SV1

Damn Vulnerable Startup (DVS)

BOF that scans Claude Code, Cursor, Codex, and ChatGPT Desktop conversation histories for exposed credentials. Should work with any COFF-loader compatitble C2.

A repository containing lists and different combinations of weak/default passwords (in Norwegian) typically seen during external pentests and red team assessments. Contains seasons, months and holidays.

Repository for the DEATHCon 2025 Workshop "Operationzaling Purple Teaming in the Enterprise".

Internal Network Penetration Test Playbook

.NET C2 Framework Proof of Concept

A light-weight first-stage C2 implant written in Nim.

Loads any C# binary in mem, patching AMSI and bypassing Windows Defender

Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.

A curated list of amazingly awesome Burp Extensions

Material for the "Hands-On BloodHound" Workshop

Open-source runtime security monitoring and control for AI agents.

Activation Context Hijacking Evasion Tool

Local forensic scanner that extracts credentials from AI tool conversation history. For authorized red team and DLP use only.

Slides and other materials from talks.

POC - Phishing site generator

✨ A curated list of awesome threat detection and hunting resources 🕵️‍♂️

BloodHound Attack Research Kit

No description.

Extract credentials from lsass remotely

Import custom queries into BloodHound CE from a legacy BloodHound JSON file.

Azure mindmap for penetration tests

Linikatz V2 is a bash script which allows post-exploitation tasks on UNIX computers joined to Active Directory

Signtool for expired certificates

I have created this custom server for preparing EXP-301 course (aka WUMED) exam and hope it will help to take OSED certification. Feel free to DM me in discord, if you have any questions about solving this taks :)

HVNC for Cobalt Strike

Nimbo-C2 is yet another (simple and lightweight) C2 framework

A collection of techniques, examples and a little bit of theory for manually obfuscating PowerShell scripts to achieve AV evasion, compiled for educational purposes. The contents of this repository are the result of personal research, including reading materials online and conducting trial-and-error attempts in labs and pentests.

This is a technique one can use for their MalDoc.

PrivKit is a simple beacon object file that detects privilege escalation vulnerabilities caused by misconfigurations on Windows OS.

.NET/PowerShell/VBA Offensive Security Obfuscator

BOF implementation of @_EthicalChaos_'s ThreadlessInject project. A novel process injection technique with no thread creation, released at BSides Cymru 2023.

The Havoc Framework.

Modules used by the Havoc Framework

(Demo) 3rd party agent for Havoc

No description.

Havoc python api

C# havoc implant

Serverless Redirector in various cloud vendor for red team

Sleep Obfuscation

An easily modifiable shellcode template for Windows x64/x86

UDRL for CS

KaynLdr is a Reflective Loader written in C/ASM

Another approach to thread stack spoofing.

Beacon Object File Loader

Titan: A generic user defined reflective DLL for Cobalt Strike

C2 deployment with Terraform

liste over norske ord og navn

C# code to Sandbox Defender (and most probably other AV/EDRs).

C# implementation of the token privilege removal flaw discovered by @GabrielLandau/Elastic

EvilSelenium is a tool that weaponizes Selenium to attack Chrome.

Nim-based assembly packer and shellcode loader for opsec & profit

Extracting clear-text passwords from VeraCrypt.exe using API hooking

Nim version of MDSec's Parallel Syscall PoC

Loading and executing shellcode in C# without PInvoke.

Collection of tools to use with Azure Applications

No description.

Execute .NET in an Existing Process

BloodyAD is an Active Directory Privilege Escalation Framework

No description.

Execute Mimikatz with different technique

No description.

An in-memory evasion technique fluctuating shellcode memory protection between RW & RX and encrypting/decrypting contents

POC of SecureWorks' recent Azure Active Directory password brute-forcing vuln

offensive notes & resources

CobaltStrike Beacon written in .Net 4 用.net重写了stager及Beacon，其中包括正常上线、文件管理、进程管理、令牌管理、结合SysCall进行注入、原生端口转发、关ETW等一系列功能

SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature.

