This is a novel technique that leverages the well-known Device Code phishing approach. It dynamically initiates the flow when the victim opens the phishing link and instantly redirects them to the authentication page. No authentication method, not even FIDO, is able to protect against this type of attack.
☆212Sep 19, 2025Updated last year
Alternatives and similar repositories for DeviceCodePhishing
Users that are interested in DeviceCodePhishing are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- OAuth Device Code Phishing Toolkit☆142Apr 18, 2026Updated 6 months ago
- Cobalt Strike BOF for evasive .NET assembly execution☆328Mar 31, 2025Updated last year
- ☆305Aug 14, 2025Updated last year
- Lateral Movement via Bitlocker DCOM interfaces & COM Hijacking☆468Jun 27, 2025Updated last year
- C2-agnostic BOF collection, categorized by attack chain phase. Designed to be small and modular, allowing for quick execution and automat…☆321Oct 17, 2026Updated last week
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- A malicious OAuth application that can be leveraged for both internal and external phishing attacks targeting Microsoft Azure and Office3…☆180Jul 31, 2025Updated last year
- Initial Access and Post-Exploitation Tool for Entra ID and M365 with a browser-based GUI☆1,413Aug 26, 2026Updated 2 months ago
- A fork of the great TokenTactics with support for CAE and token endpoint v2☆471Sep 13, 2026Updated last month
- Azure JWT Token Manipulation Toolset☆737Dec 6, 2024Updated last year
- Abusing Azure services over C2☆384Jan 20, 2026Updated 9 months ago
- tool for requesting Entra ID's P2P certificate and authenticating to a remote Entra joinned devices with it☆135Aug 23, 2025Updated last year
- ☆245Sep 21, 2026Updated last month
- A tool designed for smuggling interactive command and control traffic through legitimate TURN servers hosted by reputable providers such …☆440Jun 9, 2026Updated 4 months ago
- Demo code JavaScript POC that tricks user into sending Windows hash to responder☆37Dec 12, 2025Updated 10 months ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- SOCKS5 proxy tool that uses Azure Storage services as a means of communication.☆381Updated this week
- Weaponize signed .NET ClickOnce applications for initial access by hijacking a dependency DLL via AppDomainManager injection and loading …☆171Feb 14, 2026Updated 8 months ago
- Python and BOF utilites to the determine EPA enforcement levels of popular NTLM relay targets from the offensive perspective☆196May 31, 2026Updated 5 months ago
- Find Inbound Email Domains☆34Dec 21, 2023Updated 2 years ago
- Parses cached certificate templates from a Windows Registry file and displays them in the same style as Certipy does☆98Jul 3, 2025Updated last year
- Windows protocol library, including SMB and RPC implementations, among others.☆840Oct 5, 2026Updated 3 weeks ago
- Weaponized Browser-in-the-Middle (BitM) for Penetration Testers☆690Sep 18, 2026Updated last month
- SACL Scanner is a tool designed to scan and analyze SACLs.☆53Feb 13, 2025Updated last year
- Linker for Beacon Object Files☆193Oct 20, 2026Updated last week
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- Local SYSTEM auth trigger for relaying - X☆165Jul 23, 2025Updated last year
- Curated list of public Beacon Object Files(BOFs) build in as submodules for easy cloning☆140Jul 30, 2026Updated 3 months ago
- SharpSuccessor is a .NET Proof of Concept (POC) for fully weaponizing Yuval Gordon’s (@YuG0rd) BadSuccessor attack from Akamai.☆433Sep 26, 2025Updated last year
- Azure Post Exploitation Framework☆247Oct 27, 2025Updated last year
- A tool to modify SCCM remote control settings on the client machine, enabling remote control without permission prompts or notifications.…☆121Oct 20, 2024Updated 2 years ago
- Serverless AITM Simulation Framework for Entra ID and M365☆243Dec 29, 2025Updated 10 months ago
- TokenSmith generates Entra ID access & refresh tokens on offensive engagements. It is suitable for both covert adversary simulations and …☆423Jan 23, 2025Updated last year
- Automated Evilginx phishlet creator Extension for Burpsuite☆69Jan 10, 2025Updated last year
- BAADTokenBroker is a post-exploitation tool designed to interact with Microsoft Entra ID device-bound keys.☆82Apr 11, 2026Updated 6 months ago
- Simple, predictable pricing with DigitalOcean hosting • AdAlways know what you'll pay with monthly caps and flat pricing. Enterprise-grade infrastructure trusted by 600k+ customers.
- BOF for Kerberos abuse (an implementation of some important features of the Rubeus).☆623Nov 23, 2025Updated 11 months ago
- Disconnected RSAT - A method of running Group Policy Manager, Certificate Authority and Certificate Templates MMC snap-ins from non-domai…☆315Mar 28, 2026Updated 7 months ago
- ☆141Nov 17, 2025Updated 11 months ago
- A BOF that suspends non-GUI threads for a target process or resumes them resulting in stealthy process silencing.☆58Apr 14, 2025Updated last year
- A BloodHound collector for Microsoft Configuration Manager☆404Jul 7, 2025Updated last year
- Offensive GPO dumping and analysis tool that leverages and enriches BloodHound data☆431Oct 23, 2026Updated last week
- BOF with Synthetic Stackframe☆274Oct 30, 2025Updated last year