cocomelonc

meow. Cybersecurity research results. Simple C/C++ and Python implementations

peekaboo. It bridges my research with a functional tool. I want to provide a safe, open-source framework for hackers to test evasion and for defenders to improve detection through hands-on learning.

bsprishtina-2024-maldev-workshop. BSides Prishtina 2024 Malware Development and Persistence workshop

cocomelonc.github.io. Cybersecurity blog. Red Team, pentest, malware analysis and dev

mdmz_book. The result of research and investigation of malware development tricks, techniques, evasion, cryptography and linux malware

ejpt. some eJPT exam preparation notes

2022-06-05-malware-av-evasion-7. Malware AV evasion via disable Windows Defender (Registry). C++

hack-process-hacker2. Proof of Concept example for abusing Process Hacker 2 (v2.39.124)

vulnexipy. Vulnerabilities exploitation examples, python

2022-04-02-malware-injection-18. Find kernel32 base and API addresses. Simple C++ implementation

aiya_mmd_book. Attack and introduction (info stealer), start your adventure in MMD

offzone-2024-malware-persistence-workshop. OFFZONE 2024 Malware Persistence workshop

2022-07-21-malware-tricks-22. Run payload like a Lazarus Group (UuidFromStringA). C++ implementation

2022-01-14-malware-injection-13. Code injection via ZwCreateSection, ZwUnmapViewOfSection. C++ example

2022-05-02-malware-pers-3. Malware persistence via COM DLL hijacking. C++ implementation example

OffensiveCpp. This repo contains C/C++ snippets that can be handy in specific offensive scenarios.

2021-04-09-av-evasion-1-. AV engines evasion for C++ simple malware part 1 source code

2022-04-20-malware-pers-1. Malware development: persistence - part 1: startup folder registry keys. C++ implementation

2022-06-27-malware-injection-20. Run shellcode via EnumDesktopsA. C++ implementation

2022-01-24-malware-injection-15. Process injection via KernelCallbackTable

2022-07-13-malware-injection-21. Malware dev. Run shellcode via EnumChildWindows. C++ implementation

2022-09-06-malware-tricks-23. Malware dev tricks: parent PID spoofing. C++ implementation

2022-01-17-malware-injection-14. Code injection via memory sections (Zw) and ZwQueueApcThread. C++ malware example

2022-03-18-malware-av-evasion-4. AV evasions part 4. Trick with hide API calls via ordinals. Simple C++ example

2022-10-28-token-theft-2. APT techniques: Token theft via UpdateProcThreadAttribute. C++ implementation

2023-06-09-syscalls-2. Malware dev tricks - part 33. Syscalls part 2. Simple C++ PoC example

2022-04-13-malware-injection-19. Classic DLL injection. Download dll from url and inject. Simple C++ implementation

2022-09-10-malware-pers-10. Malware dev persistence part 10: via Image File Execution Options. C++ implementation

2023-06-07-syscalls-1. Malware dev tricks. Syscalls part 1. Simple C example

2022-07-29-malware-av-evasion-8. Malware AV evasion trick: payload encoding via Z85 algorithm. C++ implementation

2022-03-22-malware-av-evasion-5. AV evasion part 5. C++ implementation

2023-06-04-malware-tricks-31. Malware dev trick part 31. Simple C++ PoC

2022-04-26-malware-pers-2. Windows persistence via screensavers. Simple C++ implementation

2022-08-16-malware-av-evasion-9. Malware AV evasion via RC4 encrypt. C++ example

Venom. Venom is a library that meant to perform evasive communication using stolen browser socket

2023-04-08-malware-av-evasion-15. Malware AV/VM evasion part 15: GetModuleHandle: simple implementation

2022-05-29-malware-pers-6. Malware persistence part 6. Via Netsh helper DLL. C++ implementation

2022-06-19-malware-pers-8. Malware persistence via Port Monitors. C++ implementation

2022-05-09-malware-pers-4. Malware development persistence part 4. Simple C++ example

2022-08-26-malware-pers-9. Malware persistence via change default file association. C++ malware example

2021-09-19-injection-1. C++ classic code injection example. Source code of my post

2021-12-11-malware-injection-11. Code injection via NtOpenProcess and NtAllocateVirtualMemory

2022-06-12-malware-pers-7. Malware persistent trick. Winlogon registry keys. C++ implementation

2023-05-22-malware-tricks-29. Malware dev tricks: part 29. Fileless storage - Registry. C++ implementation

2022-10-21-malware-pers-16. Malawre development persistence: part 16. C++ implementation

2023-05-26-malware-tricks-30. Malware dev tricks: part 30. Find pid NtGetNextProcess. Simple C++ implementation

2022-09-25-token-theft-1. Windows access token manipulation. C++ implementation example

2022-11-05-malware-analysis-6. Malware analysis part 6. Shannon entropy

2022-10-04-malware-pers-13. Malware development: persistence - part 13. C++ implementation example

2021-09-11-reverse-shells. Source code of my post about reverse shells

2022-04-09-malware-av-evasion-6. AV/VM evasion techniques part 6. C++ implementation

2023-05-11-malware-tricks-28. Malware dev tricks: part 28. C++ example (PoC)

2021-10-30-windows-shellcoding-2. Find kernel32.dll base address via ASM

2022-11-02-malware-pers-18. Malware persistence part 18. Simple C++ implementation

2022-12-21-malware-tricks-25. Malware development tricks part 25. Simple C++ implementation

2021-11-24-malware-injection-7. Classic DLL injection via SetWindowsHookEx. Simple C++ example

2022-10-12-malware-pers-15. Malware persistence part 15: IE. C++ implementation