Ceri Coburn

SweetPotato. Local Service to SYSTEM privilege escalation from Windows 7 to Windows 10 / Server 2019

SharpBlock. A method of bypassing EDR's active projection DLL's by preventing entry point exection

BeaconEye. Hunts out CobaltStrike beacons and logs operator command output

ThreadlessInject. Threadless Process Injection using remote function hooking.

BOF.NET. A .NET Runtime for Cobalt Strike's Beacon Object Files

lsarelayx. NTLM relaying for Windows made easy

Volumiser. C#

okta-terrify. Okta Verify and Okta FastPass Abuse Tool

DRSAT. Disconnected RSAT - A method of running Group Policy Manager, Certificate Authority and Certificate Templates MMC snap-ins from non-domain joined machies

MirrorDump. Another LSASS dumping tool that uses a dynamically compiled LSA plugin to grab an lsass handle and API hooking for capturing the dump in memory

MinHook.NET. A C# port of the MinHook API hooking library

gssapi-abuse. A tool for enumerating potential hosts that are open to GSSAPI abuse within Active Directory networks

SylantStrike. Simple EDR implementation to demonstrate bypass

goreflect. Reflective DLL loading of your favorite Golang program

Shwmae. C#

dnMerge. A lightweight .NET assembly dependency merger that uses dnLib and 7zip's LZMA SDK for compressing dependant assemblies.

PIVert. C#

PinSwipe. Smart Card PIN swiping DLL

PwnyForm. C#

gookies. A Chrome cookie dumping utility

ProvisionAppx. C#

bittrex4j. Java library for accessing the Bittrex Web API's and Web Sockets

PoC. Exploit PoC for CVE's and non CVE's alike

SQL-BOF. Library of BOFs to interact with SQL servers

Jboss-Wilfly-Hashes-to-Hashcat. Converts JBoss/Wildfly management users properties file to hashcat format compatible with mode 20

chlonium. Chromium Cookie import / export tool

Rubeus. Trying to tame the three-headed dog.

InlineExecute-Assembly. InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module

VulnHub. VulnHub Walkthroughs

sandbox-attacksurface-analysis-tools. Set of tools to analyze Windows sandboxes for exposed attack surface.

gocrack. GoCrack is a management frontend for password cracking tools written in Go

nmap. Nmap - the Network Mapper. Github mirror of official SVN repository.

metasploit-framework. Metasploit Framework

Certify. Active Directory certificate abuse.

nodebb-plugin-onesignal. Allows NodeBB to interface with the OneSignal service in order to provide push notifications via OneSignal, originally forked from nodebb-plugin-pushbullet

MediaPortal-AsteriskCid. C#

impacket. Impacket is a collection of Python classes for working with network protocols.

signalr-java-client. Java

SharpView. C# implementation of harmj0y's PowerView

JCAlgTest. Automated testing tool for algorithms from JavaCard API supported by particular smart card. Performance testing of almost all available methods. The results for more than 60+ cards.