fckoo Goto Github PK

dirdevil

hiding in plain sight: part 2

disable-tamperprotection

A POC to disable TamperProtection and other Defender / MDE components

dllnotificationinjection

A POC of a new “threadless” process injection technique that works by utilizing the concept of DLL Notification Callbacks in local and remote processes.

dnlib

Reads and writes .NET assemblies and modules

dnspy

.NET debugger and assembly editor

dnspy-unity-mono

Fork of Unity mono that's used to compile mono.dll with debugging support enabled

dockerlabs

Docker - Beginners | Intermediate | Advanced

dockerregistrygrabber

Enumerate / Dump Docker Registry

donpapi

Dumping DPAPI credz remotely

donut

Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters

dosvisor

x86 Real-Mode MS-DOS Emulator using Windows Hypervisor Platform

dotnettojscript

A tool to create a JScript file which loads a .NET v2 assembly from memory.

dploot

DPAPI looting remotely in Python

dsebler

Reimplementation of the KExecDD DSE bypass technique.

dynamic-dtd

A python Flask app that generates dynamic DTDs for easy out-of-band data exfiltration.

eaglevm

Native code virtualizer for x64 binaries

edr-internals

Tools for analyzing EDR agents

edrsandblast

edr_blocker

Blocks EDR Telemetry by performing Person-in-the-Middle attack where network filtering is applied using iptables. The blocked destination IP addresses are parsed based on the server name in TLS Client Hello packet and the provided blocked server name (or blocked string) list in the file.

ekko

Sleep Obfuscation

elfiescanner

A C++ tool for process memory scanning & suspicious telemetry generation that attempts to detect a number of malicious techniques used by threat actors & those which have been incorporated into open-source user-mode rootkits.

enablealltokenprivs

entropyreducer

Reduce Entropy And Obfuscate Youre Payload With Serialized Linked Lists

enyelkm

LKM rootkit for Linux x86 with the 2.6 kernel. It inserts salts inside system_call and sysenter_entry.

esmat

macOS Endpoint Security Message Analysis Tool

etwinspector

evil-winrm

The ultimate WinRM shell for hacking/pentesting

evilarc

Create tar/zip archives that can exploit directory traversal vulnerabilities

evilginx-phishing-infra-setup

Evilginx Phishing Engagement Infrastructure Setup Guide

evilsln

A New Exploitation Technique for Visual Studio Projects