Shadow Dumper is a powerful tool used to dump LSASS memory, often needed in penetration testing and red teaming. It uses multiple advanced techniques to dump memory, allowing to access sensitive data in LSASS memory.
☆588May 22, 2025Updated last year
Alternatives and similar repositories for ShadowDumper
Users that are interested in ShadowDumper are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Dump lsass using only NTAPI functions creating 3 JSON and 1 ZIP file... and generate the MiniDump file later!☆601Aug 17, 2026Updated last month
- LSASS memory dumper using only NTAPIs, creating a minimal minidump. It can be compiled as shellcode (PIC), supports XOR encryption, and r…☆385Apr 26, 2025Updated last year
- This tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone…☆219Oct 19, 2024Updated last year
- DCOM Lateral movement POC abusing the IMsiServer interface - uploads and executes a payload remotely☆396Dec 13, 2024Updated last year
- Red teaming tool to dump LSASS memory, bypassing basic countermeasures.☆248Aug 2, 2026Updated last month
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- Dump lsass using only NTAPI functions by hand-crafting Minidump files (without MiniDumpWriteDump!!!)☆749Aug 17, 2026Updated last month
- A new technique that can be used to bypass memory scanners. This can be useful in hiding problematic code (such as reflective loaders imp…☆359Oct 7, 2024Updated last year
- .NET post-exploitation toolkit for Active Directory reconnaissance and exploitation☆401Jul 23, 2025Updated last year
- Remote Kerberos Relay made easy! Advanced Kerberos Relay Framework☆652May 8, 2025Updated last year
- A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the …☆1,901Nov 3, 2024Updated last year
- ☆199Mar 28, 2025Updated last year
- Extract and execute a PE embedded within a PNG file using an LNK file.☆476Nov 2, 2024Updated last year
- Leverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry☆477Aug 2, 2024Updated 2 years ago
- PowerShell scripts for alternative SharpHound enumeration, including users, groups, computers, and certificates, using the ActiveDirector…☆411Jan 14, 2026Updated 8 months ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- A Powershell AMSI Bypass technique via Vectored Exception Handler (VEH). This technique does not perform assembly instruction patching, f…☆173May 30, 2024Updated 2 years ago
- ☆241Oct 8, 2024Updated last year
- Windows remote execution multitool☆815Mar 25, 2026Updated 5 months ago
- .NET Post-Exploitation Utility for Abusing Strong Explicit Certificate Mappings in ADCS☆159Feb 10, 2025Updated last year
- A Rust implementation of Internal-Monologue — retrieving NetNTLM hashes without touching LSASS, leveraging SSPI for NTLM negotiation and …☆192Apr 26, 2025Updated last year
- DeadPotato is a windows privilege escalation utility from the Potato family of exploits, leveraging the SeImpersonate right to obtain SYS…☆478Aug 10, 2026Updated last month
- Bypass Credential Guard by patching WDigest.dll using only NTAPI functions☆269Apr 8, 2025Updated last year
- Proof of Concept (PoC) .NET tool for remotely killing EDR with WDAC☆439Sep 29, 2025Updated 11 months ago
- A tool for coercing and relaying Kerberos authentication over DCOM and RPC.☆151Jul 17, 2025Updated last year
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- This is the tool to dump the LSASS process on modern Windows 11☆664May 23, 2026Updated 3 months ago
- COM ViewLogger — new malware keylogging technique☆409Jan 6, 2025Updated last year
- Python implementation of GhostPack's Seatbelt situational awareness tool☆275Nov 12, 2024Updated last year
- A technique that can be used to bypass AV/EDR memory scanners. This can be used to hide well-known and detected shellcodes (such as msfve…☆598Jun 12, 2024Updated 2 years ago
- ☆387Oct 17, 2025Updated 11 months ago
- Sleep obfuscation☆275Dec 13, 2024Updated last year
- BOF and Python3 implementation of technique to unbind 445/tcp on Windows via SCM interactions☆361Nov 19, 2024Updated last year
- ☆416Dec 8, 2024Updated last year
- early cascade injection PoC based on Outflanks blog post☆240Nov 7, 2024Updated last year
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Extract the SAM and SYSTEM hives using the Volume Shadow Copy (VSS) API. With exfiltration and XOR obfuscation options. In C#, C++, Cryst…☆386Aug 31, 2026Updated 2 weeks ago
- A Rust implementation of GodPotato — abusing SeImpersonate to gain SYSTEM privileges. Includes a TCP-based reverse shell and indirect NTA…☆369Mar 17, 2026Updated 6 months ago
- Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR …☆312Jul 31, 2024Updated 2 years ago
- MultiDump is a post-exploitation tool for dumping and extracting LSASS memory discreetly.☆540Nov 14, 2025Updated 10 months ago
- ☆346Jun 24, 2026Updated 2 months ago
- A BloodHound collector for Microsoft Configuration Manager☆403Jul 7, 2025Updated last year
- NyxInvoke is a Rust CLI tool for running .NET assemblies, PowerShell, and BOFs with Patchless AMSI and ETW bypass features. with Dual-bui…☆241Feb 12, 2025Updated last year