edrs

edrsandblast

egress-assess

Egress-Assess is a tool used to test egress data detection capabilities

ekko

Sleep Obfuscation

electroneum-pool

electrum-ravencoin

Electrum-Ravencoin Wallet Client. Forked from the Electrum Bitcoin base client.

empire

Empire is a PowerShell and Python post-exploitation agent.

endgame

An AWS Pentesting tool that lets you use one-liner commands to backdoor an AWS account's resources with a rogue AWS account - or share the resources with the entire internet 😈

enum4linux-ng

A next generation version of enum4linux (a Windows/Samba enumeration tool) with additional features like JSON/YAML export. Aimed for security professionals and CTF players.

esc

Evil SQL Client (ESC) is an interactive .NET SQL console client with enhanced SQL Server discovery, access, and data exfiltration features. While ESC can be a handy SQL Client for daily tasks, it was originally designed for targeting SQL Servers during penetration tests and red team engagements. The intent of the project is to provide an .exe, but also sample files for execution through mediums like msbuild and PowerShell.

esp32marauder

A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32

eventlogparser

Parse PowerShell and Security event logs for sensitive information.

evilclippy

A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX and Windows.

evilginx2

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

evilselenium

EvilSelenium is a tool that weaponizes Selenium to attack Chrome.

excel4-dcom

PowerShell and Cobalt Strike scripts for lateral movement using Excel 4.0 / XLM macros via DCOM (direct shellcode injection in Excel.exe)

exchange2domain

CVE-2018-8581

executeassembly

Load/Inject .NET assemblies by; reusing the host (spawnto) process loaded CLR AppDomainManager, Stomping Loader/.NET assembly PE DOS headers, Unlinking .NET related modules, bypassing ETW+AMSI, avoiding EDR hooks via NT static syscalls (x64) and hiding imports by dynamically resolving APIs (hash).

exploit-code-by-me

Exploit code developed by me to check few famous vulnerabilities

extps-cobalt-strike-bof

Extended Process List (Search functionality)

fakelogonscreen

Fake Windows logon screen to steal passwords

family-of-client-ids-research

Research into Undocumented Behavior of Azure AD Refresh Tokens

farmer

filelessntdllreflection

Bypass Userland EDR hooks by Loading Reflective Ntdll in memory from a remote server based on Windows ReleaseID to avoid opening a handle to ntdll, and trigger exported API from the export table

findfrontabledomains

Search for potential frontable domains

findobjects-bof

A Cobalt Strike Beacon Object File (BOF) project which uses direct system calls to enumerate processes for specific loaded modules or process handles.

finduncommonshares

FindUncommonShares.py is a Python equivalent of PowerView's Invoke-ShareFinder.ps1 allowing to quickly find uncommon shares in vast Windows Domains.

firefoxmetamaskwalletseedrecovery

If you still know the password and have the Firefox browser extension data files, you may be able to recover your wallet seed.

firewalker

firewall_walker_bof

A BOF to interact with COM objects associated with the Windows software firewall.