List of tools to use in the Advance Red Team Operations course from White Knight Labs
☆15Dec 22, 2024Updated last year
Alternatives and similar repositories for WKL-Tools
Users that are interested in WKL-Tools are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- BOFs gift wrapped for Havoc☆12Jun 6, 2024Updated 2 years ago
- One-header configurable C++20 COFF loader☆20Jul 21, 2025Updated last year
- Program written in C that detects hooks placed on functions by an EDR☆19Nov 20, 2025Updated 11 months ago
- Reflective x64 Loader written in C/ASM☆15Dec 2, 2025Updated 10 months ago
- Dynamic Function Resolution (DFR) definitions for Crystal Palace☆12Dec 19, 2025Updated 10 months ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- The swiss army knife of LSASS dumping☆13Jan 4, 2026Updated 9 months ago
- Sleep Obfuscation via CreateThreadpoolTimer☆24Jul 27, 2026Updated 3 months ago
- Language extension for Crystal Palace Specification files☆15Jun 6, 2026Updated 4 months ago
- crystal palace + draugr function hook definition generator☆17Jan 27, 2026Updated 9 months ago
- ☆27Dec 31, 2025Updated 9 months ago
- Collection of Windows loaders☆21Mar 14, 2026Updated 7 months ago
- Tool to transplant a valid code signature from one Portable Executable (PE) binary to another.☆17Apr 24, 2020Updated 6 years ago
- Cobalt Strike BOF that extracts selected Windows registry hives directly from a raw NTFS volume by parsing NTFS metadata and reading file…☆111Oct 11, 2026Updated 2 weeks ago
- Process Hollowing Packer☆29Sep 5, 2017Updated 9 years ago
- End-to-end encrypted cloud storage - Proton Drive • AdSpecial offer: 40% Off Yearly / 80% Off First Month. Protect your most important files, photos, and documents from prying eyes.
- a modular reflective dll/pe loader that allows for easy chaining of dlls and pes together in a single or remote process with tight memory…☆15Feb 8, 2026Updated 8 months ago
- SCADAver: a Rust-powered, multi-protocol OT/ICS security framework for authorized labs featuring asset discovery, enumeration, controlled…☆89Aug 29, 2026Updated 2 months ago
- Windows x64 API hashing library that bypasses EAF and resolves forwarded exports, ordinals, and api-ms-*/ext-ms-* API Set DLLs.☆68Oct 7, 2026Updated 3 weeks ago
- MITRE ATT&CK visualizations☆13Jan 28, 2022Updated 4 years ago
- open source implementation of the UDC2 spec used in Cobalt Strike☆60Jul 4, 2026Updated 3 months ago
- A portable bridge between your C2 infrastructure and Discord, built for quick and lightweight operations.☆13Jun 3, 2025Updated last year
- Cloud dead-drop C2 framework — RSA-4096 + AES-256-GCM, 5 cloud providers, Rust-only agents, P2P mesh, persistence engine, credential harv…☆47Updated this week
- Windows User-Mode Shellcode Development Framework (WUMSDF)☆162Jul 15, 2026Updated 3 months ago
- A header-only, freestanding C++20 template for IR-bytecode VM loaders☆27May 10, 2026Updated 5 months ago
- Proton VPN Special Offer - Get 70% off • AdSpecial partner offer. Trusted by over 100 million users worldwide. Tested, Approved and Recommended by Experts.
- Open Source Implementation of Cobalt Strike's Malleable C2☆110Jun 27, 2026Updated 4 months ago
- A Very Cool Process Injector That supports both Shellcode injection and dll injection☆27Sep 22, 2025Updated last year
- OneDrive as a covert C2 transport for Cobalt Strike☆77Sep 19, 2026Updated last month
- Vmware source code for 2012.☆21Dec 15, 2023Updated 2 years ago
- Remote dynamic .NET obfuscator and AMSI/ETW patch tool for bypassing Defender☆36May 29, 2026Updated 5 months ago
- PoC framework for Sliver compilation☆22Jan 14, 2025Updated last year
- ☆11May 10, 2019Updated 7 years ago
- Object file loader implemented as a post-ex DLL for asynchronous BOF execution.☆29Jul 23, 2026Updated 3 months ago
- Credential and sensitive-data exposure triage for file shares☆16Aug 8, 2026Updated 2 months ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- SysWhispers & HellsGate successor, executing protected Indirect & Direct syscalls in EDR protected settings☆53Aug 15, 2026Updated 2 months ago
- Crystal Palace PICO loader for Sliver C2 dual-layer AMSI bypass, ETW silencing, AES-256-CBC encrypted payloads, 6 delivery variants☆48Aug 20, 2026Updated 2 months ago
- Pure-impacket parallel local-admin discovery via RBCD.☆47Oct 9, 2026Updated 2 weeks ago
- Progressing on my malware development journey.☆17Aug 20, 2024Updated 2 years ago
- Tool to authenticate to an LDAP/S server with a certificate through Schannel written in Rust. 🦀☆77Oct 10, 2026Updated 2 weeks ago
- A searchable, copy-pasteable library of pentesting commands focused on Active Directory. Runs entirely in your browser.☆27Sep 27, 2026Updated last month
- Command and control framework☆40Jun 20, 2026Updated 4 months ago