Skip to content

Latest commit

 

History

History
2999 lines (1803 loc) · 227 KB

Readme_en.md

File metadata and controls

2999 lines (1803 loc) · 227 KB
Raw

All Resource Collection Projects

Windows

  • Windows Security Resource Collection. 1100+ open source tools, 3300+ blog posts.
  • This page only contains limited tools and posts. Read Full Version

Directory

PowerShell

PowerSploit

Tools

Post

PSAttack

Tools

Post

Other

Tools

  • [216Star][23d] [PS] mkellerman/invoke-commandas Invoke Command As System/Interactive/GMSA/User on Local/Remote machine & returns PSObjects.

Post

DLL

Recent Add

Tools

  • [2064Star][10d] [C#] lucasg/dependencies A rewrite of the old legacy software "depends.exe" in C# for Windows devs to troubleshoot dll load dependencies issues.
  • [1393Star][12m] [C] fancycode/memorymodule Library to load a DLL from memory.
  • [1232Star][10d] [C#] perfare/il2cppdumper Restore dll from Unity il2cpp binary file (except code)
  • [810Star][10d] [C#] terminals-origin/terminals Terminals is a secure, multi tab terminal services/remote desktop client. It uses Terminal Services ActiveX Client (mstscax.dll). The project started from the need of controlling multiple connections simultaneously. It is a complete replacement for the mstsc.exe (Terminal Services) client. This is official source moved from Codeplex.
  • [396Star][8m] [C++] hasherezade/dll_to_exe Converts a DLL into EXE
  • [385Star][19d] [C#] 3f/dllexport .NET DllExport
  • [371Star][12d] [PS] netspi/pesecurity PowerShell module to check if a Windows binary (EXE/DLL) has been compiled with ASLR, DEP, SafeSEH, StrongNaming, and Authenticode.
  • [255Star][16d] [C++] wbenny/detoursnt Detours with just single dependency - NTDLL
  • [236Star][21d] [C#] erfg12/memory.dll C# Hacking library for making PC game trainers.
  • [234Star][1y] [C#] misaka-mikoto-tech/monohook hook C# method at runtime without modify dll file (such as UnityEditor.dll)
  • [220Star][2m] [C++] chuyu-team/mint Contains the definitions for the Windows Internal UserMode API from ntdll.dll, samlib.dll and winsta.dll.
  • [203Star][10d] [C++] s1lentq/regamedll_cs a result of reverse engineering of original library mod HLDS (build 6153beta) using DWARF debug info embedded into linux version of HLDS, cs.so

Post

DLL Injection

Tools

  • [994Star][1m] [C] fdiskyou/injectallthethings Seven different DLL injection techniques in one single project.
  • [747Star][7m] [C++] darthton/xenos Windows dll injector
  • [635Star][3m] [PS] monoxgas/srdi Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode

Post

DLL Hijack

Tools

  • [441Star][9m] [Pascal] mojtabatajik/robber Robber is open source tool for finding executables prone to DLL hijacking
  • [327Star][1y] [C++] anhkgg/superdllhijack A general DLL hijack technology, don't need to manually export the same function interface of the DLL, so easy!

Post

DLL旁加载

Post

PE

PE解析

Tools

  • [904Star][12d] [Py] erocarrera/pefile pefile is a Python module to read and work with PE (Portable Executable) files

    View Details

      ## 特性
  - Inspecting headers
  - Analysis of sections' data
  - Retrieving embedded data
  - Reading strings from the resources
  - Warnings for suspicious and malformed values
  - Support to write to some of the fields and to other parts of the PE, so it's possible to do some basic butchering of PEs
  - Packer detection with PEiD’s signatures
  - PEiD signature generation
  </details>

