Shadow Dumper is a powerful tool used to dump LSASS memory, often needed in penetration testing and red teaming. It uses multiple advanced techniques to dump memory, allowing to access sensitive data in LSASS memory.
☆591May 22, 2025Updated last year
Alternatives and similar repositories for ShadowDumper
Users that are interested in ShadowDumper are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Dump lsass using only NTAPI functions creating 3 JSON and 1 ZIP file... and generate the MiniDump file later!☆609Aug 17, 2026Updated 2 months ago
- LSASS memory dumper using only NTAPIs, creating a minimal minidump. It can be compiled as shellcode (PIC), supports XOR encryption, and r…☆386Apr 26, 2025Updated last year
- Dump lsass using only NTAPI functions by hand-crafting Minidump files (without MiniDumpWriteDump!!!)☆748Aug 17, 2026Updated 2 months ago
- This tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone…☆218Oct 19, 2024Updated 2 years ago
- Red teaming tool to dump LSASS memory, bypassing basic countermeasures.☆246Aug 2, 2026Updated 2 months ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- DCOM Lateral movement POC abusing the IMsiServer interface - uploads and executes a payload remotely☆396Dec 13, 2024Updated last year
- .NET post-exploitation toolkit for Active Directory reconnaissance and exploitation☆401Jul 23, 2025Updated last year
- Remote Kerberos Relay made easy! Advanced Kerberos Relay Framework☆650May 8, 2025Updated last year
- Python implementation of GhostPack's Seatbelt situational awareness tool☆273Nov 12, 2024Updated last year
- A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the …☆1,912Nov 3, 2024Updated last year
- This is the tool to dump the LSASS process on modern Windows 11☆680May 23, 2026Updated 5 months ago
- A new technique that can be used to bypass memory scanners. This can be useful in hiding problematic code (such as reflective loaders imp…☆358Oct 7, 2024Updated 2 years ago
- Sleep obfuscation☆275Dec 13, 2024Updated last year
- ☆200Mar 28, 2025Updated last year
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- Proof of Concept (PoC) .NET tool for remotely killing EDR with WDAC☆441Sep 29, 2025Updated last year
- DeadPotato is a windows privilege escalation utility from the Potato family of exploits, leveraging the SeImpersonate right to obtain SYS…☆478Aug 10, 2026Updated 2 months ago
- ☆415Dec 8, 2024Updated last year
- ☆240Oct 8, 2024Updated 2 years ago
- A BloodHound collector for Microsoft Configuration Manager☆404Jul 7, 2025Updated last year
- PowerShell scripts for alternative SharpHound enumeration, including users, groups, computers, and certificates, using the ActiveDirector…☆414Jan 14, 2026Updated 9 months ago
- Extract and execute a PE embedded within a PNG file using an LNK file.☆481Nov 2, 2024Updated last year
- ☆388Oct 17, 2025Updated last year
- .NET Post-Exploitation Utility for Abusing Strong Explicit Certificate Mappings in ADCS☆160Feb 10, 2025Updated last year
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Bypass Credential Guard by patching WDigest.dll using only NTAPI functions☆270Apr 8, 2025Updated last year
- A Rust implementation of Internal-Monologue — retrieving NetNTLM hashes without touching LSASS, leveraging SSPI for NTLM negotiation and …☆192Apr 26, 2025Updated last year
- BOF and Python3 implementation of technique to unbind 445/tcp on Windows via SCM interactions☆361Nov 19, 2024Updated last year
- Leverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry☆482Aug 2, 2024Updated 2 years ago
- Positional Independent Code to extract clear text password from mstsc.exe using API Hooking via HWBP.☆249Jun 11, 2024Updated 2 years ago
- Evasive shellcode loader☆400Oct 17, 2024Updated 2 years ago
- A technique that can be used to bypass AV/EDR memory scanners. This can be used to hide well-known and detected shellcodes (such as msfve…☆599Jun 12, 2024Updated 2 years ago
- Windows remote execution multitool☆814Mar 25, 2026Updated 7 months ago
- ☆99Sep 1, 2024Updated 2 years ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- A tool for coercing and relaying Kerberos authentication over DCOM and RPC.☆155Jul 17, 2025Updated last year
- Collection of UAC Bypass Techniques Weaponized as BOFs☆664Feb 21, 2024Updated 2 years ago
- Dump cookies and credentials directly from Chrome/Edge process memory☆1,502Apr 9, 2026Updated 6 months ago
- Extract the SAM and SYSTEM hives using the Volume Shadow Copy (VSS) API. With exfiltration and XOR obfuscation options. In C#, C++, Cryst…☆386Aug 31, 2026Updated last month
- smbclient-ng, a fast and user friendly way to interact with SMB shares.☆1,074Sep 29, 2026Updated last month
- A Powershell AMSI Bypass technique via Vectored Exception Handler (VEH). This technique does not perform assembly instruction patching, f…☆176May 30, 2024Updated 2 years ago
- Weaponizing DCOM for NTLM Authentication Coercions☆274Jul 1, 2025Updated last year