Projects sharing features with LOLBAS

K8tools is a multi-stage attack framework that combines memory-only payload execution, credential testing, port forwarding, privilege escalation, and physical USB-based keystroke injection for comprehensive system compromise. At its core, the Ladon PowerShell module loads a multi-function scanner directly into memory, enabling command execution without writing files to disk, while supporting memory-only payload delivery that downloads and runs obfuscated shellcode or PowerShell commands to evade antivirus detection. The framework distinguishes itself through its breadth of integrated capabili

ClamAV is an open-source antivirus engine and malware detection scanner. It identifies trojans, viruses, and other malicious software by scanning files and data streams against a database of known signatures. The system functions as a signature-based threat detector, allowing for the implementation of threat intelligence by turning malware samples into actionable signatures. It supports the creation of custom malware signatures to identify specific or specialized security threats. The engine provides capabilities for endpoint security monitoring and comprehensive malware detection scanning a

Mimikatz is a Windows post-exploitation framework designed for extracting plaintext passwords, hashes, PIN codes, and security tokens from system memory and the registry. It functions as a credential extraction tool that targets the Local Security Authority Subsystem Service to retrieve cached credentials and sensitive account data. The project provides specialized capabilities for Active Directory penetration testing, including the simulation of domain controllers to replicate directory secrets. It features a Kerberos ticket manipulator capable of exporting, injecting, and forging authentica

Mimikatz is a security research suite designed for auditing Windows authentication and managing system security configurations. It provides a comprehensive framework for extracting sensitive credentials, manipulating process privileges, and managing digital identity assets directly from system memory or offline memory dumps. The project distinguishes itself through advanced system-level exploitation techniques, including runtime process injection, API hooking, and the ability to bypass cryptographic export restrictions. It features a specialized toolkit for Kerberos protocol operations, allow

This project is a comprehensive command-line reference and toolkit designed for Linux system administration and network security assessment. It provides a collection of technical snippets and operational guides focused on managing remote environments, orchestrating shell sessions, and executing administrative tasks through native terminal utilities. The repository distinguishes itself by offering specialized techniques for stealthy operations and infrastructure manipulation. It covers methods for establishing encrypted tunnels to bypass firewalls, obfuscating process identities and command hi

Phantom-Evasion is a security research framework designed for generating obfuscated payloads and automating post-exploitation tasks during authorized security assessments. It provides a suite of utilities for creating custom executables and libraries intended to test the effectiveness of antivirus and endpoint security detection systems. The framework distinguishes itself through a focus on memory-resident operations, allowing for the execution of encrypted binaries and shellcode directly within system memory. By utilizing techniques such as junk code injection, payload encryption, and remote

LaZagne is a cross-platform credential recovery tool designed to extract passwords and secrets from operating systems, browsers, and applications. It functions as a security utility for retrieving stored credentials from compromised systems during penetration testing. The tool provides capabilities for decrypting domain credentials and extracting sensitive data from system storage, including memory dumps, credential managers, keychains, and password hashes. It recovers stored passwords from common software by accessing plaintext files, APIs, and local databases. The project supports digital

BloodHound is an identity risk management platform and graph-based attack path analyzer used to map identity relationships and permissions in Active Directory. It functions as a security tool for auditing directory services, uncovering unintended privilege relationships, and visualizing sequences of permissions that can lead to domain compromise. The project differentiates itself as a comprehensive adversary emulation framework that coordinates remote agents and executes post-exploitation commands. It includes a reverse proxy for bypassing multi-factor authentication via real-time session hij

MSEdgeRedirect is a tool that intercepts specific Microsoft Edge processes — including News, Search, Widgets, and Weather — and redirects their content to open in the system's default browser instead. It operates by modifying Windows registry keys, using Image File Execution Options to intercept Edge executable launches and redirect them to the default browser protocol handler. The tool stores user preferences in the Windows registry for persistent configuration across sessions, and includes search engine customization that allows users to select from eight built-in search engines or specify

