kelvinguo1988 Goto Github PK

1earn

个人维护的安全知识框架,内容包括不仅限于 web安全、工控安全、取证、应急、蓝队设施部署、后渗透、Linux安全、各类靶机writup

365-days-get-xuanwulab-job

Get a job from Xuanwu Lab in 365 days

3gstudent.github.io

Blog

al-khaser

Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

apt_report

Interesting apt report collection and some special ioc express

atlasldr

Reflective x64 PE/DLL Loader implemented using Dynamic Indirect Syscalls

atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.

attack-notes

av-epp-edr-windows-api-hooking-list

Depending on the AV/EDR we will check which Windows APIs are hooked by the AV/EDR

awesome-cobaltstrike

cobaltstrike的相关资源汇总 / List of Awesome CobaltStrike Resources

awesome-cybersecurity-blueteam

:computer:🛡️ A curated collection of awesome resources, tools, and other shiny things for cybersecurity blue teams.

awesome-cybersecurity-blueteam-cn

网络安全 · 攻防对抗 · 蓝队清单，中文版

awesome-hacking

A collection of various awesome lists for hackers, pentesters and security researchers

awesome-malware-analysis

Defund the Police.

awesome-rat

RAT And C&C Resources. 250+ Open Source Projects, 1200+ RAT/C&C blog/video.

blacklotus

BlackLotus UEFI Windows Bootkit

byob

BYOB (Build Your Own Botnet)

bypassantivirus

远控免杀系列文章及配套工具，汇总测试了互联网上的几十种免杀工具、113种白名单免杀方式、8种代码编译免杀、若干免杀实战技术，并对免杀效果进行了一一测试，为远控的免杀和杀软对抗免杀提供参考。

capa

The FLARE team's open-source tool to identify capabilities in executable files.

ccremote

这是一个基于gh0st远程控制的项目，使自己更深入了解远控的原理，采用VS2017，默认分支hijack还在修改不能执行，master分支的项目可以正常的运行的，你可以切换到该分支查看可以执行的代码

cobalt_strike_wiki

Cobalt Strike系列

cobaltstrike

CobaltStrike's source code

cve-2021-22205

CVE-2021-22205 Unauthorized RCE

cve-2021-40444

CVE-2021-40444 PoC

cve-2023-38831-winrar-exploit

CVE-2023-38831 winrar exploit generator

darkpulse

darkPulse是一个用go编写的shellcode Packer，用于生成各种各样的shellcode loader，目前免杀火绒，360，360核晶。

de4dot

.NET deobfuscator and unpacker.

dll2shellcode

dll转shellcode工具

f-scrack

一款python编写的轻量级弱口令检测脚本，目前支持以下服务：FTP、MYSQL、MSSQL、MONGODB、REDIS、TELNET、ELASTICSEARCH、POSTGRESQL。

filelessremotepe

Loading Fileless Remote PE from URI to memory with argument passing and ETW patching and NTDLL unhooking and No New Thread technique