Collection of BOFs created for red team/adversary engagements. Created to be small and interchangeable, for quick recon or eventing.

Mattermost is an open source platform for secure collaboration across the entire software development lifecycle..

VulnWatchdog 是一个自动化的漏洞监控和分析工具。它可以监控 GitHub 上的 CVE 相关仓库,获取漏洞信息和 POC 代码,并使用 GPT 进行智能分析,生成详细的分析报告。

A secure sandbox environment for malware developers and red teamers to test payloads against detection mechanisms before deployment. Integrates with LLM agents via MCP for enhanced analysis capabil…

Raw data from Threat Intelligence Reports with automatic reports collection and keyword search across thousands of reports

🔥 The Web Data API for AI - Turn entire websites into LLM-ready markdown or structured data

An incredibly fast proxy checker & IP rotator with ease.

CodiMD - Realtime collaborative markdown notes on all platforms.

EDR-Freeze is a tool that puts a process of EDR, AntiMalware into a coma state.

Fully decrypt App-Bound Encrypted (ABE) cookies, passwords & payment methods from Chromium-based browsers (Chrome, Brave, Edge) - all in user mode, no admin rights required.

Two tools written in C that block network traffic for blacklisted EDR processes, using either Windows Defender Firewall (WDF) or Windows Filtering Platform (WFP).

Matkap - hunt down malicious Telegram bots

Find, verify, and analyze leaked credentials

Browser Voyage

Pentester's Promiscuous Notebook

A curated list of wordlists for bruteforcing and fuzzing

"rsync for cloud storage" - Google Drive, S3, Dropbox, Backblaze B2, One Drive, Swift, Hubic, Wasabi, Google Cloud Storage, Azure Blob, Azure Files, Yandex Files

SharpSilentChrome is a C# project that "silently" installs browser extensions on Google Chrome or MS Edge by updating the browsers' Preferences and Secure Preferences files. Currently, it only supp…

🧙‍♂️ Node.js Command & Control for Script-Jacking Vulnerable Electron Applications

Automated Hosting Information Hunting Tool - Windows 主机信息自动化狩猎工具

Multilayered AV/EDR Evasion Framework

BOF to steal browser cookies & credentials

An ICMP channel for Beacons, implemented using Cobalt Strike’s External C2 framework.

Toolkit to turn Chromium vulnerabilities into full-chain exploits

Beacon Object File (BOF) to obtain Entra tokens via authcode flow.

Linux kernel rootkit

LKM rootkit for modern kernels, with DNS C2 and a simple web interface

A delicious, but malicious SSL-VPN server 🌮

C2 infrastructure that allows Red Teamers to execute system commands on compromised hosts through Microsoft Teams.