No description.

No description.

No description.

Password attacks and MFA validation against various endpoints in Azure and Office 365

SourcePoint is a C2 profile generator for Cobalt Strike command and control servers designed to ensure evasion.

Tradecraft Development Fundamentals

Trying to tame the three-headed dog.

This tool was open sourced as part of JARM Randomizer: Evading JARM Fingerprinting for HiTB Amsterdam 2021.

Kerberoast with ACL abuse capabilities

No description.

Template-Driven AV/EDR Evasion Framework

Convert Cobalt Strike profiles to IIS web.config files

No description.

AzureC2Relay is an Azure Function that validates and relays Cobalt Strike beacon traffic by verifying the incoming requests based on a Cobalt Strike Malleable C2 profile.

Load .net assemblies from memory while having them appear to be loaded from an on-disk location.

Hiding your process in ProcessHacker,Task Manager,etc by patching NtQuerySystemInformation

A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service.

No description.

TCP Port Redirection Utility

Tools for Kerberos PKINIT and relaying to AD CS

CredPhish is a PowerShell script designed to invoke legitimate credential prompts and exfiltrate passwords over DNS.

BadAssMacros - C# based automated Malicous Macro Generator.

PowerSploit - A PowerShell Post-Exploitation Framework

Obfuscate ECMA CIL (.NET IL) assemblies to evade Windows Defender AMSI

Weaponizing CLRvoyance for Post-Ex .NET Execution

Cobalt Strike script for ScareCrow payloads

No description.

Open-Source PE Packer

Azure JWT Token Manipulation Toolset

Red Team C code repo

Impacket implementation of CVE-2021-1675

No description.

YouTube/Livestream project for obfuscating C# source code using Roslyn

A better version of Xencrypt.Xencrypt it self is a Powershell runtime crypter designed to evade AVs.

Assignments for the SecurityTube Linux Assembly Expert Certification (SLAE)

A customizable wordlist and password generator.

ScareCrow - Payload creation framework designed around EDR bypass.

Search The Deep Web Straight From Your Terminal

OffensivePipeline allows to download, compile (without Visual Studio) and obfuscate C# tools for Red Team exercises.

Cobalt Strike random C2 Profile generator

Ansible playbook to deploy a phishing engagement

My collection of battle-tested Aggressor Scripts for Cobalt Strike 4.0+

Red Team oriented C# Simple HTTP & WebDAV Server with Net-NTLM hashes capture functionality

Simple script to extract useful informations from the combo BloodHound + Neo4j

Updog is a replacement for Python's SimpleHTTPServer. It allows uploading and downloading via HTTP/S, can set ad hoc SSL certificates and use http basic auth.

Fancy reverse and bind shell handler

Socks Proxy Server Plugin for Invoke-SocksProxy

No description.

Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources

Chameleon: A tool for evading Proxy categorisation

proxylogon exploit - CVE-2021-26857

framework to rapidly implement custom droppers for all three major operating systems

Loader, dropper generator with multiple features for bypassing client-side and network-side countermeasures.

A repository with my notable code snippets for Offensive Security's PEN-300 (OSEP) course.

No description.

No description.

.NET Project for Attacking vCenter

Retrieve LAPS password from the LDAP

Writing custom backdoor payloads with C# - Defcon 27 Workshop

We developed GRAT2 Command & Control (C2) project for learning purpose.

Collection of Beacon Object Files

No description.

DKMC - Dont kill my cat - Malicious payload evasion tool

My experiments in weaponizing Nim (https://nim-lang.org/)

A set of scripts that demonstrate how to perform memory injection in C#

No description.

Extended Process List (Search functionality)

Extracting Clear Text Passwords from mstsc.exe using API Hooking.

Load C# Code straight to memory

No description.

Source for tasks I have used with Covenant

Cobalt Strike Shellcode Generator

Basic C# Project that will take an MSBuild payload and run it with MSBuild via ClickOnce.

