t3hbb Goto Github PK

aggressorcollection

Collection of awesome Cobalt Strike Aggressor Scripts. All credit due to the authors

aggressorscripts

Various Aggressor Scripts I've Created.

amsi-bypass

"AMSI WRITE RAID" Vulnerability that leads to an effective AMSI BYPASS

aquarmoury

My musings in C and offensive tooling

c2concealer

C2concealer is a command line tool that generates randomized C2 malleable profiles for use in Cobalt Strike.

callstackspoofer

A PoC implementation for spoofing arbitrary call stacks when making sys calls (e.g. grabbing a handle via NtOpenProcess)

citrixphishlet

Citrix Phishlet

cobalt-wipe

Cobalt wipe is the non-commercial version of Cobalt-Strike 4.3 (May 2021 Release)

cobalt_strike_extension_kit

Attempting to be an all in one repo for others' userful aggressor scripts as well as things we've found useful during Red Team Operations.

cobaltstrike-aggressor-scripts-collection

Collection of tested Cobaltstrike aggressor scripts.

codecepticon

.NET/PowerShell/VBA Offensive Security Obfuscator

com-hunter

COM Hijacking VOODOO

coogle

A shot-for-shot remake of the Google Login Page.

crackmapexec

A swiss army knife for pentesting networks

credsniper

CredSniper is a phishing framework written with the Python micro-framework Flask and Jinja2 templating which supports capturing 2FA tokens.

darkwidow

Indirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird + Spawns a sacrificial Process as target process + (ACG+BlockDll) mitigation policy on spawned process + PPID spoofing + Api resolving from TIB + API hashing

defendercheck

Identifies the bytes that Microsoft Defender flags on.

dojoloader

Generic PE loader for fast prototyping evasion techniques

dumpert

LSASS memory dumper using direct system calls and API unhooking.

edrsandblast

enablealltokenprivs

eva

FUD shellcode Injector

eventcleaner

A tool mainly to erase specified records from Windows event logs, with additional functionalities.

filelesspeloader

Loading Remote AES Encrypted PE in memory , Decrypted it and run it

gdrv-loader

Kernel driver loader using vulnerable gigabyte driver (https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities) to load a unsigned driver

headerfile

Header file to prepend to Logger++ output for ease of import into SQL

home-grown-red-team

htmlsmuggler

✉️ HTML Smuggling generator&obfuscator for your Red Team operations

ipv4bypass

Using IPv6 to Bypass Security

jws_tool

Burp Extension to modify headers and maintain JWS validity