Casey Claim this profile

Kali365 - EvilTokens Replica

Experimentations with the MSBuild Capabilites in a default environment.

Cormorant Cipher is a document watermarking toolkit that embeds an invisible, machine-readable signature into typeset text. When a watermarked document is opened, a DNS alert fires to notify the document owner.

AI Deception Layer for - containing adversarial context designed to redirect or confuse an LLM agent reading your own infrastructure

Deploy ProjFS inside a Github Action Runner or Self-Hosted Runner

Create and Call Functions In .NET Assembly inside WSH

Experimental Decoy Broker

Load self-signed drivers without TestSigning or disable DSE. Transferred from https://github.com/DoubleLabyrinth/Windows10-CustomKernelSigners

More Than Meets the Eye

Local Privilege Escalation like BloodHound for Local Priv Esc Paths

Accelerating Exploiting Malicious Drivers via AI

DNS, HTTP, Email Receiver -

Security tools for purple team, AI security, and M365/GWS. Authorized use only.

A GitHub Actions workflow that fires an alert whenever someone uses a bait token to POST to your repository's dispatch endpoint

Basic ProjFS Provider that lets you project one Folder into another

In honor of James Mickens Keynote Usenix 2018 -

Threat Model - Testing Windows SandBox Tradecraft

A modular, stack-agnostic toolkit of security review skills for AI coding agents to autonomously find, reproduce, and patch vulnerabilities.

AI agent toolkit: unified LLM API, agent loop, TUI, coding agent CLI

No description.

A Simple TLS Intercepting Proxy - For Learning

PhantomFS is a Windows honeypot that projects convincing decoy files — credentials, financials, SSH keys — into a virtual directory via ProjFS, then fires instant Event Log and Toast alerts the moment an attacker opens one.

Agentic AI security tool that applies proactive, attacker-first analysis directly to source code.

Find zero-days while you sleep. DeepZero is an automated vulnerability research framework that parses, decompiles, and analyzes thousands of Windows kernel drivers for exploitable IOCTLs natively using AI agents.

Fingerprint anything on a network perspective

Context bomb strings

Run A Local Deception Projected File System - Canarytoken

Anthropic's educational courses

Cross Platform FUSE experiment

Learn Anthropic's CCA courses with AI as your tutor. Clone, open Claude Code, start learning.

Windows File System Proxy - FUSE for Windows

No description.

The end of an era

Canarytokens helps track activity and actions on your network

MCP server for the Thinkst Canary Console API -- manage Birds, Canarytokens, and incidents from any MCP-compatible client.

The easiest, most secure way to use WireGuard and 2FA.

The Tahoe-LAFS decentralized secure filesystem.

universal text transformation, translation, mutation, encoding/decoding, and promptcrafting

Parseltongue is a powerful prompt hacking tool/browser extension for real-time tokenization visualization and seamless text conversion, supporting formats like binary, base64, leetspeak, special characters, and multiple languages. Perfect for red teamers, developers, linguists, and latent space explorers.

An offensive data enrichment pipeline

Example starter repo for building React applications on top of a Foundry Ontology

The Illustrated TLS 1.3 Connection: Every byte explained

Official code repo for the O'Reilly Book - "Hands-On Large Language Models"

Mastering the Art of Scalable and Efficient AI Model Deployment

Linux shell for iOS

Find secrets with Gitleaks 🔑

Git Canary - Deception File System

A managed-code API for the Windows Projected File System

Virtual File System for Git: Enable Git at Enterprise Scale

Prompt Injection as Role Confusion

A WireGuard Fuzzing Harness

A tool for creating and running Linux containers using lightweight virtual machines on a Mac. It is written in Swift, and optimized for Apple silicon.

TheGradientPath is your hands-on guide to ML and AI, mixing bite-sized Python scripts, notebooks, and videos. Start with fundamentals, climb to cutting-edge models, and learn by reading, coding, and watching. Fork the repo and join the journey.

An AI-powered agentic red team framework that automates offensive security operations, from reconnaissance to exploitation to post-exploitation, with zero human intervention.

A suite to test certificate anomalies on PE files

A curated list of LLM Interpretability related material - Tutorial, Library, Survey, Paper, Blog, etc..

LINGUISTIC ENGINE FOR AI

QUIC / TLS Interceptor — eBPF Uprobe Edition

An A12/A13 SecureROM exploit

LEAKED SYSTEM PROMPTS FOR CHATGPT, CLAUDE, GEMINI, GROK, PERPLEXITY, CURSOR, LOVABLE, REPLIT, AND MORE! - AI SYSTEMS TRANSPARENCY FOR ALL! 👐

Extracted system prompts from Anthropic - Claude Fable 5, Opus 4.8, Claude Code, Claude Design. OpenAI - ChatGPT 5.5 Thinking, GPT 5.5 Instant, Codex. Google - Gemini 3.5 Flash, 3.1 Pro, Antigravity. xAI - Grok, Cursor, Copilot, VS Code, Perplexity, and more. Updated regularly.

Code for the book Deep Learning with PyTorch by Howard Huang, Eli Stevens, Luca Antiga, and Thomas Viehmann.

