Projects sharing features with Gopher

DNSExfiltrator

SessionGopher is a PowerShell tool that uses WMI to extract saved session information for remote access tools such as WinSCP, PuTTY, SuperPuTTY, FileZilla, and Microsoft Remote Desktop. It can be run remotely or locally.

Evading WinDefender ATP credential-theft

Porting of mimikatz sekurlsa::logonpasswords, sekurlsa::ekeys and lsadump::dcsync commands

Create a minidump of the LSASS process from memory

credential dump using forshaw technique using SeTrustedCredmanAccessPrivilege

Tool for extracting information from newly spawned processes

Another LSASS dumping tool that uses a dynamically compiled LSA plugin to grab an lsass handle and API hooking for capturing the dump in memory

SharpCloud is a simple C# utility for checking for the existence of credential files related to Amazon Web Services, Microsoft Azure, and Google Compute.

PIC lsass dumper using cloned handles

C# Lsass parser

Command line interface to dump LSASS memory to disk via SilentProcessExit

Transparently tunnel your IP traffic through ICMP echo and reply packets.

Search drives for documents containing passwords

This project is a technical repository of kernel exploit guides, memory corruption analyses, and archived methods for gaining root access. It serves as a centralized library of security flaws and reproduction steps used for testing system protections and verification. The documentation focuses on the Linux kernel, providing technical breakdowns of how memory management errors and multi-page write techniques allow for the modification of read-only files. It details the use of race conditions to achieve administrative privilege escalation. The repository covers a broad surface of security rese

SharpChromium is a .NET 4.0+ CLR project to retrieve data from Google Chrome, Microsoft Edge, and Microsoft Edge Beta. Currently, it can extract:

.NET 2.0 CLR project to retrieve saved browser credentials from Google Chrome, Mozilla Firefox and Microsoft Internet Explorer/Edge.

TruffleHog is a secret scanning tool designed to identify leaked credentials and API keys across version control systems, cloud storage, and filesystems. It functions as a git secret detector that enumerates hidden commits and a cloud storage security auditor for inspecting container images and storage buckets. The project is distinguished by a credential verification engine that tests discovered secrets against service APIs to confirm they are active, which eliminates false positive alerts. It further analyzes these verified credentials to determine the specific access levels and resources t

Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS

Fork of SafetyKatz that dynamically fetches the latest pre-compiled release of Mimikatz directly from gentilkiwi GitHub repo, runtime patches signatures and uses SharpSploit DInvoke to PE-Load into memory.

C# port of the Get-AppLockerPolicy PowerShell cmdlet with extended features. Includes the ability to filter and search for a specific type of rules and actions. Useful when you already bypassed AppLocker initially and you don't want to leave PS logs

SharpExfiltrate is a tiny but modular C# framework to exfiltrate loot over secure and trusted channels. It supports both single-files and full-directory paths (recursively), file extension filtering, and file size filtering. Exfiltrated data will be compressed and encrypted before being…

Egress-Assess

.Net port of the remote SAM LSA Secrets dumping functionality of impacket's secretsdump.py

Extracting Clear Text Passwords from mstsc.exe using API Hooking.