Pinned Repositories
aadcookiespoof
Azure AD Identity Protection Cookie Spoofing
abot
C# web crawler built for speed and flexibility. Please star this project! +1. Contact me with exciting opportunities!!
AtomicSyscall
Tools and PoCs for Windows syscall investigation.
BadBlood
BadBlood by @davidprowe, Secframe.com, fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world. After BadBlood is ran on a domain, security analysts and engineers can practice using tools to gain an understanding and prescribe to securing Active Directory. Each time this tool runs, it produces different results. The domain, users, groups, computers and permissions are different. Every. Single. Time.
CreateHiddenAccount
A tool for creating hidden accounts using the registry.
Process_Killers
This is a library of batch files that I keep on my desktop to kill stubborn processes. Hope it helps. The batch files are incredibly simple, and if you want to add more, please just change the process name (and make sure the name is correct). Please send a pull request with you new files.
Red-Team-Infrastructure-Automation
Disposable and resilient red team infrastructure with Terraform
RemoteProcessInjection
C# remote process injection utility for Cobalt Strike
shogun
Go Shotgun - Sends data across network without connections or packet data
verizon_samsung_auto_enable_adb
Auto Enable ADB Zero-Day Exploit, Samsung Verizon Devices
CodyJohnston's Repositories
CodyJohnston/DeathSleep
A PoC implementation for an evasion technique to terminate the current thread and restore it before resuming execution, while implementing page protection changes during no execution.
CodyJohnston/Red-Team-Infrastructure-Automation
Disposable and resilient red team infrastructure with Terraform
CodyJohnston/Sandman
Sandman is a NTP based backdoor for red team engagements in hardened networks.
CodyJohnston/AtomicSyscall
Tools and PoCs for Windows syscall investigation.
CodyJohnston/C3
Custom Command and Control (C3). A framework for rapid prototyping of custom C2 channels, while still providing integration with existing offensive toolkits.
CodyJohnston/Chisel-Strike
A .NET XOR encrypted cobalt strike aggressor implementation for chisel to utilize faster proxy and advanced socks5 capabilities.
CodyJohnston/cobalt-arsenal
My collection of battle-tested Aggressor Scripts for Cobalt Strike 4.0+
CodyJohnston/Coercer
A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 9 methods.
CodyJohnston/CVE-2022-26937
A Zeek package to detect CVE-2022-26937, a vulnerability in the Network Lock Manager (NLM) protocol in Windows MFS server.
CodyJohnston/DFSCoerce
CodyJohnston/evilginx2
Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
CodyJohnston/FOLIAGE
Public variation of FOLIAGE ( original developer )
CodyJohnston/KrbRelayUp
KrbRelayUp - a universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings).
CodyJohnston/netbox
The premiere source of truth powering network automation. Open source under Apache 2. Public demo: https://demo.netbox.dev
CodyJohnston/nishang
Nishang - Offensive PowerShell for red team, penetration testing and offensive security.
CodyJohnston/ntlmrelayx2proxychains
CodyJohnston/Powershell-to-Ducky-Converter
This is an application I am developing to automatically convert powershell scripts into ready to use Ducky scripts
CodyJohnston/RDPHijack-BOF
Cobalt Strike Beacon Object File (BOF) that uses WinStationConnect API to perform local/remote RDP session hijacking.
CodyJohnston/RunAsWinTcb
CodyJohnston/ScamNumberSearch
This project is aimed at extracting the phone numbers of tech support scammers that are specifically abusing legitimate website's SEO to push their scam numbers very high up in the search results.
CodyJohnston/ScubaGear
Automation to assess the state of your M365 tenant against CISA's baselines
CodyJohnston/skanuvaty
Blazing fast DNS/network/port scanner
CodyJohnston/Spartacus
Spartacus DLL Hijacking Discovery Tool
CodyJohnston/Spring4Shell-POC
Spring4Shell Proof Of Concept/Information CVE-2022-22965
CodyJohnston/tapir
TAPIR is a multi-user, client/server, incident response framework
CodyJohnston/TeamsImplant
CodyJohnston/updog
Updog is a replacement for Python's SimpleHTTPServer. It allows uploading and downloading via HTTP/S, can set ad hoc SSL certificates and use http basic auth.
CodyJohnston/WFH
CodyJohnston/windows-coerced-authentication-methods
A list of methods to coerce a windows machine to authenticate to an attacker-controlled machine through a Remote Procedure Call (RPC) with various protocols.
CodyJohnston/wkpe
Windows Kernel Programming Experiments