White Knight Labs

HiddenDesktop. HVNC for Cobalt Strike

Malleable-CS-Profiles. A list of python tools to help create an OPSEC-safe Cobalt Strike profile.

dcomhijack. Lateral Movement Using DCOM and DLL Hijacking

LayeredSyscall. Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR hooks in Windows.

GregsBestFriend. GregsBestFriend process injection code created from the White Knight Labs Offensive Development course

WMIExec. Set of python scripts which perform different ways of command execution via WMI protocol.

Winsocky. Winsocket for Cobalt Strike.

Warmer. Selenium-based Python script to automate sending emails to warm up your sender reputation and improve email deliverability

FuncAddressPro. A stealthy, assembly-based tool for secure function address resolution, offering a robust alternative to GetProcAddress.

StackMask. A PoC of Stack encryption prior to custom sleeping by leveraging CPU cycles.

Illicit-Services-Enum-Script. Python

slack-udc2. Cobalt Strike UDC2 implementation that provides an Slack C2 channel

docker-cobaltstrike. Docker container for running CobaltStrike 4.7 and above

KnAIght. A modern, scalable web application for obfuscating prompts to bypass AI detection systems.

wkl-gophish. WKl Gophish based on Sneaky Gophish

WKL-Passwords. Wordlist, rules and masks from White Knight Labs

async-callback-thread-injection. ODPC / White Knight Labs: educational async callback thread injection—C# demos stage OpenProcess→VirtualAllocEx→WPM via EnumUILanguagesA/EnumSystemLocalesA, then CreateRemoteThread or NtCreateThreadEx (CallbackInject / CallbackInjectNested).

windows-server-2025-x64-calc-shellcode. Position-independent x64 Windows shellcode that dynamically resolves WinExec via PEB walking and export hashing, with a loader-patched ExitThread epilogue for clean thread termination. Built for White Knight Labs training courses.

okta-mfa-check. OKTA MFA Check using Python and Selenium. Tool checks valid OKTA accounts to determine which MFA options are enabled/disabled