Post

Tools

Tools

  • [693Star][15d] [C] thewover/donut Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters
  • [407Star][2m] [Assembly] hasherezade/pe_to_shellcode Converts PE into a shellcode
  • [399Star][5m] [Jupyter Notebook] endgameinc/ember a collection of features from PE files that serve as a benchmark dataset for researchers.
  • [372Star][1y] [Assembly] egebalci/amber a reflective PE packer for bypassing security products and mitigations
  • [342Star][7m] [C] merces/pev The PE file analysis toolkit
  • [328Star][2m] [VBA] itm4n/vba-runpe A VBA implementation of the RunPE technique or how to bypass application whitelisting.
  • [327Star][1m] [C++] trailofbits/pe-parse Principled, lightweight C/C++ PE parser
  • [318Star][20d] [C++] hasherezade/libpeconv A library to load, manipulate, dump PE files. See also:
  • [288Star][9m] [Java] katjahahn/portex Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness

Post

Post

.NET

Tools

Recent Add

  • [9528Star][19d] [C#] icsharpcode/ilspy .NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!
  • [3824Star][2m] [C#] 0xd4d/de4dot .NET deobfuscator and unpacker.
  • [3278Star][9m] [JS] sindresorhus/speed-test Test your internet connection speed and ping using speedtest.net from the CLI
  • [2526Star][1y] [C#] yck1509/confuserex An open-source, free protector for .NET applications
  • [1811Star][1m] [C#] sshnet/ssh.net SSH.NET is a Secure Shell (SSH) library for .NET, optimized for parallelism.
  • [1696Star][19d] [C#] jbevain/cecil Cecil is a library to inspect, modify and create .NET programs and libraries.
  • [1535Star][12d] [C#] steamre/steamkit SteamKit2 is a .NET library designed to interoperate with Valve's Steam network. It aims to provide a simple, yet extensible, interface to perform various actions on the network.
  • [1415Star][1y] [C++] dotnet/llilc This repo contains LLILC, an LLVM based compiler for .NET Core. It includes a set of cross-platform .NET code generation tools that enables compilation of MSIL byte code to LLVM supported platforms.
  • [1147Star][9d] [C#] cobbr/covenant Covenant is a collaborative .NET C2 framework for red teamers.
  • [1135Star][15d] [Boo] byt3bl33d3r/silenttrinity An asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR
  • [923Star][12d] [C#] pwntester/ysoserial.net Deserialization payload generator for a variety of .NET formatters
  • [818Star][12d] [C#] proxykit/proxykit A toolkit to create code-first HTTP reverse proxies on ASP.NET Core
  • [788Star][2m] [C#] cobbr/sharpsploit SharpSploit is a .NET post-exploitation library written in C#
  • [728Star][3m] [C#] obfuscar/obfuscar Open source obfuscation tool for .NET assemblies
  • [693Star][15d] [C] thewover/donut Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters
  • [634Star][12d] [HTML] foxzilla/pxer A tool for pixiv.net
  • [577Star][10d] [C#] dabutvin/imgbot An Azure Function solution to crawl through all of your image files in GitHub and losslessly compress them. This will make the file size go down, but leave the dimensions and quality untouched. Once it's done, ImgBot will open a pull request for you to review and merge. [email protected]
  • [546Star][24d] [C#] crosire/scripthookvdotnet An ASI plugin for Grand Theft Auto V, which allows running scripts written in any .NET language in-game.
  • [536Star][11d] [Go] timothyye/godns A dynamic DNS client tool, supports AliDNS, Cloudflare, Google Domains, DNSPod, HE.net & DuckDNS, written in Go.
  • [494Star][28d] [C#] paulbartrum/jurassic A .NET library to parse and execute JavaScript code.
  • [493Star][1m] [C#] chmorgan/sharppcap Fully managed, cross platform (Windows, Mac, Linux) .NET library for capturing packets
  • [486Star][28d] [C#] tyranid/oleviewdotnet A .net OLE/COM viewer and inspector to merge functionality of OleView and Test Container
  • [424Star][7m] [Java] nccgroup/freddy Automatically identify deserialisation issues in Java and .NET applications by using active and passive scans
  • [386Star][14d] [C#] addictedcs/soundfingerprinting audio fingerprinting in .NET. An efficient algorithm for acoustic fingerprinting written purely in C#.
  • [385Star][19d] [C#] 3f/dllexport .NET DllExport
  • [383Star][2m] [C#] security-code-scan/security-code-scan Vulnerability Patterns Detector for C# and VB.NET
  • [373Star][9d] [C#] sonarsource/sonar-dotnet static code analyser for C# and VB.​NET languages used as an extension for the SonarQube and SonarCloud platforms.
  • [366Star][10m] [JS] nikolayit/openjudgesystem An open source system for online algorithm competitions for Windows, written in ASP.NET MVC
  • [357Star][10d] [C#] tmoonlight/nsmartproxy reverse proxy tool that creates a secure tunnel from a public endpoint to a locally service
  • [334Star][10d] [Java] wiglenet/wigle-wifi-wardriving Nethugging client for Android, from wigle.net
  • [320Star][1m] [C#] azuread/azure-activedirectory-library-for-dotnet ADAL authentication libraries for .net
  • [316Star][10d] [C#] dahall/vanara A set of .NET libraries for Windows implementing PInvoke calls to many native Windows APIs with supporting wrappers.