Implement a ChatGPT-like LLM in PyTorch from scratch, step by step

Code for the paper "Language Models are Unsupervised Multitask Learners"

Windows kernel driver exploitation knowledge base — 28 case studies organized by driver type, grounded in real CVEs with build numbers and PoC references

No description.

FreeOTP QR Code Detector

No description.

An open-source remote desktop application designed for self-hosting, as an alternative to TeamViewer.

A simulation / modeling tool for Ransomware to allow teams to find gaps

Run a Tailscale node on Railway

This is a novel technique that leverages the well-known Device Code phishing approach. It dynamically initiates the flow when the victim opens the phishing link and instantly redirects them to the authentication page. No authentication method, not even FIDO, is able to protect against this type of attack.

OAuth Device Code Phishing Toolkit

Lateral Movement Simulator

Building Foundational Model

Vibe Coded EDR AI Assited Endpoint Monitor Tool

A curated list of awesome projects related to eBPF.

A free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing. Gain visibility and control, hunt for advanced threats, collaborate with the community, and write detections-as-code.

Scripts automate the installation and use of Wireguard on AWS with Ubuntu Server 18.04

No description.

This publication is a collection of various common attack scenarios on Microsoft Entra ID (formerly known as Azure Active Directory) and how they can be mitigated or detected.

Testing JWT Signing

Metasploit Framework - CVE-2025-40551

Detect Phish via TLS Validation

Proof of concept: using a Cloudflare worker for AITM attacks

Azure AiTM Function PoC to phish Entra ID Credentials

PowerShell SharePoint extraction + auditing tool for red/blue/purple teams. Enumerates all SharePoint sites/drives a user can access via Microsoft Graph, recursively downloads files, and logs every Graph + SharePoint HTTP request for SIEM correlation, detection engineering, and IR testing.

A pure PowerShell solution for Entra OAuth authentication, enabling easy retrieval of access and refresh tokens

Contact: [email protected]

No description.

A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID

It helps penetration testers or red teamers identify clients that allow **single-factor token acquisition** using username and password only — bypassing Conditional Access and MFA, if allowed by the app.

No description.

This Repo serves as a collection of shared security and penetration testing resources for the cloud.

Welcome to the Cloud Security Toolkit repository, your all-in-one destination for cutting-edge cloud security resources! Whether you're diving into offensive strategies, mastering threat hunting, or bolstering your blue-team defenses, this repo has you covered.

C# implementation of TokenFinder. Steal M365 access tokens from Office Desktop apps

A PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.

Subterranean (subT) is a tunnelling relay for inside out access

OID-See is an identity attack surface mapping tool that models OAuth trust, persistence, and impersonation paths in Entra using a graph-based approach.

DLL reflective loader in golang

A tool designed for smuggling interactive command and control traffic through legitimate TURN servers hosted by reputable providers such as Zoom.

SharpDPAPI is a C# port of some Mimikatz DPAPI functionality.

Credentials recovery project

Extracts browser-stored data such as refresh tokens, cookies, saved credentials, credit cards, autofill entries, browsing history, and bookmarks from modern Chromium-based and Gecko-based browsers (Chrome, Microsoft Edge, Firefox, Opera, Opera GX, and Vivaldi)

No description.

Sysmon Config Pusher - Modernized

Harden your Chrome browser via enterprise policy.

Chrome-extension implant that turns victim Chrome browsers into fully-functional HTTP proxies, allowing you to browse sites as your victims.

Modlishka. Reverse Proxy.

necromantic session control

Repository created to share information about tactics, techniques and procedures used by threat actors. Initially with ransomware groups and evolving to other types of threats.

Proof-of-Concept tool for extracting NTLMv1 hashes from sessions on modern Windows systems.

WinBtrfs - an open-source btrfs driver for Windows

Now You See Me, Now You Don't

Living Off The Land Drivers

No description.

Connect your Canary Console to Claude via MCP - Natural Language API interaction

OGhidra bridges Large Language Models (LLMs) via Ollama with the Ghidra reverse engineering platform, enabling AI-driven binary analysis through natural language. Interact with Ghidra using conversational queries and automate complex reverse engineering workflows.

ATHF is a framework for agentic threat hunting - building systems that can remember, learn, and act with increasing autonomy.

AI-powered Windows Event Log analyzer that learns from your feedback. Uses Claude AI with RAG to detect suspicious activity, improve accuracy over time, and share learnings across your team. CLI and MCP server interfaces.

The Art of Pivoting - Techniques for Intelligence Analysts to Discover New Relationships in a Complex World

⚓️ Easily test HTTP webhooks with this handy tool that displays requests instantly.

Serverless AITM Simulation Framework for Entra ID and M365

A deliberately vulnerable Microsoft Entra ID environment. Learn identity security through hands-on, realistic attack challenges.

A next-generation HTTP stealth proxy which perfectly cloaks requests as the Chrome browser across all layers of the stack.

Chrome Debugging Protocol interface for Node.js

AI Inspired Chrome Extension to help log / request / response / paramters.

