Jean-François Maes

LazySign. Create fake certs for binaries using windows binaries and the power of bat files

SharpZipRunner. Executes position independent shellcode from an encrypted zip

Invoke-DLLClone. Koppeling x Metatwin x LazySign

SharpHandler. C#

AmsiHooker. Hookers are cooler than patches.

GG-AESY. Hide cool stuff in images :)

TrustJack. Yet another PoC for https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows

phisherman. A real fake social engineering app

SharpNukeEventLog. nuke that event log using some epic dinvoke fu

SharpLNKGen-UI. UI for creating LNKs

Backdoorplz. adding a backdooruser using win32api

DeepSleep. all credits go to @mgeeky

Red-EC2. Spin up RedTeam infrastructure on AWS via Ansible

aws_mini_ad. An Infrastructure as code proof of concept to deploy a bare minimum AD environment in AWS.

CSharpReflectionWorkshop. The repository that complements the From zero to hero: creating a reflective loader in C# workshop

Clippi-B. C#

CMDLL. the most basic DLL ever to pop a cmd.

Ansible-EmpireSuite. ansible roles to download and install empire (BC-Security),deathstar(byt3bl33der) and starkiller (BC-Security)

FunWithServerless. Python

Emulation-Workshop. The repository accompanying the Buer Emulation workshop

awesome-ai-workflow. opinionated workflow on LLM driven development.

Red-Route53-Interactive.

talks-cons. aggregated repo for all conferences and talks I am giving

downloadfix. inspired by mr d0x filefix

Ansible-Cobalt-Strike. An Ansible role to install cobalt-strike

Parsers. parsers to make life easier

SharpXOR. XOR crypt/decrypt using C#

blogposts-talks-and-tidbits. all random stuff that dont warrant a seperate repo

DRegHide. fun stuff with null bytes and dinvoke

SEC565-Tools. PowerShell

sharpbysentinel. lol firewall

maldev-for-dummies. A workshop about Malware Development

SilverRAT-FULL-Source-Code. This project contains an open source RAT (Remote Access Trojan).

x33fcon-workshop. PowerShell

NerveGas. messing around with ETW in C#

RegFetch. Interfaces with winsockets to fetch a txt file, parses the file and changes the registry accordingly

DInvoke. Dynamically invoke arbitrary unmanaged code from managed code without PInvoke.

WinAPI-Tricks. Collection of various WINAPI tricks / features used or abused by Malware

PowerUpSQL. PowerUpSQL: A PowerShell Toolkit for Attacking SQL Server

Ransomware-Database. For educational purposes only, samples of ransomware/wiper trojans including screenshots/ransom-notes.

EDRSandblast-GodFault. EDRSandblast-GodFault

byor. Go

PyFuscation. Obfuscate powershell scripts by replacing Function names, Variables and Parameters.

Get-ServiceACL. courtesey of a gist I found on github

poc. Proof of Concepts

ragnarok. the only rag you'll ever need.