Remote dynamic .NET obfuscator and AMSI/ETW patch tool for bypassing Defender
☆36May 29, 2026Updated 5 months ago
Alternatives and similar repositories for RefractionMirage
Users that are interested in RefractionMirage are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A simple research-focused AES-based shellcode loader demonstrating in-memory execution and NTAPI techniques to help understand how custom…☆55Feb 19, 2026Updated 8 months ago
- Various notes I have compiled during the OSEP PEN-300 course.☆60Mar 16, 2025Updated last year
- This repository contains a collection of scripts I use regularly for offensive security-related tasks.☆16Oct 29, 2026Updated last week
- Reflective x64 Loader written in C/ASM☆15Dec 2, 2025Updated 11 months ago
- Crystal Palace Evasion kit for Sliver☆125Jun 13, 2026Updated 4 months ago
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- Performs a global AMSI bypass by patching amsi.dll in memory.☆22Updated this week
- A searchable, copy-pasteable library of pentesting commands focused on Active Directory. Runs entirely in your browser.☆27Sep 27, 2026Updated last month
- OSEP sample codes from the course & more☆18Sep 27, 2025Updated last year
- Modify machine code in binaries with alternative x64 assembly opcodes for AV evasion☆267Sep 11, 2026Updated last month
- Kerberos manipulation library in pure Python☆27Oct 25, 2026Updated 2 weeks ago
- A BOF for patching AMSI, ETW and NtTraceEvent aka Sysmon using Trampolines☆13Jul 30, 2026Updated 3 months ago
- ROFMAD (Rust Orchestrator For Modular Automated Discovery)☆43Aug 14, 2026Updated 2 months ago
- Rust rewrite of nanodump, a low-level LSASS memory dumping tool.☆16Feb 22, 2026Updated 8 months ago
- Notes Template/Checklist for PEN-300 OSEP☆20Nov 20, 2021Updated 4 years ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Shellcode packer for CTFs and pentest / red team exams aiming for AV evasion!☆147Apr 4, 2026Updated 7 months ago
- BYOVD tool for manipulating Windows Protected Process Light (PPL) protection at the kernel level.☆99May 25, 2026Updated 5 months ago
- AdaptixC2 default beacon agent extended to support Crystal Palace loaders.☆66May 4, 2026Updated 6 months ago
- Credential and sensitive-data exposure triage for file shares☆17Aug 8, 2026Updated 3 months ago
- NebulaPulsar is a proof-of-concept in-memory implant framework for Java (JSP) and ASP.NET (ASPX/ASHX/ASMX) webshells, originally develope…☆47Jul 1, 2026Updated 4 months ago
- PoC for exploiting CVE-2026-26128.☆64May 6, 2026Updated 6 months ago
- Active Directory information dumper via ADWS for evasion purposes.☆325Oct 12, 2026Updated 3 weeks ago
- PwnRM is an operator-grade Active Directory post-exploitation platform engineered directly upon the native Microsoft PowerShell Remoting …☆98Sep 4, 2026Updated 2 months ago
- ☆88Sep 21, 2026Updated last month
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- ☆11Mar 8, 2026Updated 8 months ago
- ClickMyPayload creates realistic browser verification pages that silently copy PowerShell or CMD commands to the clipboard, display decoy…☆29Sep 25, 2026Updated last month
- This is a Python script that generates a staged payload that fully bypasses MS Defender. Can potentially be used for EDRs with some custo…☆97Mar 31, 2026Updated 7 months ago
- Language extension for Crystal Palace Specification files☆15Jun 6, 2026Updated 5 months ago
- The Undocumented Public API For The Hack The Box Platform☆18Jul 4, 2026Updated 4 months ago
- ☆220Sep 11, 2026Updated last month
- PoC for CVE-2026-3609 - XIGNCODE3 xhunter1.sys handle leak enabling PPL bypass and LSASS dumping☆39May 12, 2026Updated 5 months ago
- A collection of techniques for process injection on Windows☆105Updated this week
- A proof-of-concept to demonstrate randomized execution paths and their impact on call stack signatures — ideal for EDR testing, behavior-…☆24Jan 17, 2026Updated 9 months ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- OSEP - Offsec Expert Professional☆22Jun 23, 2024Updated 2 years ago
- Sliver CheatSheet for OSEP☆324May 18, 2026Updated 5 months ago
- GhostHound is a BloodHound OpenGraph extension that surfaces Active Directory tombstone reanimation as a first-class attack path, enumera…☆47Aug 9, 2026Updated 3 months ago
- C# Process Hollowing POC☆21Jan 5, 2023Updated 3 years ago
- A PoC of User-Defined Reflective Loader for Havoc Framework built with Cystal Palace☆48Oct 18, 2026Updated 3 weeks ago
- A simple to use single-include Windows API resolver☆22Jul 9, 2024Updated 2 years ago
- CopyReadProcessMemory expoits the miss-configuration/vulnerability present on the API Windows method ReadProcessMemory.☆35Nov 27, 2025Updated 11 months ago
Are these results useful?