TheWover

donut. Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters

DInvoke. Dynamically invoke arbitrary unmanaged code from managed code without PInvoke.

CertStealer. A .NET tool for exporting and importing certificates without touching disk.

GhostLoader. GhostLoader - AppDomainManager - Injection - 攻壳机动队

EasyNet. Simple packer for arbitrary data using only .NET API calls. Produces a unique signature with every usage. Standalone program and library. Algorithm: Data <-> GZip <-> AES-256 <-> Base64.

Manager. Library of tools and examples for loading/bootstrapping managed code from unmanaged code in .NET

ModuleMonitor. Uses WMI Event Win32_ModuleLoadTrace to monitor module loading. Provides filters, and detailed data. Has an option to monitor for CLR Injection attacks.

donut-demos. Demos of Donut used in conferences, etc. Mostly for my use, but free for others to use as a reference.

AssemblyLoader. Loads .NET Assembly Via CLR Loader

ProcessManager. ps-like .NET Assembly for enumerating processes on the current machine or a remote machine.

AsyncRAT-VB.NET. Remote Administration Tool For Windows VB.NET

MemProcFS. MemProcFS (fork that allows reading dumps of the lsass process)

HVNC. HVNC for C# (from TinyNuke)

beercode. Free beerware-quality code in exchange for beer money (if you are so inclined). ;-)

TelemetrySourcerer. Enumerate and disable common sources of telemetry used by AV/EDR.

TheWover.github.io. Blog. Watch the repo to subscribe

PELoader. Load PE via XML Attribute

AsyncRAT-C-Sharp. Remote Administration Tool For Windows C#

LEOPARDSEAL. A simple Linux in-memory .so loader

LetMeowIn. A sophisticated, covert Windows-based credential dumper using C++ and MASM x64.

NativeDump. Dump lsass using only Native APIs by hand-crafting Minidump files (without MinidumpWriteDump!)

DotNetInjections. Loading Assemblies Into Processes, the All Natural Organic way

Ghost-In-The-Logs. Evade sysmon and windows event logging

DLLHijackTest. DLL and PowerShell script to assist with finding DLL hijacks

SharpSploit. SharpSploit is a .NET post-exploitation library written in C#

SharpRDP. Remote Desktop Protocol .NET Console Application for Authenticated Command Execution

Sharp-InvokeWMIExec. C#

RdpThief. Extracting Clear Text Passwords from mstsc.exe using API Hooking.

Windows-Internals. My repository to upload drivers from different books and all the information related to windows internals.

Family. Collection of Malware source code by Language and Family.

pinjectra. Pinjectra is a C/C++ OOP-like library that implements Process Injection techniques (with focus on Windows 10 64-bit)

Bleak. A Windows native DLL injection library written in C# that supports several methods of injection.

eBook-BypassingAVsByCSharp. eBook "Bypassing AVS by C#.NET Programming" (Free Chapters only)

APT_REPORT. Interesting apt report collection and some special ioc express

Driver-Template. Bare template for a Kernel Mode Driver

StandIn. StandIn is a small .NET35/45 AD post-exploitation toolkit

herpaderping. Process Herpaderping proof of concept, tool, and technical deep dive. Process Herpaderping bypasses security products by obscuring the intentions of a process.

Scripts. Small scripts that make life better

Koppeling. Adaptive DLL hijacking / dynamic export forwarding

community-threats. The largest, public library of adversary emulation plans in JSON. A place to share custom SCYTHE threats with the community. #ThreatThursday

winget-cli. Windows Package Manager CLI (aka winget)

Mandark. 💉 Tiny 64-bit RunPE written in C# 💉

SignatureKid. C++

TDL. Driver loader for bypassing Windows x64 Driver Signature Enforcement

spoofing-office-macro. :fish: PoC of a VBA macro spawning a process with a spoofed parent and command line.

self-morphing-csharp-binary. C# binary that mutates its own code, encrypts and obfuscates itself on runtime

Lunar. A lightweight native DLL mapping library that supports mapping directly from memory

SharPyShell. SharPyShell - tiny and obfuscated ASP.NET webshell for C# web applications

ReflectivePELoader. Reflective PE loader for DLL injection

AggressorScripts. Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources

UEFIWriteCSharp. C#

CVE-2025-24813-PoC. Apache Tomcat 远程代码执行漏洞批量检测脚本(CVE-2025-24813)

AllTheThingsExec. Executes Blended Managed/Unmanged Exports

Vx-Engines. Collection of source code for Polymorphic, Metamorphic, and Permutation Engines used in Malware

Covenant. Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red teamers.

SharpKatz. Porting of mimikatz sekurlsa::logonpasswords, sekurlsa::ekeys and lsadump::dcsync commands

Empire. Empire is a PowerShell and Python 3.x post-exploitation framework.