mukarramkhalid Goto Github PK

active-directory-

adexplorersnapshot.py

ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound, and also supports full-object dumping to NDJSON.

admodule

Microsoft signed ActiveDirectory PowerShell module

adpt

DLL proxying for lazy people

amsi-bypass-powershell

This repo contains some Amsi Bypass methods i found on different Blog Posts.

amsi_veh

A Powershell AMSI Bypass technique via Vectored Exception Handler (VEH). This technique does not perform assembly instruction patching, function hooking or Import Address Table (IAT) modification.

androidfridabeginnersbook

《安卓Frida逆向与抓包实战》随书附件

antifrida_bypass

Generic Script To Bypass Some AntiFrida Checks

beacon_source

not a reverse-engineered version of the Cobalt Strike Beacon

business-ctf-2024

Official writeups for Business CTF 2024: The Vault Of Hope

c2_infra_workshop_defcon32_red_team_village

C2 Infrastructure Automation

clroxide

A rust library that allows you to host the CLR and execute dotnet binaries.

cnext-exploits

Exploits for CNEXT (CVE-2024-2961), a buffer overflow in the glibc's iconv()

conscrypttrustusercerts

crtp-notes

My notes containing the Certified Red Team Professional Course

cswhispers

Source generator to add D/Invoke and indirect syscall methods to a C# project.

cyber-apocalypse-2024

Official writeups for Cyber Apocalypse CTF 2024: Hacker Royale

darkwidow

Indirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird + Spawns a sacrificial Process as target process + (ACG+BlockDll) mitigation policy on spawned process + PPID spoofing + Api resolving from TIB + API hashing

deadpotato

DeadPotato is a windows privilege escalation utility from the Potato family of exploits, leveraging the SeImpersonate right to obtain SYSTEM privileges. This script has been customized from the original GodPotato source code by BeichenDream.

defendercheck

Identifies the bytes that Microsoft Defender flags on.

dirtycow

disable-flutter-tls-verification

A Frida script that disables Flutter's TLS verification

dojoloader

Generic PE loader for fast prototyping evasion techniques

edr-preloader

An EDR bypass that prevents EDRs from hooking or loading DLLs into our process by hijacking the AppVerifier layer

evil-jsdelivr

exploitation-course

Offensive Software Exploitation Course

file-tunnel

Tunnel TCP connections through a file

freeze.rs

Freeze.rs is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls written in RUST

frida-android-unpinning

A Frida script to disable SSL certificate pinning in a target application

frida-labs

The repo contains a series of challenges for learning Frida for Android Exploitation.