Outflank B.V.
Clear advice with a hacker mindset. Red Teaming - Digital Attack Simulation - Incident Detection and Response
Amsterdam, Netherlands, EU
Pinned Repositories
C2-Tool-Collection
A collection of tools which integrate with Cobalt Strike (and possibly other C2 frameworks) through BOF and reflective DLL loading techniques.
Dumpert
LSASS memory dumper using direct system calls and API unhooking.
EvilClippy
A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX and Windows.
Invoke-ADLabDeployer
Automated deployment of Windows and Active Directory test lab networks. Useful for red and blue teams.
PrintNightmare
Ps-Tools
Ps-Tools, an advanced process monitoring toolkit for offensive operations
Recon-AD
Recon-AD, an AD recon tool based on ADSI and reflective DLL’s
RedELK
Red Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.
SharpHide
Tool to create hidden registry keys.
Spray-AD
A Cobalt Strike tool to audit Active Directory user accounts for weak, well known or easy guessable passwords.
Outflank B.V.'s Repositories
outflanknl/RedELK
Red Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.
outflanknl/EvilClippy
A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX and Windows.
outflanknl/Dumpert
LSASS memory dumper using direct system calls and API unhooking.
outflanknl/C2-Tool-Collection
A collection of tools which integrate with Cobalt Strike (and possibly other C2 frameworks) through BOF and reflective DLL loading techniques.
outflanknl/SharpHide
Tool to create hidden registry keys.
outflanknl/Spray-AD
A Cobalt Strike tool to audit Active Directory user accounts for weak, well known or easy guessable passwords.
outflanknl/Ps-Tools
Ps-Tools, an advanced process monitoring toolkit for offensive operations
outflanknl/PrintNightmare
outflanknl/Recon-AD
Recon-AD, an AD recon tool based on ADSI and reflective DLL’s
outflanknl/Excel4-DCOM
PowerShell and Cobalt Strike scripts for lateral movement using Excel 4.0 / XLM macros via DCOM (direct shellcode injection in Excel.exe)
outflanknl/InlineWhispers
Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF)
outflanknl/Scripts
Small scripts that make life better
outflanknl/FindObjects-BOF
A Cobalt Strike Beacon Object File (BOF) project which uses direct system calls to enumerate processes for specific loaded modules or process handles.
outflanknl/edr-internals
Tools for analyzing EDR agents
outflanknl/Zipper
Zipper, a CobaltStrike file and folder compression utility.
outflanknl/WdToggle
A Beacon Object File (BOF) for Cobalt Strike which uses direct system calls to enable WDigest credential caching.
outflanknl/HelpColor
Agressor script that lists available Cobalt Strike beacon commands and colors them based on their type
outflanknl/Presentations
Presentation material presented by Outflank team members at public events.
outflanknl/TamperETW
PoC to demonstrate how CLR ETW events can be tampered.
outflanknl/Net-GPPPassword
.NET implementation of Get-GPPPassword. Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.
outflanknl/external_c2
POC for Cobalt Strike external C2
outflanknl/macho-loader
outflanknl/nix_bof_template
Beacon Object File (BOF) Template
outflanknl/Training-MSOfficeOffensiveTradecraft
Info related to the Outflank training: Microsoft Office Offensive Tradecraft
outflanknl/unmanaged-dotnet-patch
Modify managed functions from unmanaged code
outflanknl/RedELK-workshop
Items related to the RedELK workshop given at security conferences
outflanknl/regcertipy
Parses cached certificate templates from a Windows Registry file and displays them in the same style as Certipy does
outflanknl/RedFile
Serving files with conditions, serverside keying and more.
outflanknl/Invoke-Templator
A PowerShell script to parse the docx/docm file format and update the template location.
outflanknl/CS-Situational-Awareness-BOF
Situational Awareness commands implemented using Beacon Object Files