apkc Goto Github PK

dinvoke_rs

Dynamically invoke arbitrary unmanaged code.

direct-syscalls-a-journey-from-high-to-low

Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low level).

dirty-vanity

A POC for the new injection technique, abusing windows fork API to evade EDRs.

dirtyclr

An App Domain Manager Injection DLL PoC on steroids

disable-windows-defender

Changing values to bypass windows defender C#

dll-exports-extraction-bof

DLL Exports Extraction BOF with optional NTFS transactions.

dll-hijack-by-proxying

Exploiting DLL Hijacking by DLL Proxying Super Easily

dll-hijack-search-order-bof

DLL Hijack Search Order Enumeration BOF

dll_imports_bof

A BOF to parse the imports of a provided PE-file, optionally extracting symbols on a per-dll basis.

dll_version_enumeration_bof

A BOF for enumerating version information for DLLs associated for a Beacon process.

dllhijacktest

DLL and PowerShell script to assist with finding DLL hijacks

dllsforhackers

Dll that can be used for side loading and other attack vector.

docker-cobaltstrike

Docker container for running CobaltStrike 4.7 and above

docker-mailserver

Production-ready fullstack but simple mail server (SMTP, IMAP, LDAP, Antispam, Antivirus, etc.) running inside a container.

docker-openvpn

🔒 OpenVPN server in a Docker container complete with an EasyRSA PKI CA

docker-osx

Run macOS VM in a Docker! Run near native OSX-KVM in Docker! X11 Forwarding! CI/CD for OS X Security Research! Docker mac Containers.

domaintrail

DomainTrail is a fast subdomain enumeration tool that uses effective passive and active techniques.

donut

Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters

dotnet_xorcryptor

A new simple and powerfull packer for malware

dprotect

:electron: dProtect is a Proguard-based obfuscator for Java and Kotlin

drivers-binaries

Exploitable drivers, you know what I mean

dropbear

Dropbear SSH

dropspawn_bof

CobaltStrike BOF to spawn Beacons using DLL Application Directory Hijacking

dsc_svc_remote

This code example allows you to create a malware.exe sample that can be run in the context of a system service, and could be used for local privilege escalation in the context of an unquoted service path, etc. The payload itself can be remotely hosted, downloaded via the wininet library and then executed via direct system calls.

dsinternals

Directory Services Internals (DSInternals) PowerShell Module and Framework

dufs

A file server that supports static serving, uploading, searching, accessing control, webdav...

dumpert

LSASS memory dumper using direct system calls and API unhooking.

dynamictabrename

CNA that interacts with a JAR file to dynamically rename GUI tabs within Cobalt Strike from a JSON file.

edr-test

Automating EDR Testing with reference to MITRE ATTACK via Cobalt Strike [Purple Team].

edrs