Alternatives and similar repositories for Xenon:

Users that are interested in Xenon are comparing it to the libraries listed below

• Octoberfest7 / enumhandles_BOF
  ☆125Updated 6 months ago
• FalconForceTeam / bof-winrm-client
  ☆103Updated 2 months ago
• deh00ni / NtDumpBOF
  ☆95Updated 6 months ago
• NtDallas / Ulfberht
  Shellcode loader
  ☆77Updated 4 months ago
• CICADA8-Research / TypeLibWalker
  TypeLib persistence technique
  ☆108Updated 5 months ago
• boku7 / patchwerk
  BOF that finds all the Nt* system call stubs within NTDLL and overwrites with clean syscall stubs (user land hook evasion)
  ☆172Updated last month
• itaymigdal / PartyLoader
  Threadless shellcode injection tool
  ☆63Updated 7 months ago
• rasta-mouse / process-inject-kit
  Port of Cobalt Strike's Process Inject Kit
  ☆171Updated 3 months ago
• NtDallas / OdinLdr
  Cobaltstrike Reflective Loader with Synthetic Stackframe
  ☆101Updated 2 months ago
• 0xHossam / HuffLoader
  Huffman Coding in Shellcode Obfuscation & Dynamic Indirect Syscalls Loader.
  ☆106Updated last year
• Cipher7 / ApexLdr
  ApexLdr is a DLL Payload Loader written in C
  ☆109Updated 8 months ago
• NtDallas / Draugr
  BOF with Synthetic Stackframe
  ☆136Updated last month
• Faran-17 / Hellshazzard
  Indirect Syscall implementation to bypass userland NTAPIs hooking.
  ☆73Updated 7 months ago
• akamai / Mirage
  Mirage is a PoC memory evasion technique that relies on a vulnerable VBS enclave to hide shellcode within VTL1.
  ☆72Updated last month
• NUL0x4C / FetchPayloadFromDummyFile
  Construct the payload at runtime using an array of offsets
  ☆63Updated 9 months ago
• ewby / Mockingjay_BOF
  Cobalt Strike + Brute Ratel C4 Beacon Object File (BOF) Conversion of the Mockingjay Process Injection Technique
  ☆149Updated last year
• kozmer / aad-bofs
  AzureAD beacon object files
  ☆117Updated 3 months ago
• Octoberfest7 / Enumprotections_BOF
  A BOF to enumerate system process, their protection levels, and more.
  ☆116Updated 4 months ago
• rweijnen / createdump
  Leverage WindowsApp createdump tool to obtain an lsass dump
  ☆147Updated 6 months ago
• ZERODETECTION / MSC_Dropper
  ☆146Updated 7 months ago
• CodeXTF2 / WebcamBOF
  Webcam capture capability for Cobalt Strike as a BOF, with in-memory download options
  ☆133Updated last month
• Octoberfest7 / Secure_Stager
  An x64 position-independent shellcode stager that verifies the stage it retrieves prior to execution
  ☆184Updated 4 months ago
• safedv / Rustic64Shell
  A 64-bit, position-independent code reverse TCP shell for Windows — built in Rust.
  ☆60Updated 2 months ago
• ZephrFish / QoL-BOFs
  Curated list of public Beacon Object Files(BOFs) build in as submodules for easy cloning
  ☆127Updated 3 months ago
• mlcsec / EDRenum-BOF
  Identify common EDR processes, directories, and services. Simple BOF of Invoke-EDRChecker.
  ☆118Updated 5 months ago
• Tw1sm / SQL-BOF
  Library of BOFs to interact with SQL servers
  ☆160Updated 3 months ago
• 0xRedpoll / WhatsAppKeyBOF
  A BOF to retrieve decryption keys for WhatsApp Desktop and a utility script to decrypt the databases.
  ☆72Updated 3 weeks ago
• voidvxvt / HellBunny
  Malleable shellcode loader written in C and Assembly utilizing direct or indirect syscalls for evading EDR hooks
  ☆98Updated 3 months ago
• Maldev-Academy / DRMBinViaOrdinalImports
  Create Anti-Copy DRM Malware
  ☆54Updated 7 months ago
• Retr0-code / hash-dumper
  Windows NTLM hash dump utility written in C language, that supports Windows and Linux. Hashes can be dumped in realtime or from already s…
  ☆60Updated last year