dnspy

  • [13163Star][24d] [C#] 0xd4d/dnspy .NET debugger and assembly editor

Post

Login & Credential

Mimikatz

Tools

Post

NTLM

Tools

  • [3097Star][5m] [Py] spiderlabs/responder a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.
  • [1887Star][1m] [Py] lgandx/responder a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.
  • [781Star][1m] [Py] lgandx/pcredz This tool extracts Credit card numbers, NTLM(DCE-RPC, HTTP, SQL, LDAP, etc), Kerberos (AS-REQ Pre-Auth etype 23), HTTP Basic, SNMP, POP, SMTP, FTP, IMAP, etc from a pcap file or from a live interface.
  • [744Star][1y] [C#] eladshamir/internal-monologue Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS
  • [676Star][1y] [Py] deepzec/bad-pdf create malicious PDF file to steal NTLM(NTLMv1/NTLMv2) Hashes from windows machines
  • [256Star][2m] [Py] evilmog/ntlmv1-multi NTLMv1 Multitool
  • [252Star][14d] [PS] notmedic/netntlmtosilverticket SpoolSample -> Responder w/NetNTLM Downgrade -> NetNTLMv1 -> NTLM -> Kerberos Silver Ticket
  • [250Star][11d] [Ruby] urbanesec/zackattack Unveiled at DEF CON 20, NTLM Relaying to ALL THE THINGS!

Post

Kerberos

Tools

  • [728Star][19d] [C#] ghostpack/rubeus a C# toolset for raw Kerberos interaction and abuses.
  • [617Star][3m] [C] gentilkiwi/kekeo A little toolbox to play with Microsoft Kerberos in C
  • [593Star][7m] [Py] nidem/kerberoast a series of tools for attacking MS Kerberos implementations
  • [376Star][12d] [Go] jcmturner/gokrb5 Pure Go Kerberos library for clients and services
  • [354Star][2m] [Go] ropnop/kerbrute A tool to perform Kerberos pre-auth bruteforcing
  • [236Star][27d] [Py] dirkjanm/krbrelayx Kerberos unconstrained delegation abuse toolkit

Post

PassTheHash

Tools

Post

Pass-The-Ticket

Post

winglogon.exe

Tools

Post

LLMNR

Tools

Post

NetBIOS

Tools

Post

Other

Tools

Windows Protections

UAC

Tools

  • [2500Star][2m] [C] hfiref0x/uacme Defeating Windows User Account Control
  • [2458Star][9d] [PS] k8gege/k8tools K8工具合集(内网渗透/提权工具/远程溢出/漏洞利用/扫描工具/密码破解/免杀工具/Exploit/APT/0day/Shellcode/Payload/priviledge/BypassUAC/OverFlow/WebShell/PenTest) Web GetShell Exploit(Struts2/Zimbra/Weblogic/Tomcat/Apache/Jboss/DotNetNuke/zabbix)
  • [1859Star][17d] [JS] coreybutler/node-windows Windows support for Node.JS scripts (daemons, eventlog, UAC, etc).
  • [1742Star][1m] [Py] rootm0s/winpwnage UAC bypass, Elevate, Persistence and Execution methods