Falco is an eBPF runtime security monitor and cloud native detection engine that identifies abnormal behavior and security threats across hosts and containers. It functions as a Linux kernel event auditor, capturing system calls and kernel events in real-time to detect malicious activity. The system distinguishes itself through a rule-based threat detection model that evaluates system activity against a library of community-maintained rules and custom security definitions. It enriches raw kernel events with container and Kubernetes metadata to provide observability into isolated environments

TIC-80 is a fantasy console platform and multi-language game engine that provides a virtual retro game development environment. It operates via a bytecode virtual machine that executes game logic within fixed memory and resolution constraints. The project distinguishes itself by offering integrated asset editors for pixel art, tile maps, and a pattern-based chiptune audio workstation all within a single environment. It supports multi-language scripting, allowing developers to write logic in Lua, JavaScript, or Ruby, and provides a standalone game exporter to package projects into native execu

CrowdSec is a collaborative, distributed security engine designed for threat detection and infrastructure protection. It functions as an intrusion detection system that parses logs and network traffic to identify malicious patterns, utilizing a bucket-based threshold detection model to aggregate events and trigger alerts. The platform is built on a modular architecture that includes a centralized local API server for managing security signals and a relational database for persistent storage of remediation decisions. What distinguishes the project is its decoupled enforcement model, which offl

Empire is a post-exploitation command-and-control (C2) framework designed for red team operations. It deploys and manages agents written in PowerShell, Python, C#, Go, and C across Windows, Linux, and macOS, using encrypted communication channels over HTTP, HTTPS, and SMB. The framework executes over 400 built-in modules for reconnaissance, privilege escalation, credential theft, and lateral movement, and provides a modular engine for authoring custom attack modules. What sets Empire apart is its multi-language agent deployment system, which allows operators to choose implants that suit each

Evil-WinRM is a penetration testing tool and interactive remote shell designed for managing and executing commands on remote Windows systems via the WinRM protocol. It functions as a security utility for auditing Windows environments through remote command execution and credential manipulation. The tool distinguishes itself through its authentication capabilities, acting as both a Kerberos authentication client using ticket-based files and an NTLM pass-the-hash client that accesses services using password hashes instead of plaintext credentials. To evade detection, it supports in-memory paylo

CUPP is a suite of tools for extracting default credentials from aggregated databases, generating password dictionaries from personal data, profiling targets interactively, and expanding wordlists from dictionary sources. It functions as a password dictionary generator and target profiling tool that collects personal details through interactive questions to build custom password lists for security testing. The project distinguishes itself through a modular command pipeline architecture that chains independent subcommands for downloading remote wordlists, parsing structured credential database

Seatbelt is a C# offensive security framework and host security auditor designed to perform endpoint surveys on Windows systems. It functions as a modular tool for identifying vulnerabilities, misconfigurations, and security-relevant artifacts on both local and remote hosts. The project distinguishes itself through a module-based check system that allows for the integration of custom security command units. It features a security event log parser to track logon and process activity, alongside a credential extraction utility for gathering browser history, saved passwords, and cloud credentials

This project is a post-exploitation framework and command and control platform designed for security research and penetration testing. It functions as a remote access tool consisting of a central command server and encrypted executable payloads that establish reverse shell connections. The system utilizes a web-based dashboard for multi-client administration, allowing for remote host monitoring and direct shell access through an in-browser terminal. It generates cross-platform, encrypted binaries that employ a multi-stage delivery chain and a key exchange mechanism to secure communications.

