroll is for education/research purposes only. The author takes NO responsibility and/or liability for how you choose to use any of the tools/source code/any files provided. The author and anyone affiliated with will not be liable for any losses and/or damages in connection with the...

mimikatz

mimikatz mimikatz is a tool I've made to learn C and make somes experiments with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets. .. mimikatz 2....

CVE-2023-29343

CVE-2023-29343 This is PoC for arbitrary file write bug in Sysmon version 14.14 After last patch Sysmon would check if Archive directory exists and if it exists it would check if archive directory is owned by NT AUTHORITY\SYSTEM and access is only granted to NT AUTHORITY\SYSTEM. If both condition...

shepard

SHEPARD BITS This is a persistance tool using Windows Background Intelligent Transfer Service BITS. Functionality File Download, File Exfiltration, File Download + Persistent Execution Usage Run shepard.exe as Administrator with the following command line arguments: -d : regular file download to ...

CVE-2024-4577-checker

CVE-2024-4577 Vulnerability Checker The CVE-2024-4577 Vulnerability Checker is a Bash script designed to scan multiple domains for the CVE-2024-4577 vulnerability in PHP-CGI. This tool allows security researchers and system administrators to quickly assess whether their systems or a list of domai...

cua-kit

CUA-Kit A toolkit for enumerating and interacting with computer use agents on Windows and macOS systems. Tools Tool| Description| Outputs ---|---|--- cua-enum| Enumerate computer use agent configurations Claude Code, Codex CLI, Cursor, Gemini CLI| .exe, .x64.o cua-exec| Execute computer use agent...

wifi-password

wifi-password Quickly fetch your WiFi password and if needed, generate a QR code of your WiFi to allow phones to easily connect. Works on macOS and Linux , Windows Installation Install using pip $ python3 -m pip install --user wifi-password Install using git $ git clone...