Post

AppLocker

Tools

Post

DEP

Tools

Post

PG

Tools

  • [551Star][11m] [C] hfiref0x/upgdsed Universal PatchGuard and Driver Signature Enforcement Disable

Post

DSE

Tools

  • [723Star][10m] [C] hfiref0x/tdl Driver loader for bypassing Windows x64 Driver Signature Enforcement
  • [369Star][11d] [C] mattiwatti/efiguard Disable PatchGuard and DSE at boot time
  • [322Star][5m] [C] 9176324/shark Turn off PatchGuard in real time for win7 (7600) ~ win10 (18950).
  • [274Star][9d] [C++] can1357/byepg Defeating Patchguard universally for Windows 8, Windows 8.1 and all versions of Windows 10 regardless of HVCI

Post

Defender

Tools

Post

AMSI

Tools

  • [322Star][9d] [C#] hackplayers/salsa-tools Salsa Tools - ShellReverse TCP/UDP/ICMP/DNS/SSL/BINDTCP/Shellcode/SILENTTRINITY and AV bypass, AMSI patched

Post

ASLR

Tools

  • [901Star][2m] [Roff] slimm609/checksec.sh a bash script to check the properties of executables (like PIE, RELRO, PaX, Canaries, ASLR, Fortify Source).
  • [371Star][12d] [PS] netspi/pesecurity PowerShell module to check if a Windows binary (EXE/DLL) has been compiled with ASLR, DEP, SafeSEH, StrongNaming, and Authenticode.

Post

Control Flow Guard

Tools

Control Integrity Guard

Other

MS1X

Tools

  • [345Star][4m] [Py] 3ndg4me/autoblue-ms17-010 This is just an semi-automated fully working, no-bs, non-metasploit version of the public exploit code for MS17-010
  • [254Star][17d] [Py] mez-0/ms17-010-python MS17-010: Python and Meterpreter

Post

System

RDP

Tools

  • [6407Star][1y] [Pascal] stascorp/rdpwrap RDP Wrapper Library
  • [3800Star][9d] [C] freerdp/freerdp FreeRDP is a free remote desktop protocol library and clients
  • [1655Star][21d] [C] neutrinolabs/xrdp xrdp: an open source RDP server
  • [1083Star][9d] [C] zerosum0x0/cve-2019-0708 Scanner PoC for CVE-2019-0708 RDP RCE vuln
  • [996Star][1m] [Py] syss-research/seth Perform a MitM attack and extract clear text credentials from RDP connections
  • [911Star][13d] [Py] jimmy201602/webterminal ssh rdp vnc telnet sftp bastion/jump web putty xshell terminal jumpserver audit realtime monitor rz/sz 堡垒机 云桌面 linux devops sftp websocket file management rz/sz otp 自动化运维 审计 录像 文件管理 sftp上传 实时监控 录像回放 网页版rz/sz上传下载/动态口令 django
  • [764Star][10d] [C] rdesktop/rdesktop rdesktop is an open source UNIX client for connecting to Windows Remote Desktop Services, capably of natively speaking Remote Desktop Protocol (RDP) in order to present the user's Windows desktop. rdesktop is known to work with Windows server version ranging from NT 4 terminal server to Windows 2012 R2.
  • [692Star][13d] [C] robertdavidgraham/rdpscan A quick scanner for the CVE-2019-0708 "BlueKeep" vulnerability.
  • [433Star][9d] [C++] 0x09al/rdpthief Extracting Clear Text Passwords from mstsc.exe using API Hooking.
  • [378Star][15d] [C#] beckzhu/simpleremote Remote Administration Tools
  • [376Star][13d] [Py] gosecure/pyrdp RDP man-in-the-middle (mitm) and library for Python 3 with the ability to watch connections live or after the fact
  • [339Star][21d] [PS] joelgmsec/autordpwn The Shadow Attack Framework
  • [296Star][9d] [Py] xfreed0m/rdpassspray Python3 tool to perform password spraying using RDP
  • [283Star][8m] [Py] k8gege/cve-2019-0708 3389远程桌面代码执行漏洞CVE-2019-0708批量检测工具(Rdpscan Bluekeep Check)