MicaForEveryone is a Windows 11 window customizer and styling tool designed to apply modern backdrop effects and transparency to the title bars of Win32 applications. It functions as a Desktop Window Manager extension that forces specific system materials onto application windows, regardless of whether the native application supports them. The tool specifically targets legacy Win32 application frames, modifying their visual properties to align with the contemporary Fluent Design system. This allows for a consistent visual style across the operating system by updating the appearance of older s

Caldera is an adversary emulation platform and command and control framework designed to simulate cyber attack patterns. It functions as an automated red team tool and threat framework orchestrator, executing attack sequences based on standardized cybersecurity threat frameworks to validate security defenses and detection capabilities. The platform distinguishes itself through the dynamic compilation of customized executable payloads and the use of framework-mapped adversary modeling to structure attack techniques. It manages asynchronous agents on targeted endpoints via a central server acce

ReShade is a post-processing shader injector that hooks into DirectX, OpenGL, and Vulkan rendering pipelines to apply custom shaders in real time. It operates by injecting a DLL into the target process, intercepting graphics API calls, and inserting a configurable pipeline of user-selected shader effects that read color and depth buffers to alter the final output. The project distinguishes itself through depth buffer auto-detection, which automatically identifies the depth-stencil attachment in the rendering pipeline, enabling per-pixel depth effects such as ambient occlusion and depth-of-fie

Maskphish is a comprehensive security toolkit that integrates capabilities for digital forensics, network vulnerability scanning, open-source intelligence, penetration testing, and social engineering. It functions as a multi-purpose framework for automating reconnaissance and executing security audits across diverse network environments. The project features a specialized phishing and social engineering toolkit used for cloning websites, masking URLs, and deploying deceptive pages to capture user credentials. It also includes a remote access Trojan builder for generating platform-specific exe

SuperWeChatPC is a modifier for the WeChat desktop client that unlocks hidden features through memory patching and binary hooks. It functions as a multi-account messaging manager, a messaging data archiver, and a software interface that exposes internal messaging functions to external programs. The project enables the simultaneous operation of multiple independent client instances on a single computer through process isolation. It allows for the transmission of large attachments by bypassing standard file size restrictions and provides a wrapper for programmatic message automation. The tool

Liteflow is a component-based rule engine and workflow orchestrator used to define business logic through a chain of reusable components. It utilizes a structured data language to map logic paths, functioning as a dynamic workflow engine for managing sequences of synchronous and asynchronous tasks. The project is distinguished by its support for hot deployment, allowing rule definitions and execution logic to be updated in real time without restarting the application. It also features a multi-language scripting engine that embeds external scripts into business rules to enable flexible logic c

This is a public archive of vulnerability findings, proof-of-concept code, and technical reports detailing security flaws discovered in third-party software. It functions as a coordinated vulnerability disclosure platform, enabling private reporting to vendors and structured publication of advisories after a fix is released or a 90-day deadline passes. The repository provides modular security analysis tooling—standalone scripts and binaries each targeting a specific bug class for automated detection—alongside a cross-platform fuzzing framework that runs tests across multiple operating systems

Clink is a command line enhancer and shell extension for the Windows CMD terminal. It functions as a readline-style input library and completion engine, adding advanced line editing, persistent command history, and command argument prediction to the standard Windows command line environment. The project distinguishes itself through a scriptable architecture that allows for custom completion definitions, Lua keyboard mapping, and dynamic prompt customization. It enables the creation of context-sensitive prompts that can include asynchronous updates, environment-based formatting, and transient

Empire is a command and control framework and post-exploitation toolkit used for network penetration testing. It serves as a centralized platform for coordinating remote agent communication and automating the delivery of security testing payloads to target systems. The project provides a suite of modules for host reconnaissance, lateral movement, and credential harvesting across corporate environments. It functions as a remote administration tool to maintain persistence and execute commands on compromised hosts. The framework incorporates capabilities for agent orchestration and the executio

This project is a security research utility designed to evaluate and test the detection capabilities of antivirus products. It provides a framework for generating custom, memory-resident loaders that execute payloads directly within a process memory space, bypassing standard file-based execution monitoring. The tool distinguishes itself by employing compiler-driven generation to create unique executable binaries, which avoids the predictable patterns associated with pre-compiled security software. It incorporates dynamic control flow obfuscation to hinder static analysis and utilizes payload