Stars
Zero Day Vulnerabilities in Clamav. Discovered entirely by Clankers.
✨Spark is a web-based, cross-platform and full-featured Remote Administration Tool (RAT) written in Go that allows you control all your devices anywhere. Spark是一个Go编写的，网页UI、跨平台以及多功能的远程控制和监控工具，你可以随时…
面向浏览器的 JSVMP：将 JavaScript 编译为自定义字节码，由栈式虚拟机解释执行，配套 IR 混淆与运行时混淆和打包
一个基于栈式架构的 JavaScript 虚拟机，支持在沙盒环境中安全执行 JavaScript 代码。使用 Babel AST 解析和字节码编译技术，提供完整的 JavaScript 语法支持。
Convert Microsoft Defender Antivirus Signatures (VDM) into YARA rules
BingusLdr is a DLL loader built with Crystal Palace that uses a CET compatible stack spoofing technique.
Moonwalk++: Simple POC Combining StackMoonwalking and Memory Encryption
x64 PE bin2bin obfuscator which doesn't add a section to the binary
TeamServer and Client of Exploration Command and Control Framework
A stealthy and modular Windows loader designed to bypass modern EDR solutions using Module Stomping, Stack Duplication, and Advanced Sleep Obfuscation.
🍂 Rust LLVM obfuscation framework with instruction-level VMP/code virtualization for Android, C/C++ and Rust. Supports LLVM 11–22.
Busybox-style Beacon Object Files for *nix post-exploitation. Reimplements common Unix utilities as BOFs for use in stripped environments (Docker containers, Kubernetes pods, minimal VMs) where no …
InfinityCurveLabs / BusyBOF
Forked from cmprmsd/BusyBOFBusybox-style Beacon Object Files for *nix post-exploitation. Reimplements common Unix utilities as BOFs for use in stripped environments (Docker containers, Kubernetes pods, minimal VMs) where no …
ARM64 ELF Virtual Machine Protection System
A robust Windows Process Executable Packer and Launcher implementation written in Rust for Windows x64 systems.
Self-developed tools for Lateral Movement/Code Execution
Template-Driven AV/EDR Evasion Framework
PoC Implementation of a fully dynamic call stack spoofer
A tool uses the QoS Policy (Pacer.sys) to throttle Endpoint Detection and Response (EDR) agents from connecting to the server.
HWSyscalls is a new method to execute indirect syscalls using HWBP, HalosGate and a synthetic trampoline on kernel32 with HWBP.
AADInternals PowerShell module for administering Azure AD and Office 365
Scripts I use to deploy Havoc on Linode and setup categorization and SSL
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a s…
A lightweight, fast and reliable tun2socks
A lightweight port-forwarding and socks proxy tool written in Rust 🦀