Alternatives and similar repositories for Bin-Finder

Users that are interested in Bin-Finder are comparing it to the libraries listed below

• zblurx / impersonate-rs
  Rusty Impersonate
  ☆96Updated last year
• gsmith257-cyber / better-sliver
  Adversary Emulation Framework
  ☆106Updated 10 months ago
• gabriellandau / EDRSandblast-GodFault
  EDRSandblast-GodFault
  ☆265Updated last year
• mansk1es / GhostFart
  ☆136Updated last year
• rasta-mouse / PPEnum
  Simple BOF to read the protection level of a process
  ☆114Updated 2 years ago
• sudonoodle / BOF-entra-authcode-flow
  Beacon Object File (BOF) to obtain Entra tokens via authcode flow.
  ☆91Updated 3 weeks ago
• thefLink / Hunt-Weird-Syscalls
  ETW based POC to identify direct and indirect syscalls
  ☆185Updated 2 years ago
• NetSPI / BOF-PE
  An example reference design for a proposed BOF PE
  ☆168Updated last month
• MaorSabag / SideLoadingDLL
  Do some DLL SideLoading magic
  ☆83Updated last year
• oldboy21 / JayFinder
  Find DLLs with RWX section
  ☆81Updated last year
• rbmm / SC_DEMO
  ☆115Updated 2 months ago
• OmriBaso / WTSImpersonator
  WTSImpersonator utilizes WTSQueryUserToken to steal user tokens by abusing the RPC Named Pipe "\\pipe\LSM_API_service"
  ☆119Updated 11 months ago
• zimnyaa / noWatch
  Implant drop-in for EDR testing
  ☆139Updated last year
• safedv / RustVEHSyscalls
  A Rust port of LayeredSyscall — performs indirect syscalls while generating legitimate API call stack frames by abusing VEH.
  ☆145Updated 7 months ago
• x42en / sysplant
  Your syscall factory
  ☆123Updated last week
• codewhitesec / SysmonEnte
  ☆75Updated 2 years ago
• rad9800 / FileRenameJunctionsEDRDisable
  ☆155Updated 5 months ago
• naksyn / ModuleShifting
  Stealthier variation of Module Stomping and Module Overloading injection techniques that reduces memory IoCs. Implemented in Python ctype…
  ☆116Updated last year
• ChoiSG / OneDriveUpdaterSideloading
  Payload for DLL sideloading of the OneDriveUpdater.exe, based on the PaloAltoNetwork Unit42's blog post
  ☆94Updated 2 years ago
• passthehashbrowns / BOFMask
  ☆122Updated last year
• ipSlav / DirtyCLR
  An App Domain Manager Injection DLL PoC on steroids
  ☆172Updated last year
• FalconForceTeam / bof-winrm-client
  ☆111Updated 4 months ago
• Octoberfest7 / Secure_Stager
  An x64 position-independent shellcode stager that verifies the stage it retrieves prior to execution
  ☆187Updated 6 months ago
• naksyn / ProcessStomping
  A variation of ProcessOverwriting to execute shellcode on an executable's section
  ☆148Updated last year
• rasta-mouse / CsWhispers
  Source generator to add D/Invoke and indirect syscall methods to a C# project.
  ☆178Updated last year
• Octoberfest7 / enumhandles_BOF
  ☆125Updated 9 months ago
• CymulateResearch / Blindside
  Utilizing hardware breakpoints to evade monitoring by Endpoint Detection and Response platforms
  ☆128Updated 2 years ago
• JanielDary / ImmoralFiber
  Two new offensive techniques using Windows Fibers: PoisonFiber (The first remote enumeration & Fiber injection capability POC tool) Phan…
  ☆264Updated 8 months ago
• Octoberfest7 / BeatRev
  POC for frustrating/defeating Malware Analysts
  ☆154Updated 2 years ago
• Octoberfest7 / DropSpawn_BOF
  CobaltStrike BOF to spawn Beacons using DLL Application Directory Hijacking
  ☆227Updated last year