Remote dynamic .NET obfuscator and AMSI/ETW patch tool for bypassing Defender
☆36May 29, 2026Updated 4 months ago
Alternatives and similar repositories for RefractionMirage
Users that are interested in RefractionMirage are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Reflective x64 Loader written in C/ASM☆15Dec 2, 2025Updated 10 months ago
- Browser-Based Clickfix Generator☆25Sep 25, 2026Updated 3 weeks ago
- NebulaPulsar is a proof-of-concept in-memory implant framework for Java (JSP) and ASP.NET (ASPX/ASHX/ASMX) webshells, originally develope…☆47Jul 1, 2026Updated 3 months ago
- A simple research-focused AES-based shellcode loader demonstrating in-memory execution and NTAPI techniques to help understand how custom…☆54Feb 19, 2026Updated 8 months ago
- Kerberos manipulation library in pure Python☆27Aug 24, 2026Updated last month
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- OSEP sample codes from the course & more☆18Sep 27, 2025Updated last year
- Crystal Palace PICO loader for Sliver C2 dual-layer AMSI bypass, ETW silencing, AES-256-CBC encrypted payloads, 6 delivery variants☆47Aug 20, 2026Updated 2 months ago
- Credential and sensitive-data exposure triage for file shares☆16Aug 8, 2026Updated 2 months ago
- A collection of techniques for process injection on Windows☆104Aug 16, 2026Updated 2 months ago
- ☆86Sep 21, 2026Updated 3 weeks ago
- Performs a global AMSI bypass by patching amsi.dll in memory.☆21Oct 14, 2025Updated last year
- A PoC of User-Defined Reflective Loader for Havoc Framework built with Cystal Palace☆37Updated this week
- Rust rewrite of nanodump, a low-level LSASS memory dumping tool.☆16Feb 22, 2026Updated 7 months ago
- Kernel process termination using Microsoft's own signed driver.☆56Aug 10, 2026Updated 2 months ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- AdaptixC2 default beacon agent extended to support Crystal Palace loaders.☆64May 4, 2026Updated 5 months ago
- Process Explorer vulnerable driver PPL Bypass☆27Sep 30, 2026Updated 2 weeks ago
- Nim-based encryption tool for obfuscating shellcode and payloads for evading Windows Defender.☆28Jul 14, 2026Updated 3 months ago
- Language extension for Crystal Palace Specification files☆15Jun 6, 2026Updated 4 months ago
- GhostHound is a BloodHound OpenGraph extension that surfaces Active Directory tombstone reanimation as a first-class attack path, enumera…☆47Aug 9, 2026Updated 2 months ago
- PwnRM is an operator-grade Active Directory post-exploitation platform engineered directly upon the native Microsoft PowerShell Remoting …☆93Sep 4, 2026Updated last month
- Gadget scanner that finds ROP gadgets inside any Windows DLL☆47Jun 18, 2026Updated 4 months ago
- open source implementation of the UDC2 spec used in Cobalt Strike☆61Jul 4, 2026Updated 3 months ago
- BYOVD tool for manipulating Windows Protected Process Light (PPL) protection at the kernel level.☆98May 25, 2026Updated 4 months ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Custom Adaptix-compatible C2 agent - PIC beacon + Stardust UDRL + Go extender plugins☆145Oct 4, 2026Updated 2 weeks ago
- Command and control framework☆40Jun 20, 2026Updated 4 months ago
- Cloud dead-drop C2 framework — RSA-4096 + AES-256-GCM, 5 cloud providers, Rust-only agents, P2P mesh, persistence engine, credential harv…☆43Sep 9, 2026Updated last month
- SmuggleMyPayload generates HTML pages that embed and reconstruct files client-side using JavaScript. The toolkit offers multiple HTML Smu…☆54Oct 13, 2026Updated last week
- Another Injection Technique which eliminates creations of thread in remote process☆28Jul 7, 2026Updated 3 months ago
- Local privilege-escalation proof of concept for the Windows WalletService vulnerability fixed in July 2026.☆61Jul 20, 2026Updated 3 months ago
- BOF exploiting the Visual Studio Installer Elevation Service for SYSTEM LPE and persistence via AppDomainManager hijacking, with native E…☆88Aug 5, 2026Updated 2 months ago
- NetExec MCP☆88Updated this week
- A Position Independent Code (PIC) implementation of the execute-assembly command, using Crysta Palace linker.☆22Oct 4, 2026Updated 2 weeks ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Windows x64 API hashing library that bypasses EAF and resolves forwarded exports, ordinals, and api-ms-*/ext-ms-* API Set DLLs.☆67Oct 7, 2026Updated last week
- Cross-platform syscall-powered implant & C2 — direct syscalls (Win), raw syscalls (Linux), HTTPS/DNS/ICMP channels. No winapi layer.☆65Sep 11, 2026Updated last month
- A practical client for ADWS in Golang.☆56Aug 5, 2026Updated 2 months ago
- Build guide for Red Teaming home lab. GOAD lab setup in Proxmox and pfSense, Operator/C2 and Redirectors.☆48Sep 26, 2026Updated 3 weeks ago
- ☆26Mar 30, 2026Updated 6 months ago
- Kernel-mode process terminator using a signed BYOVD driver. Works on all Windows 10/11. No offsets, no PDB. Rust.☆108Oct 1, 2026Updated 2 weeks ago
- Crystal port of GodPotato to abuse SeImpersonatePrivilege with indirect syscalls, dynamic API resolution and compile-time string obfuscat…☆131Aug 22, 2026Updated last month