Vincent Yiu

LinkedInt. LinkedIn Recon Tool

RedTips. Red Team Tips as posted by @vysecurity on Twitter

DomLink. A tool to link a domain with registered organisation names and emails, to other domains.

DomainFrontingLists. A list of Domain Frontable Domains by CDN

morphHTA. morphHTA - Morphing Cobalt Strike's evil.HTA

IPFuscator. IPFuscator - A tool to automatically generate alternative IP representations

ANGRYPUPPY. Bloodhound Attack Path Automation in CobaltStrike

Aggressor-VYSEC. PowerShell

CVE-2017-8759. CVE-2017-8759 - A vulnerability in the SOAP WDSL parser.

ps1-toolkit. Obfuscated Penetration Testing PowerShell scripts

genHTA. Generates anti-sandbox analysis HTA files without payloads

CobaltSplunk. Splunk Dashboard for CobaltStrike logs

checkO365. checkO365 is a tool to check if a target domain is using O365

CVE-2018-4878. Aggressor Script to launch IE driveby for CVE-2018-4878

CACTUSTORCH. CACTUSTORCH: Payload Generation for Adversary Simulations

ATT-CK_Analysis. Repository for my ATT&CK analysis research.

ExfilServer. Client-side Encrypted Upload Server Python Script

FSharp-Shellcode. F# Implementation to spawn shellcode

Invoke-ProcessScan. Gives context to a system. Uses EQGRP shadow broker leaked list to give some descriptions to processes.

AzureAppC2. A script that can be deployed to Azure App for C2 / Proxy / Redirector

PSPunch. An offensive Powershell console

OffensiveLAM. A Large Action Model designed to operate on MacOS or Windows which interacts with common C2 interfaces such as Cobalt Strike, Havoc, or BRC4.

basicAuth. Basic Auth Phish page

PacketParser. A cap/pcap packet parser to make life easier when performing stealth/passive reconnaissance.

ShellcodeConversion. A collection of shell code conversion scripts that I have written over time for repetitive tasks

RDPInception. A script to attack users who are RDPing into a machine and recurse this attack. For security testers and attack simulations.

msmailprobe2. Office 365 and Exchange Enumeration Version 2

WindfarmDynamite-CNA. CobaltStrike Aggressor Script to utilise FuzzySec's Windows Notification Framework Research to Spawn a Shell under Explorer.exe

Office365TenantsList. Office365 Tenants List

redteam-plan. Issues to consider when planning a red team exercise.

Nemesis-Download-Watcher. Watches the Downloads folder for any new files and inserts it into Nemesis for analysis.

VBA-RunPE. A VBA implementation of the RunPE technique or how to bypass application whitelisting.

autovpn. Easily connect to a VPN in a country of your choice

AggressorScripts-1. Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources

EmpireAMSI. PowerShell

DoH-Servers. DNS over HTTPS Servers

IPFilter. IP address filter by City

DriverVulnCheck. Takes Bruteratel `drivers` output and checks it against loldrivers.io

S3Scanner. Scan for open S3 buckets and dump

HostnameRotator. Daily hostname rotator

wepwnise. A generator to weaponize Macro payloads that can evade EMET and utilises native VB migration.

BadIP. Bad Security Vendor IPs

EDRs. C

PWNDB. Parse PWNDB

nuclei-templates-notags.

APT_CyberCriminal_Campagin_Collections. APT & CyberCriminal Campaign Collection

Windows-SignedBinary. Python

SCTPersistence. Create COM Objects backed by Scripts, not DLLs

vysecurity.

ASNLookup. ASNLookup Tool that queries Cymru's WHOIS Service

CVE-2024-26229-BOF. BOF implementations of CVE-2024-26229 for Cobalt Strike and BruteRatel

reflectivepotato. MSFRottenPotato built as a Reflective DLL. Work in progress. Gotta love Visual C++

merlin. Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.

go-shellcode. A repository of Windows Shellcode runners and supporting utilities. The applications load and execute Shellcode using various API calls or techniques.

magnifier0day. Windows 10 Privilege Escalation (magnifier.exe) via Dll Search Order Hijacking

SUDO_KILLER. A tool to identify and exploit sudo rules' misconfigurations and vulnerabilities within sudo

vmware_vcenter_cve_2020_3952. Exploit for CVE-2020-3952 in vCenter 6.7

doxycannon. A poorman's proxycannon and botnet, using docker, ovpn files, and a dante socks5 proxy

DefaultCreds-cheat-sheet. One place for all the default credentials to assist the pentesters during an engagement / A valid dataset for the data scientist

GoPurple. Yet another shellcode runner consists of different techniques for evaluating detection capabilities of endpoint security solutions