Alternatives and similar repositories for Windows-Internals-Learning-Resources:

Users that are interested in Windows-Internals-Learning-Resources are comparing it to the libraries listed below

• OtterHacker / Hooker
  ☆105Updated 5 months ago
• YoavLevi / IAT-Tracer
  An automation plugin for Tiny-Tracer framework to trace and watch functions directly out of the executable's import table or trace logs (…
  ☆116Updated 9 months ago
• jsecurity101 / ETWInspector
  ☆156Updated 11 months ago
• SafeBreach-Labs / MagicDot
  A set of rootkit-like abilities for unprivileged users, and vulnerabilities based on the DOT-to-NT path conversion known issue
  ☆98Updated last year
• ViperXSecurity / lib-nosa
  lib-nosa is a minimalist C library designed to facilitate socket connections through AFD driver IOCTL operations on Windows.
  ☆109Updated 7 months ago
• exploits-forsale / 24h2-nt-exploit
  Exploit targeting NT kernel in 24H2 Windows Insider Preview
  ☆129Updated 11 months ago
• zodiacon / Recon2023
  Recon 2023 slides and code
  ☆79Updated last year
• ioncodes / SilentLoad
  "Service-less" driver loading
  ☆151Updated 4 months ago
• 0xsch1zo / NullGate
  Library that eases the use of indirect syscalls. Quite interesting AV/EDR bypass as PoC.
  ☆92Updated this week
• CICADA8-Research / MyMSIAnalyzer
  Analyse MSI files for vulnerabilities
  ☆129Updated 7 months ago
• sensepost / mydumbedr
  ☆117Updated last year
• FuzzySecurity / BHUSA-2023
  ☆105Updated 9 months ago
• rad9800 / FileRenameJunctionsEDRDisable
  ☆154Updated 4 months ago
• struppigel / hedgehog-tools
  ☆113Updated 2 months ago
• rtfmkiesel / loldrivers-client
  Scan your computer for known vulnerable and known malicious Windows drivers using loldrivers.io
  ☆82Updated last year
• ColeHouston / Sunder
  Windows rootkit designed to work with BYOVD exploits
  ☆183Updated 3 months ago
• hackerhouse-opensource / WMIProcessWatcher
  A CIA tradecraft technique to asynchronously detect when a process is created using WMI.
  ☆134Updated last year
• 20urc3 / Aplos
  Aplos an extremely simple fuzzer for Windows binaries.
  ☆68Updated 2 months ago
• 0xHossam / KernelCallbackTable-Injection-PoC
  Proof of Concept for manipulating the Kernel Callback Table in the Process Environment Block (PEB) to perform process injection and hijac…
  ☆212Updated 5 months ago
• synacktiv / keebcap
  Win32 keylogger that supports all (non-ime using) languages correctly
  ☆49Updated last year
• V-i-x-x / kernel-callback-removal
  kernel callback removal (Bypassing EDR Detections)
  ☆161Updated last month
• jsecurity101 / PowerParse
  PowerShell PE Parser
  ☆62Updated 9 months ago
• daem0nc0re / SharpWnfSuite
  C# Utilities for Windows Notification Facility
  ☆150Updated last week
• Maldev-Academy / RemoteTLSCallbackInjection
  Utilizing TLS callbacks to execute a payload without spawning any threads in a remote process
  ☆257Updated last year
• TierZeroSecurity / edr_blocker
  Blocks EDR Telemetry by performing Person-in-the-Middle attack where network filtering is applied using iptables. The blocked destination…
  ☆141Updated 9 months ago
• thefLink / Hunt-Weird-Syscalls
  ETW based POC to identify direct and indirect syscalls
  ☆186Updated 2 years ago
• floesen / KExecDD
  Admin to Kernel code execution using the KSecDD driver
  ☆244Updated last year
• synacktiv / DLHell
  Local & remote Windows DLL Proxying
  ☆164Updated 10 months ago
• Dor00tkit / CVE-2024-30090
  CVE-2024-30090 - LPE PoC
  ☆106Updated 6 months ago
• fin3ss3g0d / StoneKeeper
  StoneKeeper C2, an experimental EDR evasion framework for research purposes
  ☆198Updated 3 months ago