BlackLotus UEFI Windows Bootkit

Mock, Test & Track HTTP Requests and Response for Microservices

Public Repo for Atomic Test Harness

Apache Tomcat JMXProxy RCE

Kernel driver loader using vulnerable gigabyte driver (https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities) to load a unsigned driver

A post exploitation utility for loading signed kernel drivers using both the undocumented NtLoadDriver function and by directly interfacing with the Windows Service Control Manager (SCM)

The goal of this repository is to document the most common techniques to bypass AppLocker.

A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk

Leverage AMSI (Antimalware Scan Interface) technology to aid your analysis. This tool saves all buffers (scripts, .NET assemblies, etc) passed into AMSI during dynamic execution.

Build a attack range in your local machine

Project for identifying executables and DLLs vulnerable to relative path DLL hijacking.

Authenticode for PNG files

Load PE via XML Attribute

Small scripts that make life better

Finding anomalies for specific processes based on their GeoIP connections

⭐ ⭐ ⭐ Build your own IP Attack Maps with SOUND!

subTee gists code backups

To block the malware domains of coin-hive.

Various webshells. We accept pull requests for additions to this collection.

Command line interface to Carbon Black Response

Cb Response - Splunk Integration