h0n3yb Goto Github PK

aceldr

Cobalt Strike UDRL for memory scanner evasion.

adreaper

A fast enumeration tool for Windows Active Directory Pentesting written in Go

atomicsyscall

Tools and PoCs for Windows syscall investigation.

bflat

C# as you know it but with Go-inspired tooling (small, selfcontained, and native executables)

busysleepbeacon

This is a simple project made to evade https://github.com/thefLink/Hunt-Sleeping-Beacons by using a busy wait instead of beacon's built in Sleep() call. Most of the structure e.g. Sleep hook, shellcode exec etc. are taken from mgeeky's https://github.com/mgeeky/ShellcodeFluctuation.

bypassanti-virus

免杀姿势学习、记录、复现。

creadmemory

Read Memory without ReadProcessMemory for Current Process

deepsleep

A variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC

doge-gabh

GetProcAddressByHash/remap/full dll unhooking/Hell's Gate/Tartaru's Gate/RecycledGate/universal/Perun's Fart golang implementation

doppelgate

DoppelGate relies on reading ntdll on disk to grab syscall stubs, and patches these syscall stubs into desired functions to bypass Userland Hooking.

driploader

Evasive shellcode loader for bypassing event-based injection detection (PoC)

ekko

Sleep Obfuscation

etwti-syscall-hook

A simple program to hook the current process to identify the manual syscall executions on windows

falconeye

foliage

Experiment on reproducing Obfuscate & Sleep

havoc

The Havoc Framework

herpaderply_hollowing

Herpaderply Hollowing - a PE injection technique, hybrid between Process Hollowing and Process Herpaderping

inceptor

Template-Driven AV/EDR Evasion Framework

malmemdetect

Detect strange memory regions and DLLs

malseclogon

A little tool to play with the Seclogon service

mortar

evasion technique to defeat and divert detection and prevention of security products (AV/EDR/XDR)

nim-halosgate-injector

Shellcode Injector that obtains system call opcodes using the Halo's Gate method to evade EDR Hooks.

nimdllsideload

DLL sideloading/proxying with Nim!

nimlinewhispers

A very proof-of-concept port of InlineWhispers for using syscalls in Nim projects.

nttracecontrol

Powershell Event Tracing Toolbox

peloader

PE loader with various shellcode injection techniques

poc-development

ppid-spoofing

POC of PPID spoofing using NtCreateUserProcess with syscalls to create a suspended process and performing process injection by overwritting ntdll:LdrInitializeThunk with shellcode.

ppldump

Dump the memory of a PPL with a userland exploit

pr0cess

some gadgets about windows process and ready to use :)