Ricardo J. Ruiz

NativeDump. Dump lsass using only NTAPI functions by hand-crafting Minidump files (without MiniDumpWriteDump!!!)

wifi-pentesting-guide. WiFi Penetration Testing Guide

TrickDump. Dump lsass using only NTAPI functions creating 3 JSON and 1 ZIP file... and generate the MiniDump file later!

instagram-followers-bot. A bot for Instagram. You can follow users using a tag or in a specific location, unfollow those who dont follow-you-back, and follow-back those who follow you

NativeBypassCredGuard. Bypass Credential Guard by patching WDigest.dll using only NTAPI functions

WhoamiAlternatives. Different methods to get current username without using whoami

adfsbrute. A script to test credentials against Active Directory Federation Services (ADFS), allowing password spraying or bruteforce attacks.

covert-tube. Youtube as covert-channel - Control systems remotely and execute commands by uploading videos to Youtube

SharpCovertTube. Youtube as C2 channel - Control Windows systems uploading QR videos to Youtube

NativeTokenImpersonate. Impersonate Tokens using only NTAPI functions

twitter-followers-bot. A bot for Twitter. You can follow users in a specific location or tweeting specific words and unfollow those who do not follow you back (and are not included in whitelist.txt). Also generates REPORTS!

covert-control. Google Drive, OneDrive and Youtube as covert-channels - Control systems remotely by uploading files to Google Drive, OneDrive, Youtube or Telegram

wpa2-enterprise-attack. Virtual machines and scripts to attack WPA2-Enterprise networks through Rogue Access Points downgrading the authentication method to GTC

DoubleTeam. Listener that spawns a new tmux window for each incoming reverse shell + Supports listening on many ports

emqx-RCE. EMQX Dashboard Malicious Plugin leading to RCE

MemorySnitcher. Vulnerable (on purpose) programs to leak NtReadVirtualMemory address for stealthier API resolution (no GetProcAddress, GetModuleHandle or LoadLibrary in the IAT)

instagram-user-id. Get the user ID of any user in instagram

Portswigger-Labs. All Apprentice and Practitioner-level Portswigger labs

SharpSelfDelete. PoC to self-delete a binary in C#

NativeNtdllRemap. Remap ntdll.dll using only NTAPI functions with a suspended process

spotify-playlist-downloader. Downloading Spotify Playlists

OSED-prep. Exploits written while preparing for the OSED exam

SSSD-creds. Script to extract the cached credentials from SSSD, getting Active Directory credentials from Unix systems

http-protocol-exfil. Exfiltrate files using the HTTP protocol version ("HTTP/1.0" is a 0 and "HTTP/1.1" is a 1)

SharpObfuscate. Obfuscate payloads using IPv4, IPv6, MAC or UUID strings

p-invoke.net. P/Invoke definitions from the most-of-the-time offline offline pinvoke.net. Website: https://ricardojoserf.gitbook.io/pinvoke

slae32. The SecurityTube Linux Assembly Expert (SLAE) is an online course and certification which focuses on teaching the basics of 32-bit assembly language for the Intel Architecture (IA-32) family of processors on the Linux platform and applying it to Infosec

Tinder-Searcher-and-DB-creation. Tinder user searcher and DB creation. Proof of concept for Tinder security team

SharpNado. Repository to gather the .NET malware I will be developing

CESP-ADCS-cheatsheet. Cheatsheet for Altered Security's CESP ADCS course

ddos_simulation. DDoS simulation written in Python using "scapy" and "multiprocessing" libraries. Used for educational purposes

ntds-analyzer. A tool to analyze Ntds.dit files once the NTLM and LM hashes have been cracked.

s7-parser. Parser of the industrial protocol S7 (S7comm) using Libpcap

subdoler. Easy subdomain finder from a list of company names, IP ranges or domains.

MinidumpParser. C# program to parse Microsoft Minidump files and their streams

vulnserver-exploits. Vulnserver exploits

BOF_Files. Repository to gather the BOF files I will be developing

jeringuilla. Process injection framework in C#. It uses dynamic function loading using delegates and AES-encryption for strings and payloads

SharpNtdllOverwrite. Overwrite ntdll.dll's ".text" section to bypass API hooking. Getting the clean dll from disk, Knowndlls folder, a debugged process or a URL

webmin-tor-bruteforce. Script to bruteforce Webmin allowing to rotate the IP address using Tor

triangle-position. Triangle a coordinate given 3 or 4 coordinates

omrs-rce-exploit. Online Marriage Registration System (OMRS) 1.0 - Remote code execution

instagram-liker-all-posts. Like all posts of a user given the username in Instagram

network-providers. Tests with Network Providers DLLs, adding some extra functionality to NPPSpy2 by @gtworek

GetProcAddress. GetProcAddress implementation in C# walking the PEB using only NtReadVirtualMemory

LM_original_password_cracker. Having the NTLM and a cracked LM hash it is possible to get the original password by testing all the combinations of upper and lowercases. This is useful if a ntds.dit file has both NTLM and LM hashes

GetModuleHandle. GetModuleHandle implementation in C# using only NtQueryInformationProcess by walking the PEB

amazon-mwaa-RCE. RCE in Amazon Managed Workflows for Apache Airflow (MWAA) service

SharpProcessDump. Dump memory regions of a process using NtQueryVirtualMemory and NtReadVirtualMemory

pywisam. A Wifi pentesting framework written in Python

SharpEA. Read, write and delete Extended Attributes (EAs) within NTFS, to hide malicious payloads

github-bot. Easy bot for starring or branching a huge number of repositories. Using pyGithub

ipv4info_scraper. Get the IP blocks and domains from a company name by scrapping IPv4info

username-generator. Generate list of possible usernames for attacks such as password spraying

StealthyEnv. Stealthier alternative to whoami.exe in C#, it gets environment variables from PEB (PRTL_USER_PROCESS_PARAMETERS)

pyNtdllOverwrite. Overwrite ntdll.dll's ".text" section to bypass API hooking. Getting the clean dll from disk, Knowndlls folder or a debugged process

coinhive-example. Easy example using Coinhive in a simple page

goNtdllOverwrite. Overwrite ntdll.dll's ".text" section to bypass API hooking. Getting the clean dll from disk, Knowndlls folder or a debugged process

lsass-dumper. Dump lsass.exe generating a file with the hostname and date in txt format using C++.

nodejs_webshell. Node.js webshell created using AngularJS. It is a MEAN app (MongoDB + Express + AngularJs + Node.js) with a CLI in a text box