Red Team Toolkit

Red team interactive toolkit. Syscall SSN map, process injection selector, C2 jitter calculator, command evasion encoder, PowerShell obfuscator, emoji encoder, payload entropy visualizer, and LOLBAS/GTFOBins reference.

#Evasion & Syscalls

#Windows Syscall Map

SSN numbers by OS version (Win7 -> Win11 23H2), change highlighting between versions, hex/decimal toggle. Copy ASM stub for direct syscall / Hell's Gate / SysWhispers.

Windows Syscall Number Map

Direct syscall / Hell's Gate / Halo's Gate reference. SSNs change per Windows build. Sources: j00ru/windows-syscalls, SysWhispers, HellsGate

Syscall Name Category SSN vs Win10 1903 Copy Stub

SSNs can vary between minor builds of the same major version. These values are representative. Use SysWhispers3, HellsGate, or dynamic resolution for production use. (*) NtCreateThreadEx and NtSuspendThread SSNs are approximate for some builds.

#Process Injection Selector

Check your constraints (EDR active, PPL, userland hooks, SYSTEM available) and the widget recommends the 5 best injection techniques with risk badge, key APIs, and caveats.

Process Injection Technique Selector

Select your constraints. Recommendations update live based on your environment.

EDR / AV Presence
Target Constraints
Environment
Recommended Techniques 0

#C2 & OPSEC

#C2 Sleep Jitter Calculator

C2 presets (Meterpreter/Cobalt Strike/Sliver/Havoc/Low&Slow/Long haul), sleep + jitter % -> actual range, simulated beacon countdown, detection threshold comparison (Defender/Elastic/Splunk/CrowdStrike), generated code in PowerShell/Python/C/Go/C#.

C2 Sleep Jitter & Beacon Timing Calculator

Configure beacon timing parameters to calculate jitter ranges, detection risk, and generate sleep stubs.

C2 Defaults:
Timing Range
Sleep range: -- Avg/hour: -- Avg/day: --
Next beacon in:
--s
Detection Threshold Comparison
Engine Detection Condition Status

Thresholds are simplified approximations for educational purposes. Real EDR/SIEM detection uses ML models, behavioral analysis, and environment-specific baselines that cannot be reduced to static rules.












OPSEC Notes


    

  • Avoid round numbers: Exact 60s/120s intervals are trivially flagged. Use primes (61, 67, 71, 127) as base sleep values.
    • 

  • Working hours beaconing: Significantly reduces beacon count and mimics normal user traffic patterns.
    • 

  • User-Agent & header rotation: Randomize HTTP headers per request; static UA strings are a trivial IOC.
    • 

  • Exponential backoff: On failed connections, back off exponentially to avoid flood-detection and burned infrastructure.
    • 

  • Sleep masking: Obfuscate beacon in memory during sleep using Ekko, Foliage, or timer-based techniques.
    • 

















#Command Evasion Encoder




Type a command, select a shell (PowerShell/CMD/Bash/Python), get all encoded variants with evasion level badges: base64 UTF-16LE, decimal codepoints, hex, reverse, char-chunk concat, env variable split, double base64.




Command Evasion Encoder


Enter a command, select a shell. All encoded variants are generated with evasion level badges. Each output is a self-contained command ready to execute.























#PowerShell Obfuscator




8 obfuscation methods (char array, string replace, base64, concat split, reverse, env variable, tick notation, string format) with detection risk badge, char count comparison, and auto-update on input.






PowerShell Obfuscator






0 chars





Method

















Exec

















Char Array





























#PowerShell Emoji Encoder




3 encoding modes (fixed offset, random offset, XOR + emoji) with 8 execution methods (IEX, ScriptBlock, Dot-Source, InvokeScript, EngineEvent, New Runspace, Add-Type C#, & Call Op). Decoder stub included.






PowerShell Emoji Encoder



      Encode a PowerShell command into emoji characters. The decoder stub reverses the mapping and executes via IEX.
    









Mode











Exec
































































#Payload Analysis






#Payload Entropy Visualizer




16x16 byte distribution heatmap, Shannon entropy score, stats (null bytes, ASCII ratio, high bytes). Detects packed/encrypted/XOR/plaintext. Presets: meterpreter, XOR stub, HTTP, AES.




Payload Entropy Visualizer















Presets:



























#Living Off the Land






#LOLBAS + GTFOBins Reference




232 LOLBAS binaries (Windows) and 458 GTFOBins (Linux/Unix) from official projects. Search, filter by category/function, copyable commands with MITRE IDs.






LOLBins Reference

















Category:





    Loading data...
  


















#Also See






#Official Resources











#Cyber Aurelien Guidi