ferretking Goto Github PK

aggressorassessor

Aggressor scripts for phases of a pen test or red team assessment

amsi-etw-patch

Patch AMSI and ETW

amsi_ordinal_bypass

Bypass AMSI and Defender using Ordinal Values

amsitrigger

The Hunt for Malicious Strings

awesome-malware-analysis

A curated list of awesome malware analysis tools and resources.

awesome-windows-security

List of Awesome Windows Security Resources

blackhat-arsenal-tools

Official Black Hat Arsenal Security Tools Repository

building-c2-implants-in-cpp

The source code files that accompany the short book "Building C2 Implants in C++: A Primer" by Steven Patterson (@shogunlab).

can-i-take-over-xyz

"Can I take over XYZ?" — a list of services and how to claim (sub)domains with dangling DNS records.

chimera_pe

ChimeraPE (a PE injector type - alternative to: RunPE, ReflectiveLoader, etc) - a template for manual loading of EXE, loading imports payload-side

cloudflare-origin-ip

Try to find the origin IP of a webapp protected by Cloudflare.

cloudpentestcheatsheets

This repository contains a collection of cheatsheets I have put together for tools related to pentesting organizations that leverage cloud providers.

cmd.jsp

A super small jsp webshell with file upload capabilities.

cobalt_strike_extension_kit

Attempting to be an all in one repo for others' userful aggressor scripts as well as things we've found useful during Red Team Operations.

cobaltstrike-toolkit

Some useful scripts for CobaltStrike

covenant

Covenant is a collaborative .NET C2 framework for red teamers.

covid19-payloads

Phishing payloads for simulating itw COVID-19 related attacks and CTI export for tracking with VECTR

cthreadhijack

Beacon Object File (BOF) for remote process injection via thread hijacking

cve-2021-1675

C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527

dataextractor

A Burp Suite extension to extract datas from source code while browsing.

defendercheck

Identifies the bytes that Microsoft Defender flags on.

directinjectorpoc

Small POC written in C# that performs shellcode injection on x64 processes using direct syscalls as a way to bypass user-land EDR hooks.

dkmc

DKMC - Dont kill my cat - Malicious payload evasion tool

donut

Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters

edrs

excelntdonut

Excel 4.0 (XLM) Macro Generator for injecting DLLs and EXEs into memory.

eyewitness

EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.

file-archiver-in-the-browser

gadgettojscript

A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA based scripts.

ghostloader

GhostLoader - AppDomainManager - Injection - 攻壳机动队