Phantom is project created to perform loading and executing unmanaged code in memory within an IIS environment running in full‑trust mode. Instead of relying on file‑based approach, it uses reflective loading techniques to inject and run a unmanaged DLL inside the memory space of the w3wp.exe worker pool process
☆108Jun 5, 2026Updated 4 months ago
Alternatives and similar repositories for Phantom
Users that are interested in Phantom are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A stealthier approach to WMI-based command execution using Impacket without touching the disk.☆88Mar 15, 2026Updated 7 months ago
- ASPX Web Shell with COFF Loader☆137Mar 10, 2026Updated 7 months ago
- Lnk crafting and research tools☆187Mar 4, 2026Updated 7 months ago
- Weaponize signed .NET ClickOnce applications for initial access by hijacking a dependency DLL via AppDomainManager injection and loading …☆171Feb 14, 2026Updated 8 months ago
- .NET CLR-Stomping☆148May 20, 2026Updated 5 months ago
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- Random BOFs for LDAP tradecraft☆74Sep 9, 2025Updated last year
- Parses cached certificate templates from a Windows Registry file and displays them in the same style as Certipy does☆98Jul 3, 2025Updated last year
- Bof of RegPwn by MDSec☆129Mar 15, 2026Updated 7 months ago
- Async BOF to automatically extract or renew Kerberos TGTs on a target system.☆138Jul 23, 2026Updated 3 months ago
- DSCourier is a proof-of-concept that uses the WinGet Configuration COM API to apply DSC configurations through Microsoft-signed binaries.☆209Jun 25, 2026Updated 4 months ago
- ☆63Feb 12, 2026Updated 8 months ago
- Fritter is a heavily modified fork of TheWover and Odzhan's Donut shellcode generator.☆259Aug 4, 2026Updated 2 months ago
- BingusLdr is a DLL loader built with Crystal Palace that uses a CET compatible stack spoofing technique.☆116Jul 14, 2026Updated 3 months ago
- BAADTokenBroker is a post-exploitation tool designed to interact with Microsoft Entra ID device-bound keys.☆82Apr 11, 2026Updated 6 months ago
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- Evasive loader for .NET Framework assemblies☆53May 14, 2026Updated 5 months ago
- A PoC UDRL for Cobalt Strike built with Crystal Palace that combines Raphael Mudge's page streaming technique with a modular call gate (D…☆140Jan 21, 2026Updated 9 months ago
- Tailscale/Headscale C2 profile and agent for Mythic☆34Mar 14, 2026Updated 7 months ago
- Cobalt Strike BOF used to perform privilege escalation by exploiting the SeImpersonate privilege. Based on the original GodPotato PoC by …☆283Apr 16, 2026Updated 6 months ago
- C# to read WIM files over the network without transferring the whole file☆40Jan 22, 2026Updated 9 months ago
- DCOM in memory and fileless lateral movement techniques through .Net deserilization☆295Jun 22, 2026Updated 4 months ago
- Passive backdoor implant that sniffs for a covert magic-packet trigger and runs tasks written in a custom 23-opcode bytecode command lang…☆57Aug 26, 2026Updated 2 months ago
- A Beacon Object File (BOF) that talks directly to Windows authentication packages through the LSA untrusted/trusted client interface, wit…☆298Feb 21, 2026Updated 8 months ago
- A Cobalt Strike RL built with Crystal Palac; module overloading, NtContinue entry transfer, call stack spoofing, sleep masking, and stati…☆263Mar 15, 2026Updated 7 months ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- Python and BOF utilites to the determine EPA enforcement levels of popular NTLM relay targets from the offensive perspective☆195May 31, 2026Updated 4 months ago
- C2-agnostic BOF collection, categorized by attack chain phase. Designed to be small and modular, allowing for quick execution and automat…☆319Oct 17, 2026Updated last week
- InfraGuard is a Command & Control Redirection Proxy and Manager which protects your Red Team Infrastructure against threat attribution☆328Oct 22, 2026Updated last week
- Dump protected files (SAM,SYSTEM,SECURITY) by parsing the raw NTFS partition☆76Jul 18, 2026Updated 3 months ago
- One WSL BOF to rule them all☆190Jan 14, 2026Updated 9 months ago
- Cobalt Strike UDC2 implementation that provides an Slack C2 channel☆70Jan 5, 2026Updated 9 months ago
- Erebus is an Initial Access wrapper for the Mythic Command & Control Server. It converts shellcode into payloads specifically used for ph…☆235Sep 13, 2026Updated last month
- UDC2 implementation that provides an ICMP C2 channel☆132Nov 24, 2025Updated 11 months ago
- A Ligolo-ng JavaScript agent working inside Chrome & Chromium-based browsers by leveraging Isolated Web Applications.☆139Mar 30, 2026Updated 6 months ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Windows Access token manipulation tool made in C#☆25Aug 24, 2025Updated last year
- A credential extraction BOF for Veeam Backup and Replication and Veeam One☆82Sep 16, 2026Updated last month
- Bring your own Unwind Data Framework☆178Mar 15, 2026Updated 7 months ago
- WasmForge — compile Go and C# programs to single-binary, WASM-sandboxed native executables with polymorphic output.☆134Jun 24, 2026Updated 4 months ago
- The ADSyncDump BOF is a port of Dirk-Jan Mollema's adconnectdump.py / ADSyncDecrypt into a Beacon Object File (BOF) with zero dependencie…☆183Sep 3, 2025Updated last year
- Manage Shadows Copies via the VSS API using C#, C++, Crystal or Python. Working on Windows 11☆88Jan 26, 2026Updated 9 months ago
- ☆37May 19, 2026Updated 5 months ago