toxicnade Goto Github PK

ad-description-password-finder

Retrieve AD accounts description and search for password in it

apollo

A .NET Framework 4.0 Windows Agent

asmhalosgate

x64 Assembly HalosGate direct System Caller to evade EDR UserLand hooks

atompepacker

A Highly capable Pe Packer

bifrost

Objective-C library and console to interact with Heimdal APIs for macOS Kerberos

bof-foreignlsass

bypass-beaconeye

bypass BeaconEye

c2-tool-collection

A collection of tools which integrate with Cobalt Strike (and possibly other C2 frameworks) through BOF and reflective DLL loading techniques.

citrixsecureaccessauthcookiedump

Dump Citrix Secure Access auth cookie from the process memory

codecepticon

coercer

A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 9 methods.

conti_locker

Conti Locker source code

cordyceps

C++ self-Injecting dropper based on various EDR evasion techniques.

cpppractice

C/C++练手

csharp-inline-assembly

Inline Assembly Demonstration in C# using Fasm.NET and Process.NET

ekko_cfg_bypass

A PoC for adding NtContinue to CFG allowed list in order to make Ekko work in a CFG protected process

enclave_lab

Messing around with Secure Enclaves

evilsln

A New Exploitation Technique for Visual Studio Projects

fortress

FUD MAC Loader , with Indirect syscall dynamic syscall , get function address from the peb , function hash comparaison . Tested on Sentinel1 & Crowdstrike , no prevention/detection

freshycalls

FreshyCalls tries to make the use of syscalls comfortable and simple, without generating too much boilerplate and in modern C++17!

freshycalls_poc

A simple dumper as FreshyCalls' PoC. That's what's trendy, isn't it? ¯\_(ツ)_/¯

g0t-b0r3d

A bunch of code and scripts I wrote because I was bored.

github-firehose

#OSINT tool for finding Github repositories by extracting commit logs in real time from the Github event API

gogetcrawl

Extract web archive data using Wayback Machine and Common Crawl

h4cks

Combination of all my Resources, Links & Scripts

havoc

The Havoc Framework

hiding-your-syscalls

Some source code to demonstrate avoiding certain direct syscall detections by locating and JMPing to a legitimate syscall instruction within NTDLL.

hunt-sleeping-beacons

Aims to identify sleeping beacons

hunt-weird-syscalls

ETW based POC to identify direct and indirect syscalls

iat-hooking-revisited

Import address table (IAT) hooking is a well documented technique for intercepting calls to imported functions.