Python RAT Core Module
Complete Python 3 RAT framework: C2 server with operator console, implant agent, and standalone generator. AES-256-GCM with pure-Python fallback, anti-analysis, persistence.
Arsenal
Professional offensive security tools & exploit frameworks
98
Tools
12
Categories
Shellcode Encoder x86/x64
Encoder with 5 PIC schemes (xor, rc4, sub-add, insertion, polymorphic) + AES-128-CTR. Real NASM stubs for x86 and x64, 83/83 tests pass.
Windows Rootkit Driver (WDM)
WDM kernel driver (x64): DKOM process hiding, NTFS IRP hook, nsiproxy MIB filtering, CmRegisterCallbackEx protection. User-mode loader included.
Keylogger Module (Win32 API)
WH_KEYBOARD_LL keylogger: window-title context, XOR log rotation, HTTPS exfiltration, Run-key persistence. Prebuilt x86/x64 binaries + decryptor.
PE Packer/Crypter Source
AES-128-CTR PE packer with self-decrypting NASM stub (.zion section), stub anti-debug and TLS callback re-execution. 17/17 emulation tests.
Fileless Malware Loader (PowerShell)
PowerShell in-memory loader: dual-arch AMSI patch, Assembly::Load, shellcode runner, and manual PE mapping with relocations and imports.
C2 Communication Protocol Library
HTTPS/DNS/ICMP C2 library with unified API: AES-256-GCM, anti-replay, fixed DNS chunking, real task delivery. Server handler included.
Persistence Techniques Cookbook (Windows)
10 MITRE-mapped persistence techniques with install/check/remove. v1.1: binPath quoting and honest AppInit_DLLs documentation.
Malleable C2 Profile Generator
Malleable C2 profiles for Cobalt Strike/Sliver/Havoc: 20+ service-mimicking templates, randomization engine, JARM-aware TLS and syntax validation.
SOCKS5 Proxy Pivoting Module
SOCKS5 proxy server with real RFC 1928 support for TCP and UDP ASSOCIATE (client endpoint tracking per datagram). Written in C, cross-compiles for glibc, musl,
Process Injection Techniques Library
Header-only C library for Windows x64 with 8 real injection techniques. injection_lib.h — header-only library (all 8 techniques + syscall stubs + decoder stub)
Phishing Infrastructure Deployer
Phishing infrastructure deployer with REAL Terraform modules for AWS (EC2 + Route53), DigitalOcean (Droplet + Firewall + Domain) and Linode (instance + firewall