A curated list of awesome LOLBins, GTFO projects, and similar 'Living Off the Land' security resources.
☆218Jul 11, 2026Updated 3 months ago
Alternatives and similar repositories for awesome-lolbins-and-beyond
Users that are interested in awesome-lolbins-and-beyond are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- an Improoved Version of 0xNinjaCyclone´s EarlyCascade Code☆22Feb 20, 2025Updated last year
- ☆60Oct 24, 2024Updated 2 years ago
- A self-hosted sandbox for red teams to test payloads against modern detection before deployment. MCP integration lets an LLM agent drive …☆1,557May 5, 2026Updated 5 months ago
- Collect Windows telemetry for Maldev☆513Aug 14, 2026Updated 2 months ago
- Simulate the behavior of AV/EDR for malware development training.☆565Feb 15, 2024Updated 2 years ago
- Proton VPN Special Offer - Get 70% off • AdSpecial partner offer. Trusted by over 100 million users worldwide. Tested, Approved and Recommended by Experts.
- Python scripts that helps in the development of PPKG binaries☆14Jul 31, 2026Updated 3 months ago
- ☆60Mar 28, 2026Updated 7 months ago
- BOF that finds all the Nt* system call stubs within NTDLL and overwrites with clean syscall stubs (user land hook evasion)☆219Feb 6, 2025Updated last year
- This tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone…☆217Oct 19, 2024Updated 2 years ago
- C2 writen in Rust & Go powered by Tor network.☆163Oct 30, 2025Updated last year
- A harmless Netcat-lookalike for detection testing. Simulates NC-style command-line flags and listener behavior without exposing a real ba…☆37Nov 27, 2025Updated 11 months ago
- lolC2 is a collection of C2 frameworks that leverage legitimate services to evade detection☆346Jul 22, 2026Updated 3 months ago
- Automated DLL Hijacking Discovery, Validation, and Confirmation. Turning local misconfigurations into weaponized, confirmed attack paths.☆410Sep 17, 2026Updated last month
- ☆175May 21, 2026Updated 5 months ago
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- This repository contains detailed adversary simulation APT campaigns targeting various critical sectors. Each simulation includes custom …☆1,159Updated this week
- Living off the land searches for explorer and sharepoint☆107Jul 30, 2026Updated 3 months ago
- Ghosting-AMSI☆251Apr 24, 2025Updated last year
- 🔥📜 Forbidden collection of Red Team sorcery 📜🔥☆422Mar 23, 2026Updated 7 months ago
- AWS SSO Device-Code Phishing Toolkit for Red / Purple Teams☆23Mar 10, 2026Updated 7 months ago
- Version 2 - A modern 64-bit position independent meterpreter and Sliver compatible reverse_TCP Staging Shellcode based on Cracked5piders …☆102Mar 27, 2025Updated last year
- Windows Shell Link (LNK) Proof of Concept☆16Jul 19, 2025Updated last year
- Memory API proxy via signed mozglue.dll☆41Jun 25, 2026Updated 4 months ago
- LOLESXi is a curated compilation of binaries/scripts available in VMware ESXi that are were used to by adversaries in their intrusions. T…☆157Jul 25, 2026Updated 3 months ago
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- Abusing Azure services over C2☆383Jan 20, 2026Updated 9 months ago
- This technique leverages PowerShell's .NET interop layer and COM automation to achieve stealthy command execution by abusing implicit typ…☆54May 16, 2025Updated last year
- Lab used for workshop and CTF☆541Updated this week
- ZigStrike, a powerful Payload Delivery Pipeline developed in Zig, offering a variety of injection techniques and anti-sandbox features.☆530Mar 7, 2026Updated 7 months ago
- Shadow Dumper is a powerful tool used to dump LSASS memory, often needed in penetration testing and red teaming. It uses multiple advance…☆592May 22, 2025Updated last year
- A tool that allows you to extract a client-specific wordlist from the LDAP of an Active Directory.☆61Oct 9, 2026Updated 3 weeks ago
- Dump lsass using only NTAPI functions creating 3 JSON and 1 ZIP file... and generate the MiniDump file later!☆611Aug 17, 2026Updated 2 months ago
- ☆37Sep 6, 2026Updated last month
- ☆166May 5, 2025Updated last year
- GPUs on demand by Runpod - Special Offer Available • AdRun AI, ML, and HPC workloads on powerful cloud GPUs—without limits or wasted spend. Deploy GPUs in under a minute and pay by the second.
- PowerShell tool that shows how to read and write NTLM OWF values via samlib.dll.☆75Oct 22, 2025Updated last year
- Kooky cURL-powered replacement for reverse shell via /dev/tcp☆83Oct 22, 2026Updated last week
- This comprehensive process injection series is crafted for cybersecurity enthusiasts, researchers, and professionals who aim to stay at t…☆469Jun 10, 2026Updated 4 months ago
- Work, timer, and wait callback example using solely Native Windows APIs.☆88Feb 11, 2024Updated 2 years ago
- ☆91May 15, 2024Updated 2 years ago
- Small toolkit for extracting information and dumping sensitive strings from Windows processes☆116Jul 17, 2024Updated 2 years ago
- Go (formerly PowerShell) collector for adding MSSQL attack paths to BloodHound with OpenGraph☆348Jul 10, 2026Updated 3 months ago