A stealthy process injection PoC combining Thread Name-Calling for payload delivery with Waiting Thread Hijacking for execution, with zero cross-process writes.

krbrelayx fork that defeats enforced SMB signing on an SMB relay (opt-in --reauth-bypass).

Active Directory DACL collector and interactive graph viewer

Master programming by recreating your favorite technologies from scratch.

Execless Linux Enumeration Script

A full Capcom.sys writeup which features an Arbitrary overwrite technique, The main problem that made the driver popular was that it disabled SMEP.

Repository for various Beacon Object Files (BOFs)

Collection of reversed vulnerable drivers weaponized into process killers. PPL won't save you.

Post-Exploitation EVTX Analyzer for BloodHound Mapping

Mirage is a PoC memory evasion technique that relies on a vulnerable VBS enclave to hide shellcode within VTL1.

Trail of Bits skills for security research, vulnerability detection, and audit workflows

Novel lateral movement and privilege escalation tool leveraging PowerShell named pipes. Allows for executing PowerShell commands over the network using named pipes, and taking over highly privilege…

Search for Organisations, ASNs and Networks in a local Whois database (RIPE/APNIC/AfriNIC)

A poor man's attempt to replicate the shellcode execution technique demo'd by @3lk during STHACK 2026 (https://www.youtube.com/watch?v=alRgpv-czyk)

JA4+ is a suite of network fingerprinting standards

MDE (EDR) for Linux Silencer

OWASP CRS (Official Repository)

Study trackers, Obsidian prep vaults, practice boxes and resources for Hack The Box certs: CJCA, CPTS, CWES, CDSA, CWEE, CAPE, CWPE, COAE and CDEP. Each cert gets a day-by-day plan, a ready-made no…

Cobalt Strike BOF that extracts selected Windows registry hives directly from a raw NTFS volume by parsing NTFS metadata and reading file data straight from disk.

Malware as a Service Ludus Range

A python proof of concept tool to assist in your payloads classification against EDR/AV's machine learning models

Modified BloodHound.py CE ingestor for red team use. Obfuscates LDAP through ldapx, paces LDAP searches and host RPC, and resumes a stopped collection. Writes BloodHound CE JSON.

ARES - authorized red-team engagement automation with dashboard, campaign scope, module orchestration, OPSEC controls, encrypted vault, and reporting.

Reverse engineer anything with agents, from app behavior down to native binaries.

Demonstration of the DLL party process injection technique

Open-source, self-hosted AI vulnerability research tool that orchestrates agents to find and validate security issues in code.

Visa Vulnerability Agentic Harness

Abliteration without the weights — projective refusal steering as a GLP vector + fail-closed boot hotfix.

Use LLMs to find the needles in your haystack

Linux-first multi-operator C2 built to stay quiet and keep working. Self-healing mesh with assisted discovery, in-memory execution with encrypted storage, scriptable agents, cross-platform BOFs, SO…