Collection of extracted Microsoft Defender data for security research purposes

Opinionated defaults, documentation, and workflows for Claude Code at Trail of Bits

Bluetooth Low Energy (BLE) scanner with Resolvable Private Address (RPA) resolution using Identity Resolving Keys (IRKs)

POC tools for exploring SMB over QUIC protocol

wspcoerce coerces a Windows computer account via SMB to an arbitrary target using MS-WSP

PoC to coerce authentication from Windows hosts using MS-WSP

Invoke-ArgFuscator is an open-source, cross-platform PowerShell module that helps generate obfuscated command-lines for common system-native executables.

ArgFuscator.net is an open-source, stand-alone web application that helps generate obfuscated command lines for common system-native executables.

A comprehensive ETW (Event Tracing for Windows) event generation tool designed for testing and research purposes.

Project for identifying executables and DLLs vulnerable to environment-variable based DLL hijacking.

Unprotect is a collaborative platform dedicated to uncovering and documenting malware evasion techniques. We invite you to join us in this exciting journey and add your expertise to our collective …

Project for tracking publicly disclosed DLL Hijacking opportunities.

Titanis Backup Operator

MacOS Shared Library to Shellcode Loader

Manage Shadows Copies via the VSS API using C#, C++, Crystal or Python. Working on Windows 11

Homemade Aggressor scripts kit for Cobalt Strike

Library that provides Python examples for interacting with the Cobalt Strike REST API

COM Hijacking VOODOO

Library that provides Aggressor Script functions for interacting with the Cobalt Strike REST API from the client

MCP Server for Cobalt Strike interaction.

template for developing custom C2 channels for Cobalt Strike using IAT hooks applied by a reflective loader.

A PoC web interface for interacting with Cobalt Strike through its REST API.

An interactive command line application for red team operations.

A Research POC on Post-Exploitation Credential Collection through Chromium Browsers

Locate dlls and function addresses without PEB Walk and EAT parsing

PoC demonstrating Cursor's vulnerability to tasks.json hijacking.

Extracts browser-stored data such as refresh tokens, cookies, saved credentials, credit cards, autofill entries, browsing history, and bookmarks from modern Chromium-based and Gecko-based browsers …

Your own personal AI assistant. Any OS. Any Platform. The lobster way. 🦞