bohops

UltimateWDACBypassList. A centralized resource for previously documented WDAC bypass techniques

SharpRDPHijack. A proof-of-concept Remote Desktop (RDP) session hijack utility

WSMan-WinRM. A collection of proof-of-concept source code and scripts for executing remote commands over WinRM using the WSMan.Automation COM object

GhostBuild. GhostBuild is a collection of simple MSBuild launchers for various GhostPack/.NET projects

DynamicDotNet. A collection of various and sundry code snippets that leverage .NET dynamic tradecraft

RogueAssemblyHunter. Rogue Assembly Hunter is a utility for discovering 'interesting' .NET CLR modules in running processes.

COM-to-the-Darkside. Slides and resources from MCTTP 2025 Talk

paSSH. A simple Python SSH server that reveals passwords of connecting clients

pyrevtun. A pure Python reverse tunnel/reverse port forward utility (prototype) to forward TCP protocols over SSL/TLS.

IISAppPoolCreds. Retrieve the IIS Application Pool Credentials. Relies on the WebAdministration PowerShell Module.

PRUA. PASSWORD RE-USE AUDITOR

SharpCradle. C#

Random. Assorted scripts and one off things

YaraTools. Over 100K open-source YARA signatures evaluated against over 280K files to give insights into the performance of each YARA rule.

awesome-injection. Centralized resource for listing and organizing known injection techniques and POCs