Lee Chagolla-Christensen

carnac. A utility to give some insight into how you use your keyboard

Blackfyre. Python

sddl_py. Parse SDDL strings

systeminformer. A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ https://windows-internals.com

LazyGhidra. Make your Ghidra Lazy!

MSLab. Azure Local (formerly Azure Stack HCI), Windows 10 and Windows Server rapid lab deployment scripts

windbg_js_scripts. Toy scripts for playing with WinDbg JS API

Kerberos.NET. A Kerberos implementation built entirely in managed code.

Windows-Internals. My repository to upload drivers from different books and all the information related to windows internals.

algo. Set up a personal VPN in the cloud

ADACLScanner. Repo for ADACLScan.ps1 - Your number one script for ACL's in Active Directory

Internal-Monologue. Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS

HELK. The Hunting ELK

DriverMon. Monitor activity of any driver

PoshPrivilege. Manage user privileges on a local machine or view applied privileges on local or remote system

sRDI. Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode

sandbox-attacksurface-analysis-tools. Set of tools to analyze Windows sandboxes for exposed attack surface.

kerberos_windows_scripts. Collection of scripts for interacting with AD Kerberos from Linux

IRPMon. The goal of the tool is to monitor requests received by selected device objects or kernel drivers. The tool is quite similar to IrpTracker but has several enhancements. It supports 64-bit versions of Windows (no inline hooks are used, only moodifications to driver object structures are performed) and monitors IRP, FastIo, AddDevice, DriverUnload and StartIo requests.

roslyn-security-guard. Roslyn analyzers that aim to help security audit on .NET applications.

AD-control-paths. Active Directory Control Paths auditing and graphing tools

gitrob. Reconnaissance tool for GitHub organizations

regex2dfa. Convert regular expressions to minimized DFAs in AT&T FST format.

InjectModuleInitializer. Console program and nuget package to inject a module initializer method into a built .NET assembly

PowershellProfiler. PowerShell

PoshInternals. A pure script-based PowerShell module that provides deep system analysis and configuration.

gobuster. Directory/File, DNS and VHost busting tool written in Go

DSInternals. Directory Services Internals (DSInternals) PowerShell Module and Framework

wsuspect-proxy. WSUSpect Proxy - a tool for MITM'ing insecure WSUS connections

zxcvbn. Low-Budget Password Strength Estimation

frida. Clone this repo to build Frida

spiped. Spiped is a utility for creating symmetrically encrypted and authenticated pipes between socket addresses.

bypasswaf. Add headers to all Burp requests to bypass some WAF products

GrayStorm. In memory attack platform for C# Applications

grequests. Requests + Gevent = <3

Defeating-PHP-GD-imagecreatefromgif. Proof-of-concept to exploit the flaw in the PHP-GD built-in function, imagecreatefromgif()

retire.js. scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.

NWebsec. Security libraries for ASP.NET

MITMf. Framework for Man-In-The-Middle attacks

DOMPurify. DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:

httpscreenshot. Python

panda. Platform for Architecture-Neutral Dynamic Analysis

Psychson. Phison 2251-03 (2303) Custom Firmware & Existing Firmware Patches (BadUSB)

brackets. An open source code editor for the web, written in JavaScript, HTML and CSS.

Responder. Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.