Dobin Rutishauser

avred. Analyse your malware to surgically obfuscate it

RedEdr. Collect Windows telemetry for Maldev

SuperMega. Stealthily inject shellcode into an executable

antnium. A C2 framework for initial access in Go

lxd-webgui. A lightweight web frontend for LXD

BurpSentinel. GUI Burp Plugin to ease discovering of security holes in web applications

yookiterm-slides. Exploitation and Mitigation Slides

ffw. A fuzzing framework for network servers

DetonatorAgent. Detonate redteam tools on VMs and get logs & detection status

detonator. Orchestrate detonating redteam artifacts in VMs with different EDRs to see their detection surface.

yookiterm-challenges. The challenge writeups and solutions for yookiterm-challenge-files

ShellcodeObfuscationLab. Test bench lab for Shellcode Obfuscation

avred-server. The AMSI server for Avred

defender2db. Convert Microsoft Defender Antivirus Signatures (VDM) into SQL DB

antniumui. The Web UI for Antnium

waasa. Windows Application Attack Surface Analyzer

yookiterm-challenges-files. Challenge files which are deployed in the container for the user

ace-firefist. Attack chain emulator. Write recipes for initial access easily

defender2yara. Convert Microsoft Defender Antivirus Signatures (VDM) into a SQL DB

clang-cfi-safestack-analysis. C

badfiles. A detailed list of potentially dangerous file extensions

ttpExtractor. Extract the Procedures (TTP) from CTI reports

rosenbridge. A graphical user interface for Magic Wormhole file transfer

dmsr. Does My Shit Run - Linux Monitoring Solution

SentinelTestbed. Vulnerable web site. Used to test sentinel features.

RedEdrUi. Test UI for RedEdr

security_presentations. My Talks and Presentations - PDF export

LinEnum. Scripted Local Linux Enumeration & Privilege Escalation Checks

DisableWinR. Block Win-R shortcut

defender2db_data. Data from defender2db

yookiterm-server. Main yookiterm backend

windows-api-function-cheatsheets. A reference of Windows API function calls, including functions for file operations, process management, memory management, thread management, dynamic-link library (DLL) management, synchronization, interprocess communication, Unicode string manipulation, error handling, Winsock networking operations, and registry operations.

RefleXXion. RefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc. In order to bypass the user-mode hooks, it first collects the syscall numbers of the NtOpenFile, NtCreateSection, NtOpenSection and NtMapViewOfSection found in the LdrpThunkSignature array.

HijackLibs. Project for tracking publicly disclosed DLL Hijacking opportunities.

ffw-docker. Docker image of FFW

tinysploit2-writeup. Solution and writeup for tinysploit2 challenge

ffweb. A webgui to view crash information of fuzzing runs (FFW)

SemiDataSieve. JS to view, filter and sort unstructured data like procmon

yookiterm. yookiterm web frontend

xtarget. Python OpenCL project to use with Laser bullets including augmented reality

xrop-esp32. Patched xrop to support ESP32 architecture for gadget aquisition

DetonatorLab. C

nkeyrollover. ASCII side-scrolling beat-em-up game

go-shellcode. A repository of Windows Shellcode runners and supporting utilities. The applications load and execute Shellcode using various API calls or techniques.

yookiterm-lxdserver. Yookiterm LXD backend server

zeroballistics. interactive 5.56 rifle ballistics visualizer

godot-srcvis. Python

GenAI-Security-Adventures. Jupyter Notebook

mydumbedr. C

proxybypasser. Bypass proxy download restrictions with JavaScript download

ipsctrainor. arduino IPSC trigger trainer

waasa-reflector. return a file via HTTP with certain file extension and magic type

ROPNotepadNG. Exploitlab ROPNotepad extended

malshaft. Malware analysis with fuzzy hashes on functions and their basic blocks