atropineal Goto Github PK

docpatch

A simple script that edits the XML of a macro-enabled Word document (.docm or Word 97 document) to add a reference to a remote stylesheet.

doh_c2_trigger

Code for blogpost: https://outflank.nl/blog/2018/10/25/building-resilient-c2-infrastructues-using-dns-over-https/

domaincheck

DomainCheck is designed to assist operators with monitoring changes related to their domain names. This includes negative changes in categorization, VirusTotal detections, and appearances on malware blacklists. DomainCheck currently works only with NameCheap.

domainpasswordspray

DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain. By default it will automatically generate the userlist from the domain. BE VERY CAREFUL NOT TO LOCKOUT ACCOUNTS!

donut

Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies from memory and runs them with parameters

donutcs

dem sharp donuts

dotnettojscript

A tool to create a JScript file which loads a .NET v2 assembly from memory.

download

dumpert

LSASS memory dumper using direct system calls and API unhooking.

easynet

Simple packer for arbitrary data using only .NET API calls. Produces a unique signature with every usage. Standalone program and library. Algorithm: Data <-> GZip <-> AES-256 <-> Base64.

empire

Empire is a PowerShell and Python post-exploitation agent.

etl2pcapng

Utility that converts an .etl file containing a Windows network packet capture into .pcapng format.

evilclippy

A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX and Windows.

excel4-dcom

PowerShell and Cobalt Strike scripts for lateral movement using Excel 4.0 / XLM macros via DCOM (direct shellcode injection in Excel.exe)

exportnotexportableprivatekey

external_c2

POC for Cobalt Strike external C2

external_c2_framework

Python api for usage with cobalt strike's External C2 specification

externalc2

A library for integrating communication channels with the Cobalt Strike External C2 server

eyewitness

EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.

fakebelt

Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.

fakelogonscreen

Fake Windows logon screen to steal passwords

filewriter

.NET project for writing files to local or remote hosts

firecat

Firecat is a penetration testing tool that allows you to punch reverse TCP tunnels out of a compromised network.

firefox_decrypt

Firefox Decrypt is a tool to extract passwords from Mozilla (Firefox™, Waterfox™, Thunderbird®, SeaMonkey®) profiles

fireprox

AWS API Gateway management tool for creating on the fly HTTP pass-through proxies for unique IP rotation

foolavc

foolav successor - loads DLL, executable or shellcode into memory and runs it effectively bypassing AV

fox

A companion tool for BloodHound offering Active Directory statistics and number crunching

g-calisher

This program will connect to Google's API using an access token and inject a calendar event into a target's calendar.

getsystem

This is a C# implementation of making a process/executable run as NT AUTHORITY/SYSTEM. This is achieved through parent ID spoofing of almost any SYSTEM process.

ghost-in-the-logs

Evade sysmon and windows event logging