The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls

Use NtProtectVirtualMemory in Ekko timers without needing to use stack pivoting or other RSP shifting tricks

Azure apim mini proxy

Superagent protects your AI applications against prompt injections, data leaks, and harmful outputs. Embed safety directly into your app and prove compliance to your customers.

Orca is the ADE for working with a fleet of parallel agents. Run any coding agent with your own subscription. Available on desktop, mobile and VPS.

Authenticode signature manipulation toolkit for Red Team operations and security research. Covers signature stealing, metadata cloning, SIP hijacking across 19 file types, WinVerifyTrust FinalPolic…

ANIMO Azure Network Intel & Mission Ops a C2 based on Azure/Entra assessments

Pass-the-Passkey Family of Attacks

smbclient-ng, a fast and user friendly way to interact with SMB shares.

Self-hosted email sending platform built on Cloudflare Email Sending — REST API, admin UI, templates, domain management, scoped API keys, all in one Docker container.

GAP is a fileless persistence technique affecting all Chromium-based browsers (Edge, Chrome, Brave, Vivaldi).

SMBLoot is a terminal interface for browsing SMB shares, reading remote files, downloading and uploading files, and recursively inspecting remote directory trees.

A list of embedded scripting languages

Refreshing Device Bound Session Credentials (DBSC) with Chromiums session store and the Windows CNG API

A multi-platform CI/CD vulnerability detection and attack automation tool for identifying security weaknesses in pipeline configurations.

Model Context Protocol for WinDbg.

A Windows x64 offensive research framework that constructs fully synthetic call stacks

Entra ID user enumeration and auth method discovery via the public GetCredentialType API

A comprehensive modern architecture model is proposed to integrate platform solutions and tooling to support a professional Red Team.

Android Full-Stack Device Control Platform: WebRTC/H.264 remote desktop, UI/OCR/image-matching automation, one-click MITM, built-in Frida, proxy/VPN/frp/P2P networking, MCP/Agent, 160+ APIs, design…

Kali365 - EvilTokens Replica

Lateral Movement Bof with MSI ODBC Driver Install

OneForAll是一款功能强大的子域收集工具

SubDominator helps you discover subdomains associated with a target domain efficiently and with minimal impact for your Bug Bounty

Webcam capture capability for Cobalt Strike as a BOF, with in-memory download options

Cobalt Strike BOF to obtain location data

QEMU-based Linux implant for Windows

An open source, self-hosted implementation of the Tailscale control server

CodeNomad: The command center that puts AI coding on steroids.