robinfassinamoschiniforks Goto Github PK

hardhatc2

A c# Command & Control framework

hashcat

World's fastest and most advanced password recovery utility

havoc

The Havoc Framework

havoc-modules

Modules used by the Havoc Framework

havoc-py

Havoc python api

havocframework-modules

Modules used by the Havoc Framework

hellhall

Performing Indirect Clean Syscalls

hellsgate

Original C Implementation of the Hell's Gate VX Technique

hellsgateppid

Assembly HellGate implementation that directly calls Windows System Calls and displays the PPID of the explorer.exe process

hiddendesktop

HVNC for Cobalt Strike

hollow

EarlyBird process hollowing technique (BOF) - Spawns a process in a suspended state, inject shellcode, hijack main thread with APC, and execute shellcode

hollows_hunter

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

hunt-sleeping-beacons

Aims to identify sleeping beacons

hw-call-stack

Use hardware breakpoints to spoof the call stack for both syscalls and API calls

hwbp4mw

hwsyscalls

HWSyscalls is a new method to execute indirect syscalls using HWBP, HalosGate and a synthetic trampoline on kernel32 with HWBP.

impacket

Impacket is a collection of Python classes for working with network protocols.

improvedreflectivedllinjection

An improvement of the original reflective DLL injection technique by Stephen Fewer of Harmony Security

inceptor

Template-Driven AV/EDR Evasion Framework

inject-assembly

Inject .NET assemblies into an existing process

injectamsibypass

Cobalt Strike BOF - Bypass AMSI in a remote process with code injection.

injectetwbypass

CobaltStrike BOF - Inject ETW Bypass into Remote Process via Syscalls (HellsGate|HalosGate)

inlineexecute-assembly

InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module

inlinewhispers

Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF)

inlinewhispers2

Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF) via Syswhispers2

interceptor

Interceptor is a kernel driver focused on tampering with EDR/AV solutions in kernel space

intractablegiraffe

A Proof of Concept Rootkit Demonstrating Keylogging and Virtual File System (VFS) Capabilities

ironsharppack

IronSharpPack is a repo of popular C# projects that have been embedded into IronPython scripts that execute an AMSI bypass and then reflective load the C# project.

janus

Janus is a pre-build event that performs string obfuscation during compile time. This project is based off the CIA's Marble Framework

jfmaes-blogposts-talks-and-tidbits

all random stuff that dont warrant a seperate repo