Post

文章_0

SMB

Tools

  • [1215Star][1m] [C#] k8gege/ladon 用于大型网络渗透的多线程插件化综合扫描神器
  • [820Star][1y] [PS] kevin-robertson/invoke-thehash PowerShell functions for performing pass the hash WMI and SMB tasks
  • [767Star][2m] [Py] shawndevans/smbmap SMBMap is a handy SMB enumeration tool
  • [388Star][12d] [C] zerosum0x0/smbdoor Windows kernel backdoor via registering a malicious SMB handler
  • [355Star][3m] [Py] m8r0wn/nullinux Internal penetration testing tool for Linux that can be used to enumerate OS information, domain information, shares, directories, and users through SMB.
  • [348Star][11m] [Py] skorov/ridrelay Enumerate usernames on a domain where you have no creds by using SMB Relay with low priv.
  • [322Star][8m] [C#] raikia/credninja A multithreaded tool designed to identify if credentials are valid, invalid, or local admin valid credentials within a network at-scale via SMB, plus now with a user hunter
  • [255Star][19d] [PS] p3nt4/invoke-piper Forward local or remote tcp ports through SMB pipes.
  • [225Star][3m] [Py] m4ll0k/smbrute SMB Protocol Bruteforce
  • [210Star][3m] [Py] miketeo/pysmb pysmb is an experimental SMB/CIFS library written in Python. It implements the client-side SMB/CIFS protocol (SMB1 and SMB2) which allows your Python application to access and transfer files to/from SMB/CIFS shared folders like your Windows file sharing and Samba folders.

Post

WMI

Tools

  • [708Star][12d] [Go] martinlindhe/wmi_exporter Prometheus exporter for Windows machines using WMI
  • [706Star][1y] [PS] arvanaghi/sessiongopher a PowerShell tool that uses WMI to extract saved session information for remote access tools such as WinSCP, PuTTY, SuperPuTTY, FileZilla, and Microsoft Remote Desktop. It can be run remotely or locally.
  • [610Star][1y] [PS] fortynorthsecurity/wmimplant This is a PowerShell based tool that is designed to act like a RAT. Its interface is that of a shell where any command that is supported is translated into a WMI-equivalent for use on a network/remote machine. WMImplant is WMI based.
  • [265Star][9d] [JS] pandorafms/pandorafms Pandora FMS is a flexible and highly scalable monitoring system ready for big environments. It uses agents (Linux, Windows, AIX, HP-UX, Solaris and BSD systems) and can do both local and remote network monitoring (SNMP v3, TCP checks, WMI, etc).
  • [259Star][1m] [Go] stackexchange/wmi WMI for Go
  • [251Star][1y] [C#] 0xbadjuju/wheresmyimplant A Bring Your Own Land Toolkit that Doubles as a WMI Provider

