Alternatives and similar repositories for calc_poc

Users that are interested in calc_poc are comparing it to the libraries listed below

• 0xjbb / vehspoof

  View on GitHub
  Callstack spoofing using a VEH because VEH all the things.
  ☆23Mar 18, 2025Updated 10 months ago
• gemini-security / GithubC2

  View on GitHub
  ☆27Nov 7, 2023Updated 2 years ago
• DominicBreuker / SliverSamples

  View on GitHub
  A collection of sample code used in some experiments with Sliver C2
  ☆16Mar 28, 2023Updated 2 years ago
• dmcxblue / NtCreateUserProcessBOF

  View on GitHub
  An Aggressor Script that utilizes NtCreateUserProcess to run binaries
  ☆30Jan 30, 2025Updated last year
• delivr-to / MailCollector

  View on GitHub
  A .NET 4.8 application to retrieve delivr.to emails from Microsoft Outlook via COM
  ☆20Jul 19, 2025Updated 6 months ago
• SolomonSklash / COM-Hijacking

  View on GitHub
  An example of COM hijacking using a proxy DLL.
  ☆44Aug 17, 2021Updated 4 years ago
• Maldev-Academy / TrapFlagForSyscalling

  View on GitHub
  Bypass user-land hooks by syscall tampering via the Trap Flag
  ☆139Aug 25, 2025Updated 5 months ago
• pracsec / AmsiScanner

  View on GitHub
  A tool for interacting with the Anti-Malware Scan Interface API for pen testing purposes.
  ☆66Oct 17, 2023Updated 2 years ago
• p4p1 / havoc-privkit

  View on GitHub
  a port of privkit bof for havoc
  ☆23Dec 8, 2023Updated 2 years ago
• fin3ss3g0d / IoDllProxyLoad

  View on GitHub
  DLL proxy load example using the Windows thread pool API, I/O completion callback with named pipes, and C++/assembly
  ☆63Mar 19, 2024Updated last year
• ColeHouston / theHandler-BOF

  View on GitHub
  Dump protected process memory by using BYOVD to tamper with handle objects in the kernel.
  ☆38Aug 5, 2025Updated 6 months ago
• Cipher7 / havoc-SauronEye

  View on GitHub
  ☆11Dec 8, 2023Updated 2 years ago
• Cobalt-Strike / udc2-vs

  View on GitHub
  User-Defined C2 BOF Template
  ☆27Nov 24, 2025Updated 2 months ago
• WMSR / utils

  View on GitHub
  ☆11Jun 9, 2020Updated 5 years ago
• S3cur3Th1sSh1t / NimWinstaEveryoneAccess

  View on GitHub
  ☆10Jan 17, 2022Updated 4 years ago
• synacktiv / windows_kernel_shadow_stack

  View on GitHub
  Proof of concepts demonstrating some aspects of the Windows kernel shadow stack mitigation.
  ☆53Jun 2, 2025Updated 8 months ago
• andreisss / Ghosting-AMSI

  View on GitHub
  Ghosting-AMSI
  ☆222Apr 24, 2025Updated 9 months ago
• bot984397 / eepy

  View on GitHub
  ☆38Apr 15, 2025Updated 9 months ago
• t3hbb / citrixphishlet

  View on GitHub
  Citrix Phishlet
  ☆24Feb 2, 2021Updated 5 years ago
• V3ded / ToolDump-v1

  View on GitHub
  Some of my custom "tools".
  ☆28Feb 21, 2022Updated 3 years ago
• ShutdownRepo / GeoWordlists

  View on GitHub
  GeoWordlists is a tool to generate wordlists of passwords containing cities at a defined distance around the client city.
  ☆11Nov 24, 2023Updated 2 years ago
• redteamronin / EmbedInHTML

  View on GitHub
  ☆17Jan 9, 2025Updated last year
• jxroot / PhishTrap

  View on GitHub
  ⚔️ Red Team tools for capturing credentials & planting payloads using native Windows features.
  ☆10Jan 25, 2026Updated 2 weeks ago
• C5Hackr / ARM64_AmsiPatch

  View on GitHub
  ☆21Jan 8, 2026Updated last month
• ChoiSG / bin2sideload

  View on GitHub
  ☆11Nov 12, 2023Updated 2 years ago
• jakabakos / CVE-2017-9096-iText-XXE

  View on GitHub
  ☆13May 18, 2022Updated 3 years ago
• ChoiSG / havoc2nginx

  View on GitHub
  havoc2nginx is a simple python script that converts Havoc Framework's yaotl malleable c2 profile to Nginx configuration file format. Most…
  ☆12May 8, 2023Updated 2 years ago
• RevoltSecurities / RAI

  View on GitHub
  ☆19Jul 23, 2025Updated 6 months ago
• jthuraisamy / crx-packer

  View on GitHub
  CLI Chrome Extension (CRX) Packer written in Python
  ☆16Nov 2, 2013Updated 12 years ago
• keyboardcrunch / sentinelone_usbscan

  View on GitHub
  A custom SentinelOne USB scanner.
  ☆18Mar 26, 2022Updated 3 years ago
• jnqpblc / SharpReg

  View on GitHub
  SharpReg is a simple code set to interact with the Remote Registry service api and is compatible with Cobalt Strike.
  ☆28Apr 12, 2020Updated 5 years ago
• HulkOperator / CallStackSpoofer

  View on GitHub
  ☆61Dec 19, 2024Updated last year
• kozmer / sigdream

  View on GitHub
  sigreturn-oriented programming (SROP) based sleep obfuscation poc for Linux
  ☆63Dec 15, 2025Updated last month
• EvilBytecode / Lifetime-AmsiBypass

  View on GitHub
  Lifetime AMSI bypass.
  ☆36Apr 21, 2025Updated 9 months ago
• DarkSpaceSecurity / DocEx

  View on GitHub
  APT Emulation tool to exfiltrate sensitive .docx, .pptx, .xlsx, .pdf files
  ☆96Apr 2, 2025Updated 10 months ago
• d419h / IconJector

  View on GitHub
  Inject DLLs into the explorer process using icons
  ☆403May 18, 2025Updated 8 months ago
• mdsecactivebreach / TakeATest

  View on GitHub
  ☆19Mar 9, 2021Updated 4 years ago
• mubix / redteam-collab

  View on GitHub
  Red Team Collaboration Infrastructure
  ☆98Apr 24, 2025Updated 9 months ago
• shantanu561993 / ParentProcessIDSpoof

  View on GitHub
  Spoof parent process ID
  ☆13Jan 23, 2019Updated 7 years ago