Results for “evilginx2”

Conduct authorized red team initial access using EvilGinx3 adversary-in-the-middle phishing to capture session tokens and bypass multi-factor authentication.

Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA and steal session tokens.

Hunt for threats in Windows Event Logs using Chainsaw, a fast Rust-based forensic tool that runs Sigma rules, keyword searches, and artifact analysis offline.

Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) to execute malicious payloads while evading detection.

Provides a command-line workflow for binary analysis with radare2, covering reconnaissance, disassembly, function analysis, string and import inspection, patching, binary diffing, and r2pipe scripting across PE, ELF, Mach-O, DEX, and WASM formats.

Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.

Build and operate a Havoc C2 framework for authorized red-team engagements, including team server deployment, evasive Demon agent generation, and post-exploitation.

Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by analyzing endpoint process creation logs for suspicious execution patterns of legitimate Windows system binaries used for malicious purposes.

Architect C2 redirectors with nginx and Apache, derive filter rules from malleable profiles, and apply OPSEC controls for resilient red-team infrastructure.

Reverse engineer malicious Android APK files using JADX decompiler to analyze Java/Kotlin source code, identify malicious functionality including data theft, C2 communication, privilege escalation, and overlay attacks.

Stand up a Sliver C2 server and listeners, generate cross-platform implants and beacons, and run post-exploitation, pivoting, and BOF/.NET tooling via the armory for adversary emulation.

Implements a simplified version of the Signal Protocol's Double Ratchet algorithm using X25519, HKDF, and AES-256-GCM for end-to-end encrypted messaging.

Build and configure a resilient command-and-control infrastructure using BishopFox's Sliver C2 framework with redirectors, HTTPS listeners, and multi-operator support for authorized red team engagements.

Create, validate, and share STIX 2.1 threat intelligence objects using the stix2 Python library, covering indicators, malware, campaigns, relationships, bundles, and TAXII 2.1 publishing.

Processes STIX 2.1 threat intelligence bundles from TAXII 2.1 servers, normalizing objects into platform-native schemas and routing them to consuming systems.