Urraca monitors and analyzes in real-time packages from multiple repositories (PyPI, NPM, NuGet, Packagist and RubyGems) looking for secrets forgotten by developers.

Evasion for Cobalt Strike

Crystal Palace library for proxying Nt API calls via the Threadpool

The dragon in the dark. A red team post exploitation framework for testing security controls during red team assessments.

Things i do because i saw it on twitter on a weekend

Tuoni

Find jmp gadgets for call stack spoofing.

This code silently installs Chrome extensions on Mac, Windows, and Linux

Windows protocol library, including SMB and RPC implementations, among others.

An experimental webkit-based kernel exploit (Arb. R/W) for the PS5 on <= 4.51FW

This is the tool to dump the LSASS process on modern Windows 11

Implementing an early exception handler for hooking and threadless process injection without relying on VEH or SEH

BOF to steal browser cookies & credentials

COM-based DLL Surrogate Injection

Reports in .MD format

A Mythic agent for Windows written in C

Metamorphic cross-compilation of C++ & C-code to PIC, BOF & EXE.

Optimized zlib inflate (+gzip) library for embedded

Comprehensive Windows Syscall Extraction & Analysis Framework

process hollowing variant using NtCreateSection + NtMapViewOfSection + ResumeThread

Bypass user-land hooks by syscall tampering via the Trap Flag

Experimental Windows x64 Kernel Rootkit with anti-rootkit evasion features.

Proof of Concepts code for Bring Your Own Vulnerable Driver techniques

A PoC for adding NtContinue to CFG allowed list in order to make Ekko work in a CFG protected process

A tool to transform Chromium browsers into a C2 Implant

An offensive data enrichment pipeline