Tylous

SniffAir. A framework for wireless pentesting.

SourcePoint. SourcePoint is a C2 profile generator for Cobalt Strike command and control servers designed to ensure evasion.

ZipExec. A unique technique to execute binaries from a password protected zip

Limelighter. A tool for generating fake code signing certificates or signing real ones

FaceDancer. FaceDancer is an exploitation tool aimed at creating hijackable, proxy-based DLLs by taking advantage of COM-based system DLL image loading

ScareCrow. ScareCrow - Payload creation framework designed around EDR bypass.

Vibe. A framework for stealthy domain reconnaissance

Freeze.rs. Freeze.rs is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls written in RUST

Freeze. Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods

Mangle. Mangle is a tool that manipulates aspects of compiled executables (.exe or DLL) to avoid detection from EDRs

Auto_EAP. Automated Brute-Force Login Attacks Against EAP Networks.

Talon. A password guessing tool that targets the Kerberos and LDAP services within the Windows Active Directory environment.

Slides.

Ivy. Ivy is a payload creation framework for the execution of arbitrary VBA (macro) source code directly in memory. Ivy’s loader does this by utilizing programmatical access in the VBA object environment to load, decrypt and execute shellcode.

GraphRunner. A Post-exploitation Toolset for Interacting with the Microsoft Graph API

Dent. A framework for creating COM-based bypasses utilizing vulnerabilities in Microsoft's WDAPT sensors.

File-Smuggling. HTML smuggling is not an evil, it can be useful

PackMyPayload. A PoC that packages payloads into output containersb to evade Mark-of-the-Web flag & demonstrate risks associated with container file formats. Supports: ZIP, 7zip, PDF, ISO, IMG, CAB, VHD, VHDX

build_a_phish. Ansible playbook to deploy a phishing engagement

SysWhispers3. SysWhispers on Steroids - AV/EDR evasion via direct system calls.

SharpAllTheThings. The idea is to collect all the C# projects that are Sharp{Word} that can be used in Cobalt Strike as execute assembly command.

SharpCollection. Nightly builds of common C# offensive tools, fresh from their respective master branches built and released in a CDI fashion using Azure DevOps release pipelines.

PECheck. A tool to verify and create PE Checksums for Portable Executable (PE) files.

rustdesk-hvnc. HVNC based on RustDesk

Scapy-com. Forked extended scapy version

InlineExecute-Assembly. InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module

cs-tools. cobalt strike tools

File-Tunnel. Tunnel TCP connections through a file

AzureAttackKit. Collection of Azure Tools to Pull down for Attacking an Env

spoolsystem. Print Spooler Named Pipe Impersonation for Cobalt Strike

PetitPotam. PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw or other functions.

EvilnoVNC. Ready to go Phishing Platform

Dockerfiles. My collection of dockerfiles

TREVORspray. TREVORspray is a modular password sprayer with threading, clever proxying, loot modules, and more!

slurp. The original slurp source

evilginx2. Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

gofalcon. Golang-based SDK to CrowdStrike's APIs