An open-source, free protector for .NET applications

.NET IPv4/IPv6 machine-in-the-middle tool for penetration testers

Identifies the bytes that Microsoft Defender flags on.

Local Service to SYSTEM privilege escalation from Windows 7 to Windows 10 / Server 2019

Active Directory certificate abuse.

CVE-2021-42287/CVE-2021-42278 Scanner & Exploiter.

SafetyKatz is a combination of slightly modified version of @gentilkiwi's Mimikatz project and @subtee's .NET PE Loader

Identifies the bytes that Microsoft Defender / AMSI Consumer flags on.

Framework for Kerberos relaying

Whisker is a C# tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively adding "Shadow Credentials" to the target account.

A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service.

Exploit for EfsPotato(MS-EFSR EfsRpcOpenFileRaw with SeImpersonatePrivilege local privalege escalation vulnerability).

Threadless Process Injection using remote function hooking.

SOAPHound is a custom-developed .NET data collector tool which can be used to enumerate Active Directory environments via the Active Directory Web Services (ADWS) protocol.

C# tool for UAC bypasses

C# Lsass parser

StandIn is a small .NET35/45 AD post-exploitation toolkit

Proof-of-Concept for CVE-2023-38146 ("ThemeBleed")