Post

ETW

Tools

  • [1303Star][12d] [JS] jpcertcc/logontracer Investigate malicious Windows logon by visualizing and analyzing Windows event log
  • [885Star][16d] [C++] google/uiforetw User interface for recording and managing ETW traces
  • [673Star][12m] [Roff] palantir/windows-event-forwarding A repository for using windows event forwarding for incident detection and response
  • [655Star][9d] [PS] sbousseaden/evtx-attack-samples windows events samples associated to specific attack and post-exploitation techniques
  • [566Star][30d] [PS] sans-blue-team/deepbluecli a PowerShell Module for Threat Hunting via Windows Event Logs
  • [505Star][11m] [C#] lowleveldesign/wtrace Command line tracing tool for Windows, based on ETW.
  • [466Star][15d] [PS] nsacyber/event-forwarding-guidance Configuration guidance for implementing collection of security relevant Windows Event Log events by using Windows Event Forwarding. #nsacyber
  • [401Star][12m] [Py] williballenthin/python-evtx Pure Python parser for recent Windows Event Log files (.evtx)
  • [318Star][3m] [C#] zodiacon/procmonx Extended Process Monitor-like tool based on Event Tracing for Windows
  • [295Star][11d] [C#] fireeye/silketw flexible C# wrappers for ETW
  • [290Star][12m] [C#] nsacyber/windows-event-log-messages Retrieves the definitions of Windows Event Log messages embedded in Windows binaries and provides them in discoverable formats. #nsacyber
  • [268Star][5m] [C++] gametechdev/presentmon Tool for collection and processing of ETW events related to DXGI presentation.
  • [261Star][10d] [C++] microsoft/krabsetw KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.

Post

Lsass

Tools

  • [489Star][20d] [Py] hackndo/lsassy Extract credentials from lsass remotely
  • [356Star][11d] [Py] aas-n/spraykatz Credentials gathering tool automating remote procdump and parse of lsass process.
  • [315Star][13d] [C] outflanknl/dumpert LSASS memory dumper using direct system calls and API unhooking.

Post

BitLocker

Tools

  • [772Star][3m] [C] aorimn/dislocker FUSE driver to read/write Windows' BitLocker-ed volumes under Linux / Mac OSX
  • [347Star][1y] [C] e-ago/bitcracker BitCracker is the first open source password cracking tool for memory units encrypted with BitLocker

Post

NTFS

Tools

  • [582Star][1y] mtivadar/windows10_ntfs_crash_dos PoC for a NTFS crash that I discovered, in various Windows versions
  • [270Star][17d] [Py] dkovar/analyzemft fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple format
  • [234Star][21d] [C] pbatard/uefi-ntfs UEFI:NTFS - Boot NTFS partitions from UEFI

Post

SSDT

Tools

Post

Windows Registry

Tools

Post

Component Object Model(COM)

Tools

Distributed Component Object Model(DCOM)

Tools

  • [225Star][10d] [PS] outflanknl/excel4-dcom PowerShell and Cobalt Strike scripts for lateral movement using Excel 4.0 / XLM macros via DCOM (direct shellcode injection in Excel.exe)
  • [207Star][1y] [PS] sud0woodo/dcomrade Powershell script for enumerating vulnerable DCOM Applications

Post

Dynamic Data Exchange(DDE)

Post

Compiled HTML Help(CHM)

Post

WinSxS

Tools

WoW64

Tools

Post

Background Intelligent Transfer Service(BITS)

Tools

Batch Script(.bat)

Tools

  • [268Star][9m] [Batchfile] diogo-fernan/ir-rescue A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
  • [216Star][9d] [PS] enjoiz/privesc Windows batch script that finds misconfiguration issues which can lead to privilege escalation.

Post

DACL

Tools

  • [333Star][11d] [PS] canix1/adaclscanner Repo for ADACLScan.ps1 - Your number one script for ACL's in Active Directory

Post

WebDAV

Tools

  • [465Star][23d] [C++] winscp/winscp WinSCP is a popular free SFTP and FTP client for Windows, a powerful file manager that will improve your productivity. It supports also Amazon S3, FTPS, SCP and WebDAV protocols. Power users can automate WinSCP using .NET assembly.
  • [373Star][2m] [Py] mar10/wsgidav A generic and extendable WebDAV server based on WSGI

Post

Group Policy Object(GPO)

Tools

  • [246Star][16d] [C#] fsecurelabs/sharpgpoabuse take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO.

