.NET debugger and assembly editor

Integrate cutting-edge LLM technology quickly and easily into your apps

PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)

.NET deobfuscator and unpacker.

Trying to tame the three-headed dog.

Covenant is a collaborative .NET C2 framework for red teamers.

A source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using static analysis with a json based rules engine. …

Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.

Phison 2251-03 (2303) Custom Firmware & Existing Firmware Patches (BadUSB)

Deserialization payload generator for a variety of .NET formatters

Network Analysis Tool

.NET IPv4/IPv6 machine-in-the-middle tool for penetration testers

Reko is a binary decompiler.

WiX Toolset v3.x

A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX and Windows.

C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527

Five lessons, learn how to really apply AI to your .NET Applications

Directory Services Internals (DSInternals) PowerShell Module and Framework

KrbRelayUp - a universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings).

Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS

Collection of Offensive C# Tooling

A repository with my notable code snippets for Offensive Security's PEN-300 (OSEP) course.

TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts

The Hunt for Malicious Strings

A tool to create a JScript file which loads a .NET v2 assembly from memory.

SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature.

C# Data Collector for BloodHound

PoC tool to coerce Windows hosts authenticate to other machines via the MS-RPRN RPC interface. This is possible via other protocols as well.

WOA Deployer for Raspberry Pi

Framework for Kerberos relaying