lsarelayx is system wide NTLM relay tool designed to relay incoming NTLM based authentication to the host it is running …
DetectionLabELK – A Fork From DetectionLab With ELK Stack Instead Of Splunk
DetectionLabELK is a fork from Chris Long’s DetectionLab with ELK stack instead of Splunk. Description: DetectionLabELK is the perfect lab …
Ad-Honeypot-Autodeploy – Deploy A Small, Intentionally Insecure, Vulnerable Windows Domain For RDP Honeypot Fully Automatically
Deploy a small, intentionally insecure, vulnerable Windows Domain for RDP Honeypot fully automatically. Runs on self-hosted virtualization using libvirt with …
Ntlm_Theft – A Tool For Generating Multiple Types Of NTLMv2 Hash Theft Files
A tool for generating multiple types of NTLMv2 hash theft files. ntlm_theft is an Open Source Python3 Tool that generates …
FalconEye – Real-time detection software for Windows process injections
FalconEye is a windows endpoint detection software for real-time process injections. It is a kernel-mode driver that aims to catch …
PPLdump – Dump The Memory Of A PPL With A Userland Exploit
This tool implements a userland exploit that was initially discussed by James Forshaw (a.k.a. @tiraniddo) – in this blog post …
StandIn – A Small .NET35/45 AD Post-Exploitation Toolkit
StandIn is a small AD post-compromise toolkit. StandIn came about because recently at xforcered we needed a .NET native solution …
Wsb-Detect – Tool To Detect If You Are Running In Windows Sandbox (“WSB”)
wsb-detect enables you to detect if you are running in Windows Sandbox (“WSB”). The sandbox is used by Windows Defender …
Debotnet – A Tiny Portable Tool For Controlling Windows 10’s Many Privacy-Related Settings And Keep Your Personal Data Private
A free and portable tool for controlling Windows 10’s many privacy-related settings and keep your personal data private. Your preparation …