My experience using Windows API for offensive purposes
☆17Jul 10, 2021Updated 5 years ago
Alternatives and similar repositories for OffensiveWinAPI
Users that are interested in OffensiveWinAPI are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- BlowBeef is a tool for analyzing WMI data.☆18Jul 26, 2021Updated 5 years ago
- A crappy hook on SpAcceptLsaModeContext that prints incoming auth attempts. WIP☆36Jul 27, 2021Updated 5 years ago
- A multi-staged malware that contains a kernel mode rootkit and a remote system shell.☆72May 20, 2021Updated 5 years ago
- POC code to crash Windows Event Logger Service☆27Oct 16, 2020Updated 6 years ago
- ☆84Aug 26, 2024Updated 2 years ago
- Simple, predictable pricing with DigitalOcean hosting • AdAlways know what you'll pay with monthly caps and flat pricing. Enterprise-grade infrastructure trusted by 600k+ customers.
- Custom implementation of DbgHelp's MiniDumpWriteDump function. Uses static syscalls to replace low-level functions like NtReadVirtualMemo…☆128Jan 18, 2022Updated 4 years ago
- Headers for linking your software with ntdll.dll☆15Nov 4, 2020Updated 5 years ago
- 使得Cobaltstrike支持Atexec☆90Jun 30, 2020Updated 6 years ago
- Tool to get NT system shell .☆11Jun 29, 2021Updated 5 years ago
- Anti-Malware security solution for Windows environment.☆22Jul 10, 2021Updated 5 years ago
- Using "svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc" as trigger☆58Oct 7, 2020Updated 6 years ago
- Win32 PE Anti-RE and Anti-debugging Framework☆13May 14, 2019Updated 7 years ago
- Some simple scripts for decrypting passwords retrieved from a Manage Engine OpManager installation☆11Jan 28, 2016Updated 10 years ago
- works but not work, cao!☆24Sep 4, 2021Updated 5 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- A Control Panel Applet dropper project. It has a high success rate on engagements since nobody cares about .CPL files and you can just do…☆52May 31, 2018Updated 8 years ago
- Experimental: Windows .text section compare - disk versus memory☆15Jan 21, 2015Updated 11 years ago
- SLib is a sandbox evasion library that implements some of the checks from https://evasions.checkpoint.com in C#☆66Aug 29, 2023Updated 3 years ago
- Hiding your process in ProcessHacker,Task Manager,etc by patching NtQuerySystemInformation☆89Apr 20, 2021Updated 5 years ago
- ☆15Mar 30, 2022Updated 4 years ago
- Process Ghosting Tool☆173Jun 22, 2021Updated 5 years ago
- ☆21May 28, 2021Updated 5 years ago
- C++ implementation of DOUBLEPULSAR usermode shellcode. Yet another Reflective DLL loader.☆30Nov 9, 2021Updated 4 years ago
- Send message on Telegram when you get a new Cobalt Strike beacon☆21Dec 6, 2019Updated 6 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Create a Run registry key with direct system calls. Inspired by @Cneelis's Dumpert and SharpHide.☆77Feb 27, 2020Updated 6 years ago
- Library of tools and examples for loading/bootstrapping managed code from unmanaged code in .NET☆64Nov 22, 2019Updated 6 years ago
- ☆20Jun 25, 2024Updated 2 years ago
- MiniDumpWriteDump behavior modification hook☆50Feb 15, 2021Updated 5 years ago
- About C# loader that copies a chunk at the time of the shellcode in memory in a suspended process, rather that all at once☆12Jul 14, 2022Updated 4 years ago
- Play Doh Windows ACL Tools☆63Sep 7, 2022Updated 4 years ago
- Access windows machine remotely on HTTP☆12Oct 28, 2020Updated 6 years ago
- Process Hollowing demonstration & explanation☆37Feb 25, 2021Updated 5 years ago
- Cobalt Strike Beacon Object File (BOF) that uses RegConnectRegistryA + RegOpenKeyExA API to dump registry hives on remote computer☆18Mar 4, 2023Updated 3 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Microsoft MSHTML Remote Code Execution Vulnerability CVE-2021-40444☆18Sep 29, 2021Updated 5 years ago
- Nice try reading NTDLL from disk, nerd.☆19Apr 18, 2022Updated 4 years ago
- ☆15Dec 16, 2020Updated 5 years ago
- Example code for using named pipe output with beacon ReflectiveDLLs☆118Jun 24, 2020Updated 6 years ago
- ☆41Apr 22, 2021Updated 5 years ago
- Process Monitor filter for finding privilege escalation vulnerabilities on Windows☆78Jun 9, 2021Updated 5 years ago
- A repository filled with ideas to break/detect direct syscall techniques☆25Apr 21, 2022Updated 4 years ago