Projects sharing features with SharpWeb

Windows passwords decryption from dump files

DNSExfiltrator

SessionGopher is a PowerShell tool that uses WMI to extract saved session information for remote access tools such as WinSCP, PuTTY, SuperPuTTY, FileZilla, and Microsoft Remote Desktop. It can be run remotely or locally.

Evading WinDefender ATP credential-theft

Porting of mimikatz sekurlsa::logonpasswords, sekurlsa::ekeys and lsadump::dcsync commands

Create a minidump of the LSASS process from memory

credential dump using forshaw technique using SeTrustedCredmanAccessPrivilege

Tool for extracting information from newly spawned processes

Another LSASS dumping tool that uses a dynamically compiled LSA plugin to grab an lsass handle and API hooking for capturing the dump in memory

SharpCloud is a simple C# utility for checking for the existence of credential files related to Amazon Web Services, Microsoft Azure, and Google Compute.

PIC lsass dumper using cloned handles

C# Lsass parser

Command line interface to dump LSASS memory to disk via SilentProcessExit

Transparently tunnel your IP traffic through ICMP echo and reply packets.

Search drives for documents containing passwords

This project is a technical repository of kernel exploit guides, memory corruption analyses, and archived methods for gaining root access. It serves as a centralized library of security flaws and reproduction steps used for testing system protections and verification. The documentation focuses on the Linux kernel, providing technical breakdowns of how memory management errors and multi-page write techniques allow for the modification of read-only files. It details the use of race conditions to achieve administrative privilege escalation. The repository covers a broad surface of security rese

SharpChromium is a .NET 4.0+ CLR project to retrieve data from Google Chrome, Microsoft Edge, and Microsoft Edge Beta. Currently, it can extract:

TruffleHog is a secret scanning tool designed to identify leaked credentials and API keys across version control systems, cloud storage, and filesystems. It functions as a git secret detector that enumerates hidden commits and a cloud storage security auditor for inspecting container images and storage buckets. The project is distinguished by a credential verification engine that tests discovered secrets against service APIs to confirm they are active, which eliminates false positive alerts. It further analyzes these verified credentials to determine the specific access levels and resources t

Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS

If a credential is there... Gopher will find it!

Fork of SafetyKatz that dynamically fetches the latest pre-compiled release of Mimikatz directly from gentilkiwi GitHub repo, runtime patches signatures and uses SharpSploit DInvoke to PE-Load into memory.

SharpExfiltrate is a tiny but modular C# framework to exfiltrate loot over secure and trusted channels. It supports both single-files and full-directory paths (recursively), file extension filtering, and file size filtering. Exfiltrated data will be compressed and encrypted before being…

Egress-Assess

.Net port of the remote SAM LSA Secrets dumping functionality of impacket's secretsdump.py

Mimikatz is a security research suite designed for auditing Windows authentication and managing system security configurations. It provides a comprehensive framework for extracting sensitive credentials, manipulating process privileges, and managing digital identity assets directly from system memory or offline memory dumps. The project distinguishes itself through advanced system-level exploitation techniques, including runtime process injection, API hooking, and the ability to bypass cryptographic export restrictions. It features a specialized toolkit for Kerberos protocol operations, allow