Ege Balcı

sgn. Shikata ga nai (仕方がない) encoder ported into go with several improvements

amber. Reflective PE packer.

HERCULES. HERCULES is a special payload generator that can bypass antivirus softwares.

deoptimizer. Evasion by machine code de-optimization.

EGESPLOIT. EGESPLOIT is a golang library for malware development

evilreplay. Seamless remote browser session control

Cminer. Cminer is a tool for enumerating the code caves in PE files.

Keylogger. Simple C++ Keylogger...

ARCANUS. ARCANUS is a customized payload generator/handler.

WSAAcceptBackdoor. Winsock accept() Backdoor Implant.

Hook_API. Assembly block for hooking windows API functions.

IAT_API. Assembly block for finding and calling the windows API functions inside import address table(IAT) of the running PE file.

Mass-Hacker-Arsenal. Massive arsenal of hacker tools...

The-Eye. Simple security surveillance script for linux distributions.

syscall_api. Assembly

MapPE. PE file mapping and manipulation package.

Ticketbleed. This is a tool for exploiting Ticketbleed (CVE-2016-9244) vulnerability.

zippo. Zippo is a archive payload generator for testing XSS, (Zip/Tar/Gzip) slip vulnerabilities.

SelfDefense. Several self-defense shellcodes

sub7. Clone of https://gitlab.com/illwill/sub7 repo.

crc32_api. Assembly API block that uses CRC32 for resolving Windows API function addresses

MSF-Self-Defence. Self defense post module for metasploit

AgentTesla_RCE. AgentTesla botnet C&C RCE exploit.

meterpreter. Basic multi platform meterpreter loader module.

AzorultDecryptor. Brute-force script for finding azorult XOR key.

MSF-Telegram-Notify. Telegram notification for metasploit sessions.

Injector. Simple shellcode injector.

KPOT-Decryptor. Tool for finding KPOT XOR key using known-plaintext attack.

keystone-go. Keystone binding for golang

BitBender. BitBender is a byte manipulation tool

CVE-2022-29154. HIP2022 presentation materials.

urlscan-go. URLScan Go API client

poe2-whisper-bot. Telegram bot for redirecting POE2 trade messages.

CVE-2018-8065. Flexense HTTP Server <= 10.6.24 - Denial Of Service Exploit

PEzor. Read the blog post here: https://iwantmore.pizza/posts/PEzor.html

No-Consolation. A BOF that runs unmanaged PEs inline

LdrLibraryEx. A small x64 library to load dll's into memory.

ARMBot_RCE. ARM Bot RCE Exploit.

malware-1. Malware source code samples leaked online uploaded to GitHub for those who want to analyze the code.

Saddam. DDoS Amplification Tool

Botnet. Botnet

Crypter. Windows Crypter

ransomware. A windows crypto-ransomware (Academic)

COFF-Loader. A reimplementation of Cobalt Strike's Beacon Object File (BOF) Loader

hidden-tear. ransomware open-sources

metasploit-framework. Metasploit Framework

DreamLoader. Simple 32/64-bit PEs loader.

spy-extension. A Chrome extension that will steal literally everything it can

ShellcodeTemplate. An easily modifiable shellcode template for Windows x64/x86

machineid. Get the unique machine id of any host (without admin privileges)

Cpp-Keylogger. Advanced keylogger made in C++ that works on Window 7, 8, 8.1, And 10 - Use at your own discretion

GoDefender. Anti Virtulization, Anti Debugging, AntiVM, Anti Virtual Machine, Anti Debug, Anti Sandboxie, Anti Sandbox, VM Detect package. Windows ONLY.

AtomPePacker. A Highly capable Pe Packer

LG-Smart-IP-Device-Backup-Download. Exploit for downloading backup files from LG Smart IP Devices.

tracee. Linux Runtime Security and Forensics using eBPF

Nidhogg. Nidhogg is an all-in-one simple to use rootkit for red teams.

MicroBackdoor. Small and convenient C2 tool for Windows targets

TurkoRat. Fully undetected grabber (grabs wallets, passwords, cookies, modifies discord client etc.)

kopycat. Linux Kernel module-less implant (backdoor)