A collection of techniques for process injection on Windows
☆105Aug 16, 2026Updated 2 months ago
Alternatives and similar repositories for windows-process-injection
Users that are interested in windows-process-injection are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A proof of concept that makes a Windows syscall look like it came from a legitimate Windows thread pool, with no trace of your own code a…☆15Jul 15, 2026Updated 3 months ago
- Novel lateral movement and privilege escalation tool leveraging PowerShell named pipes. Allows for executing PowerShell commands over the…☆26Oct 8, 2026Updated 3 weeks ago
- Runtime Credential Guard deactivation via \\LSA_ISO_DISABLE_CREDENTIAL_GUARD + LSASS NT hash extraction (Win11 24H2)☆108Oct 27, 2026Updated last week
- Custom Adaptix-compatible C2 agent - PIC beacon + Stardust UDRL + Go extender plugins☆154Oct 29, 2026Updated last week
- A Position Independent Code (PIC) implementation of the execute-assembly command built with Crystal Palace.☆22Oct 4, 2026Updated last month
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- P³-Shellcode Loader is a loader that implements a code injection technique which leverages the Process Parameters structure as an executi…☆247Jul 8, 2026Updated 3 months ago
- A stealthy process injection PoC combining Thread Name-Calling for payload delivery with Waiting Thread Hijacking for execution, with zer…☆140Oct 30, 2026Updated last week
- Demonstration of the DLL party process injection technique☆99Oct 1, 2026Updated last month
- ☆72Jul 12, 2026Updated 3 months ago
- Proof of Concept for Process Code Injection Without Using WriteProcessMemory☆160Sep 27, 2026Updated last month
- a minimal, position-independent C shellcode framework for Windows x64. compiles entirely on Linux☆70Aug 1, 2026Updated 3 months ago
- Remote process injection via TP_DIRECT.Callback hijack☆41Oct 30, 2026Updated last week
- A Proof of Concept demonstrating CET-compliant callstack spoofing in Rust. It leverages Windows Thread Pool and Enum Callback trampolinin…☆72Jul 12, 2026Updated 3 months ago
- a short script to make my life easy : ) nothing more☆13Jul 6, 2026Updated 4 months ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Windows x64 API hashing library that bypasses EAF and resolves forwarded exports, ordinals, and api-ms-*/ext-ms-* API Set DLLs.☆70Oct 7, 2026Updated last month
- Malware as a Service Ludus Range☆143Sep 24, 2026Updated last month
- BingusLdr is a DLL loader built with Crystal Palace that uses a CET compatible stack spoofing technique.☆117Jul 14, 2026Updated 3 months ago
- Kernel-mode process terminator using a signed BYOVD driver. Works on all Windows 10/11. No offsets, no PDB. Rust.☆112Oct 27, 2026Updated last week
- Research notes on Windows Component Object Model (COM) attack surface for offensive security and vulnerability research. Covers COM hijac…☆165Jul 20, 2026Updated 3 months ago
- ☆37May 19, 2026Updated 5 months ago
- A minimized non-intrusive version of EDR Introspection☆46Jun 30, 2026Updated 4 months ago
- Hidden Desktop Plugin For Havoc C2,Soon coming for Sliver.☆265Sep 29, 2026Updated last month
- Python scripts that helps in the development of PPKG binaries☆16Jul 31, 2026Updated 3 months ago
- Simple, predictable pricing with DigitalOcean hosting • AdAlways know what you'll pay with monthly caps and flat pricing. Enterprise-grade infrastructure trusted by 600k+ customers.
- SmuggleMyPayload generates HTML pages that embed and reconstruct files client-side using JavaScript. The toolkit offers multiple HTML Smu…☆57Oct 13, 2026Updated 3 weeks ago
- Crystal Palace Evasion kit for Sliver☆126Jun 13, 2026Updated 4 months ago
- Another Injection Technique which eliminates creations of thread in remote process☆29Jul 7, 2026Updated 4 months ago
- krbrelayx fork that defeats enforced SMB signing on an SMB relay (opt-in --reauth-bypass).☆80Oct 21, 2026Updated 2 weeks ago
- technical analysis of a steganographic loader (Crypters and Tools) used by likely-TA558 to deliver various malware in Italy and Colombia☆14Aug 18, 2025Updated last year
- A PoC of User-Defined Reflective Loader for Havoc Framework built with Cystal Palace☆49Oct 18, 2026Updated 2 weeks ago
- A PoC tool for the Pass-ta-key Golden Attack, covering the extraction of the Google Password Manager Security Domain Secret from Chrome p…☆35Updated this week
- Clean Indirect Syscalls with Hook Evasion & Return Address Spoofing.☆101Apr 30, 2026Updated 6 months ago
- Collection of reversed vulnerable drivers weaponized into process killers. PPL won't save you.☆115Oct 18, 2026Updated 2 weeks ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Cobalt Strike BOF☆58Dec 10, 2025Updated 10 months ago
- ☆74Oct 27, 2026Updated last week
- Beacon Object File (BOF) to coerce machine account auth via IPP.☆98Updated this week
- POC Utilizing the new SleepMask-VS kit to utilize RC4 encryption.☆12Mar 4, 2025Updated last year
- ☆88Sep 21, 2026Updated last month
- Code and data for our paper "Onelogon: Taking over Active Directory Accounts via Netlogon" (WOOT’26).☆129Sep 1, 2026Updated 2 months ago
- Gain shellcode execution via T4 Text Transform files/TextTransoform.exe☆87Oct 23, 2026Updated 2 weeks ago