toxicnade,Real,github

recycledgate

Hellsgate + Halosgate/Tartarosgate. Ensures that all systemcalls go through ntdll.dll

RefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc. In order to bypass the user-mode hooks, it first collects the syscall numbers of the NtOpenFile, NtCreateSection, NtOpenSection and NtMapViewOfSection found in the LdrpThunkSignature array.

rippl

RIPPL is a tool that abuses a usermode only exploit to manipulate PPL processes on Windows

rogue

A barebones template of 'rogue' aka a simple recon and agent deployment I built to communicate over ICMP. Well, without the ICMP code.

rpc-backdoor

A basic emulation of an "RPC Backdoor"

saas-attacks

Offensive security drives defensive security. We're sharing a collection of SaaS attack techniques to help defenders understand the threats they face. #nolockdown

seccomp-bypass

Collection of shellcodes that use a variety of syscalls in order to bypass some seccomp configurations

selinux-kernel-module-bypass

Tools for bypassing SELinux via init_module

sharpmapmodules

C# recon modules

shellcodefluctuation

An advanced in-memory evasion technique fluctuating shellcode's memory protection between RW/NoAccess & RX and then encrypting/decrypting its contents

shellcodestdio

An extensible framework for easily writing compiler optimized position independent x86 / x64 shellcode for windows platforms.

sideloadingdll

sigflip

SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature.

ssl_logger

Decrypts and logs a process's SSL traffic.

stratus-red-team

:cloud: :zap: Granular, Actionable Adversary Emulation for the Cloud

threadstackspoofer

Thread Stack Spoofing - PoC for an advanced In-Memory evasion technique allowing to better hide injected shellcode's memory allocation from scanners and analysts.

tierzerotable

Table of AD and Azure assets and whether they belong to Tier Zero

ulexecve

ulexecve is a userland execve() implementation which helps you execute arbitrary ELF binaries on Linux from userland without the binaries ever having to touch storage. This is useful for red-teaming and anti-forensics purposes.