Complete Arsenal of Memory injection and other techniques for red-teaming in WindowsWhat does Injector do? Process injection support for shellcode located at remote server as well as local storage. Just specify the shellcode file and it will do th...
SharpHook is inspired by the SharpRDPThief project, It uses various API hooks in order to give us the desired credentials. In the background it uses the EasyHook project, Once the desired process is up and running SharpHook will automatically inject...
Gundog provides you with guided hunting in Microsoft 365 Defender. Especially (if not only) for Email and Endpoint Alerts at the moment.Functionality You provide an AlertID (you might received via Email notification) and gundog will then hunt for a...
New technique I have discovered recently and give it a nickname (Chop chop) to perform lateral movement using windows services display name and WMI by smuggling the malicious binary as base64 chunks and automate the process using the TChopper tool.Ho...
Project Description The redpill project aims to assist reverse tcp shells in post-exploration tasks. Often in redteam engagements we need to use unconventional ways to access target system, such as reverse tcp shells (not metasploit) in order to byp...
This repository has been made basing onto the already existing MiscTool, so big shout-out to rasta-mouse for releasing them and for giving me the right motivation to work on them.CheeseExec Command Exec / Lateral movement via PsExec-like functionali...
Multi-platform toolkit for an interactive C2C DNS shell, by using DNS-Black-Cat, you will be able to execute system commands in shell mode over a fully encrypted covert channel.Server ported as a python script, which acts as DNS server with required...
Hunting for Malicious Strings Usage: AMSI calls (xmas tree mode) -d, --debug Show Debug Info -m, --maxsiglength=VALUE Maximum signature Length to cater for, ...
PowerShell module for Office 365 and Azure AD log collectionModule description The DFIR-O365RC PowerShell module is a set of functions that allow the DFIR analyst to collect logs relevant for Office 365 Business Email Compromise investigations. The...
C# port of WMImplant which uses either CIM or WMI to query remote systems. It can use provided credentials or the current user's session. Note: Some commands will use PowerShell in combination with WMI, denoted with ** in the --show-commands command...
Platinum Membership
€200.00
Silver Membership
€100.00
Gold Membership
€150.00
©2021 By Cyber Sec Labs