Validate Login is authorized MSFT Page

No description.

Windows Script Host .NET runner

HTA drops vulnerable Driver - Bulder - Package - passwords probably "atomic"

No description.

PC免杀远控winos4.0成品

免杀远控木马源码整理开源(银狐 winos 大灰狼 gh0st) Rat

A command-line scanner for batch detection of Next.js application versions and determining if they are affected by CVE-2025-66478 vulnerability.

Copy of Subtee's Repository That's Taken Down

No description.

MITM proxy for TCP/TLS/DTLS/UDP traffic, with support for TLS upgrades like STARTTLS, PostgreSQL, and more.

↕️🤫 Stealth redirector for your red team operation security

A APowerShell Based Certificate Creation and Signing - for things like EXE and RDP etc...

Collection of useful Canary tools

Harden Windows Safely, Securely using Official Supported Microsoft methods and proper explanation | Always up-to-date and works with the latest build of Windows | Provides tools and Guides for Personal, Enterprise, Government and Military security levels | Read The Rationale https://github.com/HotCakeX/Harden-Windows-Security/blob/main/Rationale.md

A tool for testing for certificate validation vulnerabilities of TLS connections made by a client device or an application.

Mobile Application Fuzzer via SSL MITM

VerSprite Security Research

Bruteforce dictionary attack on bitcoin brain wallets

Rusty Hypervisor - Windows Kernel Blue Pill Type-2 Hypervisor in Rust (Codename: Matrix)

Rusty Hypervisor - Windows UEFI Blue Pill Type-1 Hypervisor in Rust (Codename: Illusion)

Rusty Bootkit - Windows UEFI Bootkit in Rust (Codename: RedLotus)

No description.

Kernel Signed Driver Validation Research

No description.

Bitcoin wallet private key brute force finder

Tools and Techniques for Blue Team / Incident Response

Javascript Bitcoin Wallet. Supports Multisig, Stealth, HD, SegWit, Bech32, Time Locked Addresses, RBF and more!

Python Library for Secp256k1 Bitcoin curve to do fast ECC calculation

Retrieve ECDSA signature R,S,Z values from blockchain rawtx or txid.

Brute force Bitcoin private keys.

Bitcoin Wallet Address Generator

macFUSE umbrella repository

Deception System - in Python basic ProjFS constructs examples.

Windows Projected File System for Python

Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

VMware VMX Crypto Module for Python

This repository implements a Python function that recovers the private key from two different signatures that use the same random nonce during signature generation.

Red Canary Mac Monitor is an advanced, stand-alone system monitoring tool tailor-made for macOS security research. Beginning with Endpoint Security (ES), it collects and enriches system events, displaying them graphically, with an expansive feature set designed to reduce noise.

Reverse Engineering: Decompiling Binary Code with Large Language Models

Enhance Your Active Directory Password Spraying with User Intelligence.

Sync Windows directory with remote directory using Windows Cloud Files API

C# Cloud Sync Engine using cloud files API introduced in Windows 10.

MSBuild without MSbuild.exe

MSBuild Without MSBuild.exe

User mode file system library for windows with FUSE Wrapper

A collection of Azure AD tools for offensive and defensive security purposes

Azure Security Resources and Notes

This repository contains a collection of cheatsheets I have put together for tools related to pentesting organizations that leverage cloud providers.

SpecterOps Presentations

Cybersecurity AI (CAI), the framework for AI Security

game of active directory (SnapLabs version)

A WireGuard UWP VPN plugin.

A 5G Sniffer and Downlink Injector Framework on steroids... And yes, Wireshark supported!!!

SimpleVisor is a simple, portable, Intel VT-x hypervisor with two specific goals: using the least amount of assembly code (10 lines), and having the smallest amount of VMX-related code to support dynamic hyperjacking and unhyperjacking (that is, virtualizing the host state from within the host). It works on Windows and UEFI.

This is POC for IOS 0click CVE-2025-43300

ELEGANTBOUNCER is a detection tool for file-based mobile exploits.

No description.

A tool that implements the Golden SAML attack

BeaconatorC2 is a framework for red teaming and adversarial emulation, providing a full-featured management interface, along with a catalog of beacons and a clear schema to add more beacons over time.

Collection of malware source code for a variety of platforms in an array of different programming languages.

:cloud: :zap: Granular, Actionable Adversary Emulation for the Cloud

Microsoft Authentication Library (MSAL) for iOS and macOS

A basic TimeCard app - Test EntraID - iOS interaction

A complete, proof-of-concept, C# implementation of the General Number Field Sieve algorithm for factoring very large semi-prime numbers. The focus was on readability and understandability of the code, not performance.

Forensic toolkit for iOS sysdiagnose feature

kfd, short for kernel file descriptor, is a project to read and write kernel memory on Apple devices.

A completely free, open source and online course about Reverse Engineering iOS Applications.

PoC for CVE-2020-0601- Windows CryptoAPI (Crypt32.dll)

OpenBullet reinvented

A comprehensive ETW (Event Tracing for Windows) event generation tool designed for testing and research purposes.

No description.

Open-Source Phishing Toolkit