Phantom is project created to perform loading and executing unmanaged code in memory within an IIS environment running in full‑trust mode. Instead of relying on file‑based approach, it uses reflective loading techniques to inject and run a unmanaged DLL inside the memory space of the w3wp.exe worker pool process
☆106Jun 5, 2026Updated 3 months ago
Alternatives and similar repositories for Phantom
Users that are interested in Phantom are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A stealthier approach to WMI-based command execution using Impacket without touching the disk.☆86Mar 15, 2026Updated 6 months ago
- ASPX Web Shell with COFF Loader☆136Mar 10, 2026Updated 6 months ago
- Tailscale/Headscale C2 profile and agent for Mythic☆34Mar 14, 2026Updated 6 months ago
- Lnk crafting and research tools☆185Mar 4, 2026Updated 6 months ago
- .NET CLR-Stomping☆146May 20, 2026Updated 3 months ago
- End-to-end encrypted email - Proton Mail • AdSpecial offer: 40% Off Yearly / 80% Off First Month. All Proton services are open source and independently audited for security.
- Async BOF to automatically extract or renew Kerberos TGTs on a target system.☆135Jul 23, 2026Updated last month
- Evasive loader for .NET Framework assemblies☆51May 14, 2026Updated 4 months ago
- Random BOFs for LDAP tradecraft☆72Sep 9, 2025Updated last year
- Weaponize signed .NET ClickOnce applications for initial access by hijacking a dependency DLL via AppDomainManager injection and loading …☆168Feb 14, 2026Updated 7 months ago
- Bof of RegPwn by MDSec☆129Mar 15, 2026Updated 6 months ago
- DSCourier is a proof-of-concept that uses the WinGet Configuration COM API to apply DSC configurations through Microsoft-signed binaries.☆210Jun 25, 2026Updated 2 months ago
- ☆62Feb 12, 2026Updated 7 months ago
- Parses cached certificate templates from a Windows Registry file and displays them in the same style as Certipy does☆96Jul 3, 2025Updated last year
- Fritter is a heavily modified fork of TheWover and Odzhan's Donut shellcode generator.☆253Aug 4, 2026Updated last month
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Dump protected files (SAM,SYSTEM,SECURITY) by parsing the raw NTFS partition☆75Jul 18, 2026Updated 2 months ago
- C# to read WIM files over the network without transferring the whole file☆39Jan 22, 2026Updated 7 months ago
- DCOM in memory and fileless lateral movement techniques through .Net deserilization☆293Jun 22, 2026Updated 2 months ago
- BAADTokenBroker is a post-exploitation tool designed to interact with Microsoft Entra ID device-bound keys.☆82Apr 11, 2026Updated 5 months ago
- Bring your own Unwind Data Framework☆171Mar 15, 2026Updated 6 months ago
- UDC2 implementation that provides an ICMP C2 channel☆131Nov 24, 2025Updated 9 months ago
- C2-agnostic BOF collection, categorized by attack chain phase. Designed to be small and modular, allowing for quick execution and automat…☆317Aug 31, 2026Updated 2 weeks ago
- A Beacon Object File (BOF) that talks directly to Windows authentication packages through the LSA untrusted/trusted client interface, wit…☆296Feb 21, 2026Updated 6 months ago
- A Cobalt Strike RL built with Crystal Palac; module overloading, NtContinue entry transfer, call stack spoofing, sleep masking, and stati…☆256Mar 15, 2026Updated 6 months ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- Cobalt Strike UDC2 implementation that provides an Slack C2 channel☆69Jan 5, 2026Updated 8 months ago
- A Ligolo-ng JavaScript agent working inside Chrome & Chromium-based browsers by leveraging Isolated Web Applications.☆135Mar 30, 2026Updated 5 months ago
- One WSL BOF to rule them all☆189Jan 14, 2026Updated 8 months ago
- Manage Shadows Copies via the VSS API using C#, C++, Crystal or Python. Working on Windows 11☆86Jan 26, 2026Updated 7 months ago
- An alternative to the builtin clipboard feature in Cobalt Strike that adds the capability to enable/disable and dump the clipboard histor…☆117Apr 16, 2026Updated 5 months ago
- A collection of DPAPI hunting and parsing BOFs☆39Mar 3, 2026Updated 6 months ago
- Cobalt Strike BOF used to perform privilege escalation by exploiting the SeImpersonate privilege. Based on the original GodPotato PoC by …☆280Apr 16, 2026Updated 5 months ago
- ZigStrike, a powerful Payload Delivery Pipeline developed in Zig, offering a variety of injection techniques and anti-sandbox features.☆529Mar 7, 2026Updated 6 months ago
- MAPS cloud scanner and response parser for Microsoft Defender research.☆95Feb 19, 2026Updated 6 months ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- A Beacon Object File suite for Microsoft SQL Server that speaks TDS 7.4 on the wire itself☆100Apr 9, 2026Updated 5 months ago
- Windows Access token manipulation tool made in C#☆25Aug 24, 2025Updated last year
- Python and BOF utilites to the determine EPA enforcement levels of popular NTLM relay targets from the offensive perspective☆190May 31, 2026Updated 3 months ago
- ☆88Feb 12, 2026Updated 7 months ago
- A PoC UDRL for Cobalt Strike built with Crystal Palace that combines Raphael Mudge's page streaming technique with a modular call gate (D…☆139Jan 21, 2026Updated 7 months ago
- Conquest is a feature-rich and malleable command & control/post-exploitation framework developed in Nim.☆420Sep 3, 2026Updated 2 weeks ago
- A credential extraction BOF for Veeam Backup and Replication and Veeam One☆80Updated this week