Pinned Loading

1. ShadowDumper ShadowDumper Public

   Shadow Dumper is a powerful tool used to dump LSASS memory, often needed in penetration testing and red teaming. It uses multiple advanced techniques to dump memory, allowing to access sensitive da…

   C++ 387 64

2. ProcessInjectionTechniques ProcessInjectionTechniques Public

   This comprehensive process injection series is crafted for cybersecurity enthusiasts, researchers, and professionals who aim to stay at the forefront of the field. It serves as a central repository…

   C++ 307 45

3. RWX_MEMEORY_HUNT_AND_INJECTION_DV RWX_MEMEORY_HUNT_AND_INJECTION_DV Public

   Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region.

   C++ 248 47

4. LsassReflectDumping LsassReflectDumping Public

   This tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone is created, it utilizes MINIDUMP_CALLBACK_INFORMATION callb…

   C++ 175 26

5. DefenseEvasionTechniques DefenseEvasionTechniques Public

   This comprehensive and central repository is designed for cybersecurity enthusiasts, researchers, and professionals seeking to stay ahead in the field. It provides a valuable resource for those ded…

   C++ 83 14

6. .NET_PROFILER_DLL_LOADING .NET_PROFILER_DLL_LOADING Public

   .NET profiler DLL loading can be abused to make a legit .NET application load a malicious DLL using environment variables. This exploit is loading a malicious DLL using Task Scheduler (MMC) to bypa…

   C++ 42 12