# chryzsh/redteam-bofs

> A collection of Beacon Object Files (BOFs) written in C for Windows post-exploitation: credential hunting, system enumeration, event log analysis, and privilege management. Aimed at red teams and pentesters using Cobalt Strike, Sliver, and OC2.

- Magnitude: 3.4 out of 10 — Early signal
- Stars: 91 total · +3 stars measured 2026-10-15, 00:21–02:29 UTC, ≈ 35 by evening
- Star trust: star growth looks organic
- Category: Security · Language: C · Created: 2026-10-09 · Last push: 2026-10-09
- GitHub: https://github.com/chryzsh/redteam-bofs · Page: https://gitnova.dev/en/r/chryzsh/redteam-bofs

## Useful for

- Build BOFs with make and load them into Cobalt Strike for host reconnaissance
- Dump saved Edge passwords or Credential Manager entries on a compromised host
- Check Credential Guard and HVCI status before attempting credential dumping

## Why it’s here

- Star-counter measurements on 2026-10-15 (UTC), 00:21–02:29: 88 → 91 stars (+3). This is the change over that interval.
- Estimated end-of-day forecast: about +35 stars, using observed gains and the previous day.
- The repository is 6 days old and already has 91 stars. With less than two weeks of history, there's no usual pace to compare the spike against yet.
- Top new repositories this week: #193.
- Recent forks include notable developers: @zha0 (259 followers).

## Star trust

Star growth looks organic.

Star-trust labels are heuristics based on the repository’s behavior, not a check of every stargazer.

## Numbers

- Forks: 8
- Issues and pull requests: 0
- Watchers: 0
- Average over the last week: 18 per day
- Usual pace: too little history (under two weeks)
- Stars in the last hour (measured): 1

## Stars per day, last 7 days (oldest → newest, today is partial)

2026-10-09 … 2026-10-15: 37, 10, 5, 2, 0, 37, 3

## Spotted in now

- Top new repositories this week: #193

## More in this category

1. **vxcontrol/pentagi** — 6.9 · Breakout · Security · Go · +174 stars measured 2026-10-15, 00:20–02:28 UTC, ≈ 1,248 by evening
   Autonomous multi-agent system in Go for automated penetration testing: AI agents plan and execute steps in an isolated Docker sandbox with 20+ tools (nmap, metasploit, sqlmap).
   Full card: https://gitnova.dev/en/r/vxcontrol/pentagi.md
2. **NationalSecurityAgency/ghidra** — 5.7 · Breakout · Security · Java · +140 stars measured 2026-10-15, 00:20–02:28 UTC, ≈ 1,104 by evening
   A software reverse engineering framework from the NSA: disassembly, decompilation, graphing and scripting for analyzing compiled code on Windows, macOS and Linux.
   Full card: https://gitnova.dev/en/r/NationalSecurityAgency/ghidra.md
3. **mhtsec/ARTEX** — 5.3 · