Solomon Sklash

chomp-scan. A scripted pipeline of tools to streamline the bug bounty/penetration test reconnaissance phase, so you can focus on chomping bugs.

SleepyCrypt. A shellcode function to encrypt a running process image when sleeping.

htbenum. A Linux enumeration script for Hack The Box

SyscallPOC. Shellcode injection POC using syscalls.

RubeusToCcache. A small tool to convert Base64-encoded .kirbi tickets from Rubeus into .ccache files for Impacket

COM-Hijacking. An example of COM hijacking using a proxy DLL.

hacker-checklist. Hacking with the power of checklists.

SeasideBishop. A C port of b33f's UrbanBishop

netntlm. A crappy hook on SpAcceptLsaModeContext that prints incoming auth attempts. WIP

UnhookingPOC. A small commented POC for removing API hooks placed by AV/EDR.

initial-scan. A tool for performing an initial information-gathering scan of websites for penetration tests.

TokenStealingDriver. C++

sri-check. A Burp Suite extension for identifying missing Subresource Integrity attributes.

cookie-decrypter. A Burp Suite Professional extension for decrypting/decoding various types of cookies.

ApiHashing. Replacing GetModuleHandle & GetProcAddress as a God

csharptoolbox. PowerShell

vim-snazzy. Elegant vim theme with bright colors.

Ares. Project Ares is a Proof of Concept (PoC) loader written in C/C++ based on the Transacted Hollowing technique

COMThanasia. A set of programs for analyzing common vulnerabilities in COM

MalwareApiLibrary. collection of apis used in malware development

RecycledGate. Hellsgate + Halosgate/Tartarosgate. Ensures that all systemcalls go through ntdll.dll

VX-API-1. Collection of various malicious functionality to aid in malware development

LoadLibrary-GetProcAddress-Replacements. LoadLibrary() and GetProcAddress() Replacement Functions

ShellcodeFluctuation. An in-memory evasion technique fluctuating shellcode memory protection between RW & RX and encrypting/decrypting contents

RAII-types. Code to handle certain Windows types using the RAII paradigm

inject-assembly. Inject .NET assemblies into an existing process

ImprovedReflectiveDLLInjection. An improvement of the original reflective DLL injection technique by Stephen Fewer of Harmony Security

NiCOFF. COFF and BOF Loader written in Nim

TREVORspray. TREVORspray is a modular password sprayer with threading, clever proxying, loot modules, and more!

No-Consolation. A BOF that runs unmanaged PEs inline

ShellcodeStdio. An extensible framework for easily writing compiler optimized position independent x86 / x64 shellcode for windows platforms.

Shoggoth. Shoggoth: Asmjit Based Polymorphic Encryptor

DeathSleep. A PoC implementation for an evasion technique to terminate the current thread and restore it before resuming execution, while implementing page protection changes during no execution.

Hunt-Weird-ImageLoads. Small tool to play with IOCs caused by Imageload events

NativeNtdllRemap. Remap ntdll.dll using only NTAPI functions with a suspended process

Direct-NtCreateUserProcess. Call NtCreateUserProcess directly as normal.

ShellcodeTemplate. An easily modifiable shellcode template for Windows x64/x86

log.c. A simple logging library implemented in C99

DllToShellCode. Fast Conversion Windows Dynamic Link Library To ShellCode

Cookie-Graber-BOF. C or BOF file to extract WebKit master key to decrypt user cookie

SysWhispers3. SysWhispers on Steroids - AV/EDR evasion via direct system calls.

AceLdr. Cobalt Strike UDRL for memory scanner evasion.

titanldr-ng. A newer iteration of TitanLdr with some newer hooks, and design. A generic user defined reflective DLL I built to prove a point to Mudge years ago.

phnt. Native API header files for the System Informer project.

CreateProcess. A small PoC that creates processes in Windows

sRDI. Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode

APCLdr. Payload Loader With Evasion Features

D1rkLdr. Shellcode Loader with Indirect Dynamic syscall Implementation , shellcode in MAC format, API resolving from PEB, Syscall calll and syscall instruction address resolving at run time

StinkyLoader. It stinks

SLAE64. Materials for PentesterAcademy SLAE64 Ccourse

DarkLoadLibrary. LoadLibrary for offensive operations

Hunt-Sleeping-Beacons. Aims to identify sleeping beacons

log4j-scan. A fully automated, accurate, and extensive scanner for finding log4j RCE CVE-2021-44228

YouMayPasser. You shall pass

segmentation-scan. Shell

C-To-Shellcode-Examples. C