Discover WithSecureLabs/shadowhammer Open Source project

Stars
7
Rank 2,294,772 (Top 46 %)
Language
Python
Created over 5 years ago
Updated over 2 years ago

WithSecureLabs

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Tools related to 'shadowhammer' attack, https://securelist.com/operation-shadowhammer/89992

drozer

The Leading Security Assessment Framework for Android.

Python

3,894

chainsaw

Rapidly Search and Hunt through Windows Forensic Artefacts

Rust

2,713

Custom Command and Control (C3). A framework for rapid prototyping of custom C2 channels, while still providing integration with existing offensive toolkits.

C++

1,498

needle

The iOS Security Testing Framework

Python

1,331

doublepulsar-detection-script

A python2 script for sweeping a network to find windows systems compromised with the DOUBLEPULSAR implant.

Python

1,008

awspx

A graph-based tool for visualizing effective access and resource relationships in AWS environments.

Python

913

python-exe-unpacker

A helper script for unpacking and decompiling EXEs compiled from python code.

Python

751

leonidas

Automated Attack Simulation in the Cloud, complete with detection use cases.

Jupyter Notebook

446

android-keystore-audit

JavaScript

385

physmem2profit

Physmem2profit can be used to create a minidump of a target hosts' LSASS process by analysing physical memory remotely

364

Jandroid

Python

323

CallStackSpoofer

A PoC implementation for spoofing arbitrary call stacks when making sys calls (e.g. grabbing a handle via NtOpenProcess)

C++

294

bitlocker-spi-toolkit

Tools for decoding TPM SPI transaction and extracting the BitLocker key from them.

Python

271

captcha22

CAPTCHA22 is a toolset for building, and training, CAPTCHA cracking models using neural networks.

Python

243

doublepulsar-c2-traffic-decryptor

A python2 script for processing a PCAP file to decrypt C2 traffic sent to DOUBLEPULSAR implant

Python

224

snake

snake - a malware storage zoo

Shell

205

Jamf-Attack-Toolkit

Suite of tools to facilitate attacks against the Jamf macOS management platform.

IAMSpy

damn-vulnerable-llm-agent

Python

169

LinuxCatScale

Incident Response collection and processing scripts with automated reporting scripts

IceKube

peas

PEAS is a Python 2 library and command line application for running commands on an ActiveSync server e.g. Microsoft Exchange.

Python

152

ppid-spoofing

Scripts for performing and detecting parent PID spoofing

PowerShell

127

detectree

Data visualization for blue teams

Svelte

123

GarbageMan

GarbageMan is a set of tools for analyzing .NET binaries through heap analysis.

C++

113

drozer-agent

The Android Agent for the Mercury Security Assessment Framework.

Java

111

doublepulsar-usermode-injector

A utility to use the usermode shellcode from the DOUBLEPULSAR payload to reflectively load an arbitrary DLL into another process, for use in testing detection techniques or other security research.

104

TickTock

C++

102

ModuleStomping

https://blog.f-secure.com/hiding-malicious-code-with-module-stomping/

C++

dotnet-gargoyle

A spiritual .NET equivalent to the Gargoyle memory scanning evasion technique

cloud-wiki

A public cloud security knowledgebase - https://www.secwiki.cloud/

CSS

AMSIDetection

AMSI detection PoC

tau-engine

A document tagging library

Rust

radare2-scripts

A collection of useful radare2 scripts!

Python

CVE-2021-25374_Samsung-Account-Access

This script can be used to gain access to a victim's Samsung Account if they have a specific version of Samsung Members installed on their Samsung Device, and if the victim's device is from the US or Korea region.

Python

ESFang

ESF modular ingestion tool for development and research.

Objective-C

macOSTriageCollectionScript

A triage data collection script for macOS

Shell

lazarus-sigma-rules

RemotePSpy

RemotePSpy provides live monitoring of remote PowerShell sessions, which is particularly useful for older (pre-5.0) versions of PowerShell which do not have comprehensive logging facilities built in.

Python

FLAIR

F-Secure Lightweight Acqusition for Incident Response (FLAIR)

Batchfile

mongo-rs

A higher-level wrapper on top of the official bson & mongodb crates.

Rust

llm-vulnerable-recruitment-app

An example vulnerable app that integrates an LLM

Python

volatility-plugins

Python

FixerUpper

A Burp extension to enable modification of FIX messages when relayed from MitM_Relay

Python

snake-core

snake-core - the real snake

Python

jdiesel

jdiesel fuels the drozer

Java

deject

Memory dump and Sample analysis tool

Python

memory-carving-scripts

Scripts for extracting useful information from infected memory dumps

PowerShell

keywe-tooling

Tools that can be used to interact with the KeyWe Smart Lock device.

Python

datamate

Python

usb-ninja-detection-poc

USB Ninja Detection PoC

C++

iocs

YARA

snake-scales

snake-scales - the default repository of snake scales

Python

dreamer

Easier cloud infrastructure with Terraform and Ansible

Python

snake-skin

snake-skin - the web ui for snake

Svelte

boops-boops-android-agent

Java

snake-tail

snake-tail - the command line ui for snake

Python

slide-decks

WithSecureLabs/shadowhammer

WithSecureLabs

Reviews

Repository Details

More Repositories