TheDarkMark is a C2 framework designed to be fast and parallel.

🐍 TOON for Python (Token-Oriented Object Notation) Encoder/Decoder - Reduce LLM token costs by 30-60% with structured data.

PowerShell toolkit that extracts locked Windows files (SAM, SYSTEM, NTDS, ...) using MFT parsing and raw disk reads

PowerShell tool that shows how to read and write NTLM OWF values via samlib.dll.

BOF to steal Teams cookies

A tool to view and extract the contents of an Windows Installer (.msi) file.

Active Directory Firewall

Totally Automatic LFI Exploiter (+ Reverse Shell) and Scanner

A tool designed to exploit bad implementations of decryption mechanisms in Laravel applications.

A C# tool for requesting certificates from ADCS using DCOM over SMB. This tool allows you to remotely request X.509 certificates from CA server using the MS-WCCE protocol over DCOM and It bypasses …

Conquest is a feature-rich and malleable command & control/post-exploitation framework developed in Nim.

Defeating Windows User Account Control

PowerShell collector for adding MSSQL attack paths to BloodHound with OpenGraph

NOF0 - 开源的 AI 交易竞技场

A library for loading dll module bypassing windows PE loader from memory (x86/x64)

A PICO for Crystal Palace that implements CLR hosting to execute a .NET assembly in memory.

The DCERPC only printerbug.py version

kernel-mode DLL Injector

异步Beacon Object Files概念的实现。它提供了一个框架，用于运行可以检测事件并报告回Cobalt Strike团队服务器的异步监控任务。

Proof-of-Concept tool for extracting NTLMv1 hashes from sessions on modern Windows systems.

IDA Pro plugin to make bitfield accesses easier to grep

EDR-Redir : a tool used to redirect the EDR's folder to another location.

WSUS Unauthenticated RCE

Deobfuscate obfuscator.io, unminify and unpack bundled javascript

Tool to bypass LSA Protection (aka Protected Process Light)

Wfuzz fork

Beacon Object File (BOF) for Using the BadSuccessor Technique for Account Takeover

Crystal Palace library for proxying Nt API calls via the Threadpool