Collection of beacon BOF written to learn windows and cobaltstrike

Bloodhound for Blue and Purple Teams

A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA based scripts.

Chimera is a (shiny and very hack-ish) PowerShell obfuscation script designed to bypass AMSI and commercial antivirus solutions.

Iterative AD discovery toolkit for offensive operations

Abuses the Shared Logon Session ID Issue (Described [here](https://www.tiraniddo.dev/2020/04/sharing-logon-session-little-too-much.html) by the awesome James Forshaw) To Achieve System From NetworkService. Can be used as a "getsystem" as well

DAFT: Database Audit Framework & Toolkit

No description.

Checks expired domains for categorization/reputation and Archive.org history to determine good candidates for phishing and C2 domain names

Cobalt Strike Malleable C2 Design and Reference Guide

A collaborative, multi-platform, red teaming framework

Dll that can be used for side loading and other attack vector.

Information released publicly by NCC Group's Full Spectrum Attack Simulation (FSAS) team.

Cloud Security Posture Management (CSPM)

C# Executable with embedded Python that can be used reflectively to run python code on systems without Python installed

Abuse CVE-2020-1472 (Zerologon) to take over a domain and then repair the local stored machine account password.

Apply a filter to the events being reported by windows event logging

GhostBuild is a collection of simple MSBuild launchers for various GhostPack/.NET projects

No description.

.NET Project for performing Authenticated Remote Execution

.NET project for installing Persistence

Cobalt Strike Aggressor script menu for Powerview/SharpView

This program is designed to demonstrate various process injection techniques

C# port of the Get-AppLockerPolicy PS cmdlet

Temporary Impacket Fork for Contributing and Sharing Our Knowledge about Windows

Azure Red Team tool for graphing Azure and Azure Active Directory objects

A VBA implementation of the RunPE technique or how to bypass application whitelisting.

BetterSafetyKatz

Applied Purple Teaming - Infrastructure, Threat Optics, and Continious Improvement - June 6, 2020

Standalone version of my AES Powershell payload for Cobalt Strike.

📡PoC auto collect from GitHub.

Petaq - Purple Team Command & Control Server

SharpSploit is a .NET post-exploitation library written in C#

Subdomain Enumeration and Scanner

This script is intended to automate your reconnaissance process in an organized fashion

Red Team Scripts by d0nkeys (ex SnadoTeam)

No description.

Course content, lab setup instructions and documentation of our very popular Breaking and Pwning Apps and Servers on AWS and Azure hands on training!

Evade sysmon and windows event logging

:fish: PoC of a VBA macro spawning a process with a spoofed parent and command line.

Hiding implants in HTML files

The goal of this repository is to document the most common techniques to bypass AppLocker.

CVE-2020-0796 - Windows SMBv3 LPE exploit #SMBGhost

Recover the default privilege set of a LOCAL/NETWORK SERVICE account

Using DInvoke to patch AMSI.dll in order to bypass AMSI detections triggered when loading .NET tradecraft via Assembly.Load().

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

A tool which creates a spoofed certificate of any online website and signs an Executable for AV Evasion. Works for both Windows and Linux

lterm is a small script built to install a bash hook for full terminal logging.

Enumerate and decrypt TeamViewer settings from registry

Discord as a C2

No description.

Empire is a PowerShell and Python post-exploitation agent.

This is a tool published for the Citrix ADC (NetScaler) vulnerability. We are only disclosing this due to others publishing the exploit code first.

No description.

Salsa Tools - ShellReverse TCP/UDP/ICMP/DNS/SSL/BINDTCP/Shellcode/SILENTTRINITY and AV bypass, AMSI patched

Wiki to collect Red Team infrastructure hardening resources

Covenant is a collaborative .NET C2 framework for red teamers.

Custom Query list for the Bloodhound GUI based off my cheatsheet

Extracts all base64 ticket data from a rubeus /dump file and converts the tickets to ccache files for easy use with other tools.