q-a-z Goto Github PK

russkiwlst

Bundle of common passwords targeting RUSSIAN-speaking audience (parsed from big data leaks)

scarecrow

ScareCrow - Payload creation framework designed around EDR bypass.

scripts

Scripts and Stuff

secinject

Section Mapping Process Injection (secinject): Cobalt Strike BOF

shad0w

A post exploitation framework designed to operate covertly on heavily monitored environments

sharkexec

内网渗透|红队工具|C#内存加载|cobaltstrike

sharpallthethings

The idea is to collect all the C# projects that are Sharp{Word} that can be used in Cobalt Strike as execute assembly command.

sharpnopsexec

Get file less command execution for lateral movement.

sharprdphijack

A POC Remote Desktop (RDP) session hijack utility for disconnected sessions

sharpsecdump

.Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py

sharpunhooker

C# Based Universal API Unhooker

shellcode-in-memory-decoder

A simple C implementation to decoded your shellcode and writes it directly to memory

sigflip

SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature.

sigma

Execute shellcode with ZwCreateSection, ZwMapViewOfSection, ZwOpenProcess, ZwMapViewOfSection and ZwCreateThreadEx

simplifier

sleepycrypt

A shellcode function to encrypt a running process image when sleeping.

smbautorelay

SMB Auto Relay provides the automation of SMB/NTLM Relay technique for pentesting and red teaming exercises in active directory environments.

some_paper_collect

Collection of some articles

sourcepoint

SourcePoint is a C2 profile generator for Cobalt Strike command and control servers designed to ensure evasion.

spawn

Cobalt Strike BOF that spawns a sacrificial process, injects it with shellcode, and executes payload. Built to evade EDR/UserLand hooks by spawning sacrificial process with Arbitrary Code Guard (ACG), BlockDll, and PPID spoofing.

speakeasy

Windows kernel and user mode emulation.

srdi

Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode

srslte_to_gsm

standin

StandIn is a small .NET35/45 AD post-exploitation toolkit

string-obfuscator

suborner

synapse

A repo for Hacking tools

syscall_shellcodeload_csharp

Load shellcode via syscall

sysmonquiet

RDLL for Cobalt Strike beacon to silence sysmon process

taowu-cobalt-strike