Starred repositories
Give coding agents a disposable Linux VM, not your laptop
BOF to manage Active Directory Integrated DNS (ADIDNS)
Dump TGTs remotely and convert Windows' klist binary output to ccache.
BOF to steal browser cookies & credentials
Beacon Object File to Enable Chrome DevTools Protocol (CDP)
SpotifyC2 is a cybersecurity research project that demonstrates cloud-based command communication using Spotify playlists for command retrieval and Telegram for output delivery, without requiring t…
ROFMAD (Rust Orchestrator For Modular Automated Discovery)
DCOM in memory and fileless lateral movement techniques through .Net deserilization
RoguePlanet Windows Defender Vulnerability
A credential extraction .NET assembly for Veeam Backup & Replication and Veeam One
Store sensitive files in the cloud, or on shared media without trusting the host. LUKSbox is a Rust-based encrypted-container tool with passphrase, FIDO2 (YubiKey, Titan, Nitrokey, Windows Hello), …
This repo contains the results of an internal re-write of impacket I undertook at my current company. It contains some of the IoCs found within the library
PoC to interact with local/remote registry hives through WMI
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a s…
SharpDPAPI ported to Cobalt Strike BOFs — 19 self-contained BOFs for DPAPI credential triage
A Beacon Object File suite for Microsoft SQL Server that speaks TDS 7.4 on the wire itself
A credential extraction BOF for Veeam Backup and Replication and Veeam One
A CobaltStrike toolkit to write files produced by Beacon to memory instead of disk
Extract Windows credentials directly from VM memory snapshots and virtual disks
Spawn Up quickly Elastic EDR Panel
Active Directory Certificate Services (ADCS) enumeration library with BloodHound CE v6 export support
BAADTokenBroker is a post-exploitation tool designed to interact with Microsoft Entra ID device-bound keys.
Ghidra MCP Server — 200+ MCP tools for AI-powered reverse engineering. GUI plugin + headless server, lazy tool loading, convention enforcement, batch operations, Ghidra Server integration, and Dock…
A Cobalt Strike RL built with Crystal Palac; module overloading, NtContinue entry transfer, call stack spoofing, sleep masking, and static signature removal.