BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more

Kernel Driver Utility

Stealthy Linux Kernel Rootkit for modern kernels (6x)

Bypass Chromium's App-Bound Encryption via Direct Syscall-based Reflective Process Hollowing. Extract cookies, passwords, payment methods & tokens from Chrome, Edge, Brave & Avast - fileless, user-…

Qtap: An eBPF agent that captures pre-encrypted network traffic, providing rich context about egress connections and their originating processes.

A modern 32/64-bit position independent implant template

Proof-of-Concept tool for extracting NTLMv1 hashes from sessions on modern Windows systems.

Extract data from modern Chrome versions, including refresh tokens, cookies, saved credentials, autofill data, browsing history, and bookmarks

Dump LSASS via physical memory read primitives in vulnerable kernel drivers

miscellaneous scripts and programs

POC tool to convert CobaltStrike BOF files to raw shellcode

Beacon Object File (BOF) port of DumpGuard for extracting NTLMv1 hashes from sessions on modern Windows systems.