matterpreter Goto Github PK

cpuid

A class to emulate the behavior of NtQuerySystemInformation when passed the SystemHypervisorDetailInformation information class

cpuid_for_antivm

A collection of cpuid instruction implementations for anti-vm purposes.

defendercheck

Identifies the bytes that Microsoft Defender flags on.

dnspy

.NET debugger and assembly editor

elam

A Practical example of ELAM (Early Launch Anti-Malware)

empire

Empire is a PowerShell and Python post-exploitation agent.

empyre

A post-exploitation OS X/Linux agent written in Python 2.7

eyewitness

EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.

ferrisetw

Basically a KrabsETW rip-off written in Rust

findetwproviderimage

Quickly search for references to a GUID in DLLs, EXEs, and drivers

getda.sh

Identify common attack paths to get Domain Administrator

internetcatfeeder

Raspberry Pi internet-enabled cat feeder using the PicoBorg Reverse

malleable-c2

Cobalt Strike Malleable C2 Design and Reference Guide

misc

Collection of things I've written on pentests to make life easier.

mythic

A collaborative, multi-platform, red teaming framework

offensivecsharp

Collection of Offensive C# Tooling

openedr

Open EDR public repository

penteensy

USB HID for Penetration Testing

powersploit

PowerSploit - A PowerShell Post-Exploitation Framework

pubg-map-hack

Map hack solution for PUBG

rubeus

Trying to tame the three-headed dog.

seatbelt

Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.

shapeshifter

Companion PoC for the "Adventures in Dynamic Evasion" blog post

sharphound

sharphound3

C# Data Collector for the BloodHound Project, Version 3

sharpstay

.NET project for installing Persistence

shhmon

Neutering Sysmon via driver unload

spotter

Targeted Payload Execution

standin

StandIn is a small .NET35/45 AD post-exploitation toolkit

unicorn

Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. Based on Matthew Graeber's powershell attacks and the powershell bypass technique presented by David Kennedy (TrustedSec) and Josh Kelly at Defcon 18.