TheWover

Pinned Repositories

SharpSploit
SharpSploit is a .NET post-exploitation library written in C#
Language:C#1.8k 83 23321
CertStealer
A .NET tool for exporting and importing certificates without touching disk.
Language:C#478 14 068
DInvoke
Dynamically invoke arbitrary unmanaged code from managed code without PInvoke.
Language:C#700 15 20108
donut
Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters
Language:C3.7k 79 108651
donut-demos
Demos of Donut used in conferences, etc. Mostly for my use, but free for others to use as a reference.
31 4 03
EasyNet
Simple packer for arbitrary data using only .NET API calls. Produces a unique signature with every usage. Standalone program and library. Algorithm: Data <-> GZip <-> AES-256 <-> Base64.
Language:C#90 10 024
GhostLoader
GhostLoader - AppDomainManager - Injection - 攻壳机动队
Language:C#154 4 082
Manager
Library of tools and examples for loading/bootstrapping managed code from unmanaged code in .NET
Language:C++62 7 111
ModuleMonitor
Uses WMI Event Win32_ModuleLoadTrace to monitor module loading. Provides filters, and detailed data. Has an option to monitor for CLR Injection attacks.
Language:C#39 2 010
TheWover.github.io
Blog. Watch the repo to subscribe
Language:SCSS5 3 06

TheWover's Repositories

TheWover/AssemblyLoader
Loads .NET Assembly Via CLR Loader
Language:C14 4 08
TheWover/injection
Windows process injection methods
Language:C2
TheWover/AggressorScripts
Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources
Language:C#1 2 0
TheWover/amsi_bypassr
AMSI bypass stager generator
Language:Python1 2 0
TheWover/Browser-ExternalC2
External C2 Using IE COM Objects
Language:C#1 2 0
TheWover/Custom-GetProcAddress-and-GetModuleHandle-and-more
Custom GetProcAddress, GetModuleHandleA and some dbghelp.dll functions
Language:C++1 1 0
TheWover/Howling-Software-V2
Language:C#1 2 0
TheWover/KsDumper
Dumping processes using the power of kernel space !
Language:C#1 2 0
TheWover/MaliciousDLLGenerator
DLL Generator for side loading attack
Language:C1 2 01
TheWover/self-morphing-csharp-binary
C# binary that mutates its own code, encrypts and obfuscates itself on runtime
Language:C#1 1 0
TheWover/spotter
Targeted Payload Execution
Language:Python1 2 0
TheWover/coreclr
CoreCLR is the runtime for .NET Core. It includes the garbage collector, JIT compiler, primitive data types and low-level classes.
Language:C#2 0
TheWover/CPLResourceRunner
Run shellcode from resource
Language:PowerShell
TheWover/cs-script
C# scripting platform
Language:C#2 0
TheWover/de4dot
.NET deobfuscator and unpacker.
Language:C#2 0
TheWover/dotnet
A simple but effective mini-profiler for ASP.NET (and Core) websites
Language:C#2 0
TheWover/DotNetAnywhere
Small .NET interpreter
Language:C
TheWover/Harmony
A library for patching, replacing and decorating .NET and Mono methods during runtime
Language:C#2 0
TheWover/HoLLy.MemoryLib
A specialized C# memory-accessing library
Language:C#2 0
TheWover/injdrv
proof-of-concept Windows Driver for injecting DLL into user-mode processes using APC
Language:C2 0
TheWover/JitBuddy
Disassemble to x86/x64 ASM listing the native code generated by the JIT of a managed method.
Language:C#2 0
TheWover/LimeUSB-Csharp
Malware USB Spread | Example C#
Language:C#2 0
TheWover/malware-sample-library
Malware sample library.
2 01
TheWover/OffensiveCSharp
Collection of Offensive C# Tooling
Language:C#2 0
TheWover/protobuf-net
Protocol Buffers library for idiomatic .NET
Language:JavaScript2 0
TheWover/ReClass.NET
Not just a ReClass port to the .NET platform.
Language:C#2 0
TheWover/SharpSocks
Tunnellable HTTP/HTTPS socks4a proxy written in C# and deployable via PowerShell
Language:C#
TheWover/TikiTorch
Language:JavaScript2 0
TheWover/Vanara
A set of .NET libraries for Windows implementing PInvoke calls to many native Windows APIs with supporting wrappers.
Language:C#2 0
TheWover/WindowsInternals
Windows Internals Book 7th edition Tools
Language:C2 01