Post

AppInit/AppCert

Post

InstallUtil

Post

Image File Execution Option(IFEO)

Post

Mshta

Post

Microsoft HTML Application(HTA)

Post

NetShell

Tools

Post

VBScript

Tools

  • [1615Star][12d] [Py] zerosum0x0/koadic Koadic C3 COM Command & Control - JScript RAT

Post

VBA

Tools

Post

Security Service Provider(SSP)

Post

Scheduled Task

Tools

  • [432Star][1m] [Py] sibson/redbeat RedBeat is a Celery Beat Scheduler that stores the scheduled tasks and runtime metadata in Redis.
  • [385Star][1m] [C#] dahall/taskscheduler Provides a .NET wrapper for the Windows Task Scheduler. It aggregates the multiple versions, provides an editor and allows for localization.

Post

WinRM

Tools

  • [708Star][13d] [Ruby] hackplayers/evil-winrm The ultimate WinRM shell for hacking/pentesting
  • [238Star][10d] [Go] masterzen/winrm Command-line tool and library for Windows remote command execution in Go

Post

Control Panel

Tools

Post

Windows Shortcut File

Tools

Post

Windows Explorer

Tools

Post

Application Shim

Post

Squiblydoo

Post

Open Office XML

Tools

Other

Software

IE

Tools

Edge

Tools

Post

MSOffice

Tools

  • [1731Star][1m] [JS] ziv-barber/officegen Standalone Office Open XML files (Microsoft Office 2007 and later) generator for Word (docx), PowerPoint (pptx) and Excell (xlsx) in javascript. The output is a stream.
  • [1066Star][20d] [Rich Text Format] decalage2/oletools python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.
  • [750Star][9d] [C#] outflanknl/evilclippy A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX and Windows.
  • [407Star][2m] [YARA] guelfoweb/peframe PEframe is a open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents.

Post

EMET

Tools

Post

psexec

Tools

Post

Nltest

CMSTP.exe

Rundll32

Tools

Post

Regsvr32

Tools

Post

Regasm

Regsvcs

svchost

Tools

Post

MSBuild

Tools

  • [4136Star][7d] [C#] microsoft/msbuild The Microsoft Build Engine (MSBuild) is the build platform for .NET and Visual Studio.
  • [728Star][9m] [Py] mr-un1k0d3r/powerlessshell rely on MSBuild.exe to remotely execute PowerShell scripts and commands without spawning powershell.exe.
  • [226Star][7m] [Py] infosecn1nja/maliciousmacromsbuild Generates Malicious Macro and Execute Powershell or Shellcode via MSBuild Application Whitelisting Bypass.

Post

csrss.exe

Post

其他exe

Post

SysInternalSuite

Sysmon

Tools

Post

Procmon

Tools

Post

Autoruns

Tools

Post

ProcessExplorer

Post

Other

Tools

Post

Tools

Recent Add

Environment Setup

Kernel&&Driver

Registry

SystemCall

Other

  • [1007Star][12d] [C++] henrypp/simplewall Simple tool to configure Windows Filtering Platform (WFP) which can configure network activity on your computer.
  • [981Star][5m] [C] basil00/divert Windows Packet Divert
  • [742Star][4m] [Py] diyan/pywinrm Python library for Windows Remote Management (WinRM)
  • [605Star][21d] [C] hfiref0x/winobjex64 Windows Object Explorer 64-bit
  • [475Star][2m] [C#] microsoft/dbgshell A PowerShell front-end for the Windows debugger engine.
  • [428Star][12d] [C] samba-team/samba he standard Windows interoperability suite of programs for Linux and Unix
  • [412Star][2m] [Jupyter Notebook] microsoft/windowsdefenderatp-hunting-queries Sample queries for Advanced hunting in Microsoft Defender ATP
  • [396Star][16d] [C#] microsoft/binskim A binary static analysis tool that provides security and correctness results for Windows Portable Executable and *nix ELF binary formats
  • [377Star][2m] [Ruby] winrb/winrm Ruby library for Windows Remote Management

Post

Recent Add

Contribute

Contents auto exported by Our System, please raise Issue if you have any question.