Villain Villain is a high level C2 framework that can handle multiple TCP socket & HoaxShell-based reverse shells, enhance their functionality with additional features (commands, utilities etc) and share them among connected sibling servers...
AMSI Bypass via VEH A PowerShell AMSI Bypass technique via Vectored Exception Handler (VEH). This technique does not perform assembly instruction patching, function hooking or Import Address Table (IAT) modification. How it works: For...
RedFlag RedFlag leverages AI to determine high-risk code changes. Run it in batch mode to scope manual security testing of release candidates, or run it in your CI pipelines to flag PRs and add...
MSSQL ATTACK TOOL The MSSQL ATTACK TOOL (M.A.T) was developed at SySS internally in a Research & Development project. The tool, programmed in C#, allows for the fast discovery and exploitation of vulnerabilities in...
MDE_Enum MDE_Enum is a comprehensive .NET tool designed to extract and display detailed information about Windows Defender exclusions and Attack Surface Reduction (ASR) rules. It is capable of querying both local and remote systems...
kflowd kflowd runs as an agent on Linux endpoints to monitor processes via eBPF kernel subsystem for filesystem and TCP and UDP networking events, enabling immediate threat and anomaly detection on suspicious activities. Advanced...
TheAllCommander Framework for modeling and researching C2 communications for developing efficient filtering and detection logic. TheAllCommander 2.1 (April 2024) includes support for logging telemetry data gathered from test daemons, as well as alpha support...
Fragtunnel Fragtunnel is a PoC TCP tunneling tool that exploits the design flaw that IDS/IPS engines and Next Generation Firewalls have; therefore, it can tunnel your application’s traffic to the target server and back...
Secretlint Secretlint is that Pluggable linting tool to prevent committing credentials. Feature Scanner: Found credentials in a project and report these Project Friendly: Easy to set up your project and integrate CI services Pre-Commit Hook:...
DonPAPI DonPAPI automates secrets dump remotely on multiple Windows computers, with defense evasion in mind. Collected credentials: Chromium browser Credentials, Cookies, and Chrome Refresh Token Windows Certificates Credential Manager Firefox browser Credentials and Cookies...
BlueSpy – PoC to record audio from a Bluetooth device This repository contains the implementation of a proof of concept to record and replay audio from a Bluetooth device without the legitimate user’s awareness....
smbclient-ng A fast and user-friendly way to interact with SMB shares. Feature bat: Pretty prints the contents of a file. Syntax: bat <file> cat: Get the contents of a file. Syntax: cat <file> cd: Change the...
