Alternatives and similar repositories for BHUSA-2023

Users that are interested in BHUSA-2023 are comparing it to the libraries listed below

• alfarom256 / LogMeInPoCHandleDup
  ☆64Updated last year
• Z4kSec / IoctlHunter
  IoctlHunter is a command-line tool designed to simplify the analysis of IOCTL calls made by userland software targeting Windows drivers.
  ☆104Updated last year
• deepinstinct / ContainYourself
  A PoC of the ContainYourself research presented in DEFCON 31, which abuses the Windows containers framework to bypass EDRs.
  ☆319Updated 2 years ago
• outflanknl / edr-internals
  Tools for analyzing EDR agents
  ☆273Updated last year
• BeetleChunks / Obligato
  This project is an implant framework designed for long term persistent access to Windows machines.
  ☆110Updated 2 years ago
• synacktiv / DLHell
  Local & remote Windows DLL Proxying
  ☆169Updated last year
• ViperXSecurity / lib-nosa
  lib-nosa is a minimalist C library designed to facilitate socket connections through AFD driver IOCTL operations on Windows.
  ☆119Updated last year
• SafeBreach-Labs / MagicDot
  A set of rootkit-like abilities for unprivileged users, and vulnerabilities based on the DOT-to-NT path conversion known issue
  ☆107Updated last year
• warpnet / MS-RPC-Fuzzer
  Gain insights into MS-RPC implementations that may be vulnerable using an automated approach and make it easy to visualize the data. By f…
  ☆324Updated 2 months ago
• JanielDary / ImmoralFiber
  Two new offensive techniques using Windows Fibers: PoisonFiber (The first remote enumeration & Fiber injection capability POC tool) Phan…
  ☆278Updated last year
• PacktPublishing / Windows-APT-Warfare
  Windows APT Warfare, published by Packt
  ☆76Updated 2 years ago
• 20urc3 / Aplos
  Aplos an extremely simple fuzzer for Windows binaries.
  ☆68Updated 10 months ago
• SafeBreach-Labs / wd-pretender
  ☆132Updated 2 years ago
• Idov31 / NidhoggScript
  NidhoggScript is a tool to generate "script" file that allows execution of multiple commands for Nidhogg
  ☆50Updated last year
• Bw3ll / ROP_ROCKET
  ROP ROCKET is an advanced code-reuse attack framework, with extensive ROP chain generation capabilities, including for novel Windows Sysc…
  ☆164Updated last month
• ghostpepper108 / Evasion
  ☆107Updated 2 years ago
• oldboy21 / JayFinder
  Find DLLs with RWX section
  ☆80Updated 2 years ago
• sensepost / mydumbedr
  ☆121Updated last year
• Cracked5pider / CodeCave
  A bunch of scripts and code i wrote.
  ☆148Updated last year
• Kudaes / Eclipse
  Activation Context Hijack
  ☆168Updated 5 months ago
• Wh04m1001 / GamingServiceEoP
  ☆150Updated last year
• zodiacon / Recon2023
  Recon 2023 slides and code
  ☆80Updated 2 years ago
• hackerhouse-opensource / Artillery
  CIA UAC bypass implementation that utilizes elevated COM object to write to System32 and an auto-elevated process to execute as administr…
  ☆181Updated 2 years ago
• cocomelonc / bsprishtina-2024-maldev-workshop
  BSides Prishtina 2024 Malware Development and Persistence workshop
  ☆123Updated last week
• mansk1es / GhostFart
  ☆137Updated 2 years ago
• ColeHouston / Sunder
  Windows rootkit designed to work with BYOVD exploits
  ☆211Updated 11 months ago
• OmriBaso / WTSImpersonator
  WTSImpersonator utilizes WTSQueryUserToken to steal user tokens by abusing the RPC Named Pipe "\\pipe\LSM_API_service"
  ☆121Updated last year
• CICADA8-Research / COMThanasia
  A set of programs for analyzing common vulnerabilities in COM
  ☆243Updated last year
• florylsk / RecycledInjector
  Native Syscalls Shellcode Injector
  ☆267Updated 2 years ago
• naksyn / Embedder
  Embedder is a collection of sources in different languages to embed Python interpreter with minimal dependencies
  ☆123Updated last year