Payload encoding utility to effectively lower payload entropy.

Fragtunnel is a proof-of-concept (PoC) TCP tunnel tool that you can use to tunnel your application's traffic and bypass next-generation firewalls en route to the target.

清除Go编译时自带的信息

Open Source Platform for storing, organizing, and searching documents related to cyber threats

Supplementary code for the CalcuLatency research paper

📁Clash客户端备份-Clash client backup

3proxy - tiny free proxy server

Some of my Malware Analysis writeups.

Nimbo-C2 is yet another (simple and lightweight) C2 framework

Algorithm for detection of real-time DNS exfiltration

Elkeid is an open source solution that can meet the security requirements of various workloads such as hosts, containers and K8s, and serverless. It is derived from ByteDance's internal best practi…

Turn a normal PDF file into malicious.Use to steal Net-NTLM Hashes from windows machines.

Fake Protocol Server

这是一个用于显示当前网速、CPU及内存利用率的桌面悬浮窗软件，并支持任务栏显示，支持更换皮肤。

A nearly undetectable reverse HTTPS Botnet+RAT C2 Handler and Client written in Go

XrayR 一键脚本以及docker部署

A collection of Indicators of Compromise (IoCs), most aligning with samples derived from the signatures in the YARA-Signatures repo

A robust, multiprocessing-capable, multi-family RAT config parser/config extractor for AsyncRAT, DcRAT, VenomRAT, QuasarRAT, XWorm, Xeno RAT, and cloned/derivative RAT families.

T-Pot Attack Map that follows ES honeypot events within T-Pot and parses IPs, ports and honeypot info to visualize events in real time.

🍯 T-Pot - The All In One Multi Honeypot Platform 🐝

19 Customizable honeypots for monitoring network traffic, bots activities and username\password credentials (DNS, HTTP Proxy, HTTP, HTTPS, SSH, POP3, IMAP, STMP, RDP, VNC, SMB, SOCKS5, Redis, TELNE…

📦 Get a clean, ready-to-go Linux box in seconds.

Krypton C2 is a simple botnet source. Credits Source Code: NixWasHere

Web-based Traffic and Security Network Traffic Monitoring

This script reads from pcap or line-separated hex stream files, and writes the TLS fingerprint IDs of each TLS Clienthello in CSV.