Check if your AV/EDR does inline hooking, displays the hooked functions and allows you to compare them with the original ones.
☆44Apr 2, 2026Updated 6 months ago
Alternatives and similar repositories for HookSentry
Users that are interested in HookSentry are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- a short script to make my life easy : ) nothing more☆13Jul 6, 2026Updated 3 months ago
- The swiss army knife of LSASS dumping☆13Jan 4, 2026Updated 9 months ago
- A proof of concept that makes a Windows syscall look like it came from a legitimate Windows thread pool, with no trace of your own code a…☆15Jul 15, 2026Updated 3 months ago
- Gadget scanner that finds ROP gadgets inside any Windows DLL☆48Jun 18, 2026Updated 4 months ago
- A Position Independent Code (PIC) implementation of the execute-assembly command built with Crystal Palace.☆21Oct 4, 2026Updated 3 weeks ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- A python proof of concept tool to assist in your payloads classification against EDR/AV's machine learning models☆39Oct 14, 2026Updated 2 weeks ago
- vehsyscall:a syscall project that may bypass EDR☆58Mar 1, 2024Updated 2 years ago
- Precision call-stack spoofing gadget hunter for x64 DLLs, powered by Iced disassembler☆20Jul 2, 2026Updated 3 months ago
- BOF and research notes from hunting execution paths, covering Shell.HWEventHandlerShellExecute COM execution through the AutoPlay IHWEven…☆39Jun 20, 2026Updated 4 months ago
- A collection of position independent coding resources☆129Nov 15, 2025Updated 11 months ago
- Random BOFs for LDAP tradecraft☆74Sep 9, 2025Updated last year
- ☆110Aug 21, 2024Updated 2 years ago
- A BOF to regularly check for active users on a target.☆16Apr 19, 2025Updated last year
- BOF with Synthetic Stackframe☆274Oct 30, 2025Updated last year
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- AV/EDR companies netblocks☆19Nov 9, 2021Updated 4 years ago
- Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from mem…☆77Mar 16, 2026Updated 7 months ago
- A Beacon Object File for decrypting Chrome App-Bound Encryption masterkeys in-memory via Cobalt Strike☆19Jul 14, 2025Updated last year
- Locate dlls and function addresses without PEB Walk and EAT parsing☆111Nov 7, 2025Updated 11 months ago
- Svn sync of http://svn.code.sf.net/p/rdp2tcp/code/, the true master of this project☆12Sep 21, 2022Updated 4 years ago
- Cobalt Strike Beacon Object File (BOF) that obtain SYSTEM privilege with SeImpersonate privilege by passing a malicious IUnknwon object t…☆12Feb 4, 2024Updated 2 years ago
- A Proof of Concept demonstrating CET-compliant callstack spoofing in Rust. It leverages Windows Thread Pool and Enum Callback trampolinin…☆72Jul 12, 2026Updated 3 months ago
- Lateral Movement Bof with MSI ODBC Driver Install☆174Sep 30, 2025Updated last year
- Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR …☆311Jul 31, 2024Updated 2 years ago
- Open source password manager - Proton Pass • AdSecurely store, share, and autofill your credentials with Proton Pass, the end-to-end encrypted password manager trusted by millions.
- Slides for COM Hijacking AV/EDR Talk on 38c3☆75Jan 3, 2025Updated last year
- Another Injection Technique which eliminates creations of thread in remote process☆29Jul 7, 2026Updated 3 months ago
- Simple, header-only, pattern matching and patching class + tool written in modern C++.☆26Jun 5, 2026Updated 4 months ago
- ☆14Oct 7, 2025Updated last year
- Sleep replacement that executes real, varied work to break behavioral pattern matching by EDR and anti-cheat systems☆88Jul 20, 2026Updated 3 months ago
- A Bof to dump domain credentials via DRSGetNCChanges, Created for use with the Adaptix C2.☆15Dec 16, 2025Updated 10 months ago
- A BOF that's a BOF Loader and more☆212Apr 6, 2026Updated 6 months ago
- BOF to run PE in Cobalt Strike Beacon without console creation☆198Nov 23, 2025Updated 11 months ago
- Cobaltstrike Reflective Loader with Synthetic Stackframe☆193Jan 17, 2026Updated 9 months ago
- GPUs on demand by Runpod - Special Offer Available • AdRun AI, ML, and HPC workloads on powerful cloud GPUs—without limits or wasted spend. Deploy GPUs in under a minute and pay by the second.
- Windows Persistence IT-Security☆111Mar 9, 2025Updated last year
- Async BOF for NTLMv2 Hash Snooping from ETW☆13Apr 2, 2026Updated 6 months ago
- A community maintained repository of Beacon Object Files (BOFs) for red team operations, research, and education. Our goal is to provide …☆34Aug 8, 2026Updated 2 months ago
- Lateral movement with DCOM DLL hijacking☆185Jul 4, 2025Updated last year
- Encrypted shellcode Injection to avoid Kernel triggered memory scans☆432Sep 12, 2023Updated 3 years ago
- Demonstration of Early Bird APC Injection - MITRE ID T1055.004☆35Oct 31, 2023Updated 2 years ago
- Enhanced Evasion for Threadless Injections☆15May 29, 2026Updated 5 months ago