The swiss army knife of LSASS dumping

A little tool to play with the Seclogon service

NTLM relaying for Windows made easy

This project is 'bridge' between the sleep and python language. It allows the control of a Cobalt Strike teamserver through python without the need for for the standard GUI client. NOTE: This proje…

Zuthaka is an open source application designed to assist red-teaming efforts, by simplifying the task of managing different APTs and other post-exploitation tools.

InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditiona…

A .NET Runtime for Cobalt Strike's Beacon Object Files

Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).

AV/EDR evasion via direct system calls.

LoadLibrary for offensive operations

"Golden" certificates

Situational Awareness commands implemented using Beacon Object Files

Java deserialization exploitation lab.

Fish-like autosuggestions for zsh

Write snippets of code in C++, Python, Ruby, and others as documentation and execute them as regression tests.

List of Awesome CobaltStrike Resources

Mimikatz implementation in pure Python

Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF)

Python library to parse and read Microsoft minidump file format

A method of bypassing EDR's active projection DLL's by preventing entry point exection

Great explanation of Process Hollowing (a Technique often used in Malware)

Remove API hooks from a Beacon process.

The Serenity Operating System 🐞

automated password spraying tool

Package to configure your dots pagination carousel just like Instagram does

ILMerge is a static linker for .NET Assemblies.

MSBuildShell, a Powershell Host running within MSBuild.exe

Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

Browser extension & demo for a new opt-in security header that strictly caches script files