Brings the power of ChatGPT to Ghidra!

Reverse Engineering: Decompiling Binary Code with Large Language Models

A BOF to retrieve decryption keys for WhatsApp Desktop and a utility script to decrypt the databases.

This function runs a number of checks on a system to help provide situational awareness to a penetration tester during the reconnaissance phase. It gathers information about the local system, users…

A C++ proof of concept demonstrating the exploitation of Windows Protected Process Light (PPL) by leveraging COM-to-.NET redirection and reflection techniques for code injection. This PoC showcases…

Red teaming tool to dump LSASS memory, bypassing basic countermeasures.

A truly Position Independent Code (PIC) NimPlant C2 beacon written in C, without reflective loading.

Loads any C# binary in mem, patching AMSI + ETW.

Hide your Powershell script in plain sight. Bypass all Powershell security features

Shellcode Loader Utilizing ETW Events

Generate and Manage KeyCredentialLinks

Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region.

Your Skyfall Infrastructure Pack

shell code example

Test AMSI Provider implementation in C#

early cascade injection PoC based on Outflanks blog post

Open Source C&C Specification

"AMSI WRITE RAID" Vulnerability that leads to an effective AMSI BYPASS

Awesome EDR Bypass Resources For Ethical Hacking

Awesome AV/EDR/XDR Bypass Tips

An offensive data enrichment pipeline

LOLAPPS is a compendium of applications that can be used to carry out day-to-day exploitation.

Simple hunting script for suspicious M365 OAuth Apps

Malware As A Service

Indirect Syscall with TartarusGate Approach in Go