Adversary tradecraft detection, protection, and hunting

A collection of intel and usernames scraped from various cybercrime sources & forums. DarkForums, HackForums, Patched, Cracked, BreachForums, LeakBase, & more

Browser extension for reverse image search, available for Chrome, Edge and Safari

Helping defenders learn and validate npm supply-chain detections with safe atomic tests.

Educational proof-of-concept demonstrating DEP/NX bypass using hardware breakpoints, vectored exception handling, and instruction emulation on Windows x64. For security research and learning purpos…

Evasion kit for Cobalt Strike

Advanced Active Directory network topology analyzer with SMB validation, multiple authentication methods (password/NTLM/Kerberos), and comprehensive network discovery. Export results as BloodHound‑…

Purpleteam scripts simulation & Detection - trigger events for SOC detections

GTRS - Google Translator Reverse Shell

Telegram Bot Exec Terminal Command

Initial Access and Post-Exploitation Tool for AAD and O365 with a browser-based GUI

A POC Windows crypto-ransomware (Academic). Now Ransom:Win32/MauriCrypt.MK!MTB

The Art of Mac Malware

Program for determining types of files for Windows, Linux and MacOS.

A library for creating, reading and editing PE files and .NET modules.

Easy XOR string encryption for NET based binaries

Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls.

Collection of powershell scripts I used to complete my CARTP and CARTE courses.

Fully decrypt App-Bound Encrypted (ABE) cookies, passwords & payment methods from Chromium-based browsers (Chrome, Brave, Edge) - all in user mode, no admin rights required.

A user-mode code and its rootkit that will Kill EDR Processes permanently by leveraging the power of Process Creation Blocking Kernel Callback Routine registering and ZwTerminateProcess.

A list of methods to coerce a windows machine to authenticate to an attacker-controlled machine through a Remote Procedure Call (RPC) with various protocols.

MeshAgent used along with MeshCentral to remotely manage computers. Many variations of the background management agent are included as binaries in the MeshCentral project.

gather gather gather

Local Service to SYSTEM privilege escalation from Windows 7 to Windows 10 / Server 2019

Payload Development Kit

Polymorphic Command & Control

BloodyAD is an Active Directory Privilege Escalation Framework

Simple and fast anti-censorship tool written in Go