A behavioral analytics library that uses dom mutations and user interactions to generate aggregated insights.

An overview of LLMs for cybersecurity.

Light, fluffy, and always free - The AWS Local Emulator alternative

A secure* runtime for autonomous AI agents. Policy from plain-English constitutions. (*https://ironcurtain.dev)

PX4 Autopilot Software

Location of some Active Directory lab scripts I have created and find useful

Template-based shellcode packer written in Rust, with indirect syscall support. Made with <3 for pentesters.

Windows Dependencies

A monitor of resources

Windows Security Descriptor Definition Language (SDDL) parser and formatter

An advanced, yet simple, tunneling/pivoting tool that uses a TUN interface.

Allows viewing, editing, and even deleting individual items within the Windows clipboard

SoaPy is a Proof of Concept (PoC) tool for conducting offensive interaction with Active Directory Web Services (ADWS) from Linux hosts.

Java Dynamic Reverse Engineering and Debugging Tool

Process-aware, eBPF-based tcpdump

Public issue tracking and documentation for Foundry Virtual Tabletop - software connecting RPG gamers in a shared multiplayer environment with an intuitive interface and powerful API.

An analysis of the user password hashing algorithm used by Citrix NetScaler

Moriarty is designed to enumerate missing KBs, detect various vulnerabilities, and suggest potential exploits for Privilege Escalation in Windows environments.

Some scripts to support with importing large datasets into BloodHound

A C# port from Invoke-GhostTask

The GPOddity project, aiming at automating GPO attack vectors through NTLM relaying (and more).

Notify is a Go-based assistance package that enables you to stream the output of several tools (or read from a file) and publish it to a variety of supported platforms.

NTP Exfiltration Tool

WindowSpy is a Cobalt Strike Beacon Object File meant for automated and targeted user surveillance.

Steganalysis web platform

The Network Execution Tool

Simple HS256, HS384 & HS512 JWT token brute force cracker.

Create a vulnerable active directory that's allowing you to test most of the active directory attacks in a local lab

Windows Defender Killer | Registry-Based Disablement + BYOVD Process Termination (C++)

Lateral Movement Using DCOM and DLL Hijacking