Adversary Emulation Framework

Indirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird + Spawns a sacrificial Process as target process + (ACG+Bloc…

Multiplayer pivoting solution

"Bob the Smuggler": A tool that leverages HTML Smuggling Attack and allows you to create HTML files with embedded 7z/zip archives. The tool would compress your binary (EXE/DLL) into 7z/zip file for…

This repository has workflows created for https://github.com/RikunjSindhwad/Task-Ninja

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

Automatic privilege escalation for misconfigured capabilities, sudo and suid binaries using GTFOBins.

Evasive loader to bypass static detection

Patching "signtool.exe" to accept expired certificates for code-signing.

A proof of concept for abusing exception handlers to hook and bypass user mode EDR hooks.

C++ self-Injecting dropper based on various EDR evasion techniques.

Reflective x64 PE/DLL Loader implemented using Dynamic Indirect Syscalls

A variation of ProcessOverwriting to execute shellcode on an executable's section

Uses rpcdump to locate the ADCS server, and identify if ESC8 is vulnerable from unauthenticated perspective.

A set of fully-undetectable process injection techniques abusing Windows Thread Pools

My Notes about Penetration Testing

Reflective DLL to privesc from NT Service to SYSTEM using SeImpersonateToken privilege

C# AV/EDR Killer using less-known driver (BYOVD)

Shellcode Loader with memory evasion

Collection of C# projects. Useful for pentesting and redteaming.

BadZure orchestrates the setup of Azure Active Directory tenants, populating them with diverse entities while also introducing common security misconfigurations to create vulnerable tenants with mu…

Automate Active Directory Enumeration using PowerView

Automated DLL Sideloading Tool With EDR Evasion Capabilities

Red Team Toolkit is an Open-Source Django Offensive Web-App which is keeping the useful offensive tools used in the red-teaming together.

linWinPwn is a bash script that automates a number of Active Directory Enumeration and Vulnerability checks

Useful Cobalt Strike techniques learned from engagements

Windows x64 kernel mode rootkit process hollowing POC.