Repository for various Beacon Object Files (BOFs)

Reverse engineer anything with agents, from app behavior down to native binaries.

Demonstration of the DLL party process injection technique

红果短剧｜Windows 10/11 桌面版 + Android TV 测试版。电视 APK 4.03 MB，Android 5.0+ / ARM64，支持遥控、续播与换一部；免费使用，由渠道有数独立维护。

AD AutoPwn v4.13.0 — automated AD attack chain, zero-auth to Domain Admin. Discover/Kerberoast/AS-REP/AD CS ESC1-16/Shadow Creds/RBCD+KCD/Ghost-SPN/TGS-rewrite/Dollar-Ticket/WPAD/WSUS/PXE/SCCM/Bloo…

SilentChrome-BOF installs Chromium extension, native messaging, and Isolated Web App profile artifacts

CVE-2026-85706 Unauthenticated File Read

Kernel stack buffer overflow in ROCCAT Kone.sys (CWE-121), local privilege escalation reachable by any user. Verified on Windows 11.

Run unsigned kernel payloads in a signed kernel driver via wasm3. No JIT/W^x (HVCI/etc., compliant)

A collection of BOF-PE's that allow running tailscale from memory

POC tool for ResetNightmare (CVE-2026-27912)

Beacon Object File for CVE 2026-54121

SharpSilentChrome is a C# project that "silently" installs browser extensions on Google Chrome or MS Edge by updating the browsers' Preferences and Secure Preferences files. Currently, it only supp…

Educational Chrome extensions simulating real-world attacker behavior in the browser. Built for Red Team demos, threat emulation, and adversary simulation scenarios.

Automating the MITM attack on WSUS

Find zero-days while you sleep. DeepZero is an automated vulnerability research framework that parses, decompiles, and analyzes thousands of Windows kernel drivers for exploitable IOCTLs natively u…

A Bloodhound alternative. BloodBash will ingest the same files bloodhound does but no server is required to use this tool. It's great for quick AD enumeration.

Security Researcher • Tool Developer • Offensive Security

A Beacon Object File suite for Microsoft SQL Server that speaks TDS 7.4 on the wire itself

Docker labs + defensive scanner for fastjson remote-class-load RCE. fastjson 1.2.66-1.2.83: @JSONType resource probe (CVE-2026-16723). fastjson2 2.0.57: attacker @type reaches loadClass with autoTy…

Timeroasting scripts by Tom Tervoort

User-mode ETW interception and telemetry manipulation lab for Windows security research.

A BYOVD technique abuse tool

Interactive documentation and visual reference for binary formats and system memory layouts.

Beacon Object File for LDAP Queries Through ADWS

adws enumeration bof

A practical client for ADWS in Golang.

Active Directory Vulnerability Scanner

A BloodHound OpenGraph collector that models Windows local privilege escalation as interconnected attack paths.

Active Directory information dumper via ADWS for evasion purposes.