Projects sharing features with InvisibilityCloak

evasion technique to defeat and divert detection and prevention of security products (AV/EDR/XDR)

Dendrobate is a framework that facilitates the development of payloads that hook unmanaged code through managed .NET code. To do this Dendrobate uses EasyHook and packs the injected component, Dendron, using Fody & Costura . This is all done automatically so all you need to do when you compile…

macOS Initial Access Payload Generator

generate CobaltStrike's cross-platform payload

Shhhloader is a work in progress shellcode loader. It takes raw shellcode as input and compiles a C++ stub that does a bunch of different things to try and bypass AV/EDR. The included python builder will work on any Linux system that has Mingw-w64 installed.

To view the latest version of Freeze or to submit an issue, reference https://github.com/Tylous/Freeze.

To view the latest version of Ivy or to submit an issue, reference https://github.com/Tylous/Ivy.

To view the latest version of ScareCrow or to submit an issue, reference https://github.com/Tylous/ScareCrow.

A Proof of Concept for weaponizing SysWhispers for making direct system calls in Cobalt Strike Beacon Object File.

PEzor

Weaponize DLL hijacking easily. Backdoor any function in any DLL without disrupting normal process operation.

RuralBishop is practically a carbon copy of UrbanBishop by b33f, but all P/Invoke calls have been replaced with D/Invoke.

MSBuild Without MSBuild.exe

Tiny Excel BIFF8 Generator, to Embedded 4.0 Macros in *.xls

A tool to abuse Exchange services

Donut is a toolset for loading and executing payloads in memory, featuring a position-independent shellcode generator, an in-memory payload injector, and a .NET assembly loader. It is designed to convert executable files and scripts into shellcode that can be executed within the memory space of a remote process without writing files to disk. The project specializes in security evasion through memory-based patching and payload obfuscation using symmetric block ciphers and compression. It includes a remote payload stager to retrieve encrypted modules from HTTP or DNS servers during runtime, red

c++ fully undetected shellcode launcher ;)

Store and execute an encrypted windows binary from inside memory, without a single bit touching disk.

This project is a post-exploitation framework and command and control platform designed for security research and penetration testing. It functions as a remote access tool consisting of a central command server and encrypted executable payloads that establish reverse shell connections. The system utilizes a web-based dashboard for multi-client administration, allowing for remote host monitoring and direct shell access through an in-browser terminal. It generates cross-platform, encrypted binaries that employ a multi-stage delivery chain and a key exchange mechanism to secure communications.

Garble is an obfuscation tool for Go binaries. It transforms compiled Go programs by hashing identifiers, package paths, and filenames into short, opaque strings, making reverse engineering more difficult. The tool produces reproducible results from identical source and a user-supplied seed, enabling verifiable builds. Obfuscation can be restricted to only those packages that match user-defined patterns, leaving other parts of the codebase untouched. Constant string literals in the binary are replaced with runtime-resolved expressions to hide their original content. The tool integrates direct