guage

reality. grs内网穿透工具通过reality协议隐藏特征

WinDump. 后渗透信息/密码/凭证收集工具

iisproxy. 通过websocket在IIS8(Windows Server 2012)以上实现socks5代理

donut_ollvm. Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters

wget. 可能是windows最小的wget (862字节)

CobaltStrikeDetect. CobaltStrikeDetect

COMFinder. IDA plugin for COM

zigdonut. 用zig实现精简版的donut,可将exe/dll/elf转换为shellcode

zigshellcode. Zig

pyminhook. MinHook warp of Python

zigxorstr. zig compile time string encryption

WinINetLogger. WinINetLogger

BeaconKiller. 一个通过etw技术查杀Cobalt Strike (http/https)Beacon的工具

LdrpHandleTlsData. 定位ntdll.dll中LdrpHandleTlsData地址

MFCFinder. 静态获取MFC的MESSAGE_MAP表

pcre_static_cgo. static link pcre for golang,support window/linux

whatssl. 识别客户端是否使用OpenSSL