n4n4r3 Goto Github PK

1earn

ffffffff0x 团队维护的安全知识框架,内容包括不仅限于 web安全、工控安全、取证、应急、蓝队设施部署、后渗透、Linux安全、各类靶机writup

amd-ryzen-master-driver-v17-exploit

Cobalt Strike (CS) Beacon Object File (BOF) for kernel exploitation using AMD's Ryzen Master Driver (version 17).

awesome-cybersecurity-blueteam

:computer:🛡️ A curated collection of awesome resources, tools, and other shiny things for cybersecurity blue teams.

awesome-incident-response

A curated list of tools for incident response

awesome-threat-detection

✨ A curated list of awesome threat detection and hunting resources 🕵️‍♂️

cobaltstrikesource

Cobaltstrike4.1 Source

defcon-31-syscalls-workshop

Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".

edr-preloader

An EDR bypass that prevents EDRs from hooking or loading DLLs into our process by hijacking the AppVerifier layer

edrception

A proof of concept for abusing exception handlers to hook and bypass user mode EDR hooks.

fos-license-gen

fullbypass

A tool which bypasses AMSI (AntiMalware Scan Interface) and PowerShell CLM (Constrained Language Mode) and gives you a FullLanguage PowerShell reverse shell. Feel free to modiy and DM if you find some bugs :)

ghidra

Ghidra is a software reverse engineering (SRE) framework

grab_beacon_config

gurs

python模拟鼠标滑动轨迹

hikari

LLVM Obfuscator

hikari-llvm15

A fork of Hikari Obfuscator [WIP]

hikari-llvm15-core

instruction2vec

Efficient Preprocessor of Assembly Code to Detect Software Weakness with CNN

iocextract

Defanged Indicator of Compromise (IOC) Extractor.

llvm-pass-tutorial

A step-by-step tutorial for building an LLVM sample pass

loldrivers

Living Off The Land Drivers

lpadesktop

LPA Simulator

nanodet-plus-opencv

分别使用OpenCV、ONNXRuntime部署NanoDet-Plus，包含C++和Python两个版本的程序

pjstealth

rekall

Rekall Memory Forensic Framework

shellghost

A memory-based evasion technique which makes shellcode invisible from process start to end.

veh-poc

vmlinux-to-elf

A tool to recover a fully analyzable .ELF from a raw kernel, through extracting the kernel symbol table (kallsyms)

volatility3

Volatility 3.0 development

win-api-tracer-frida

win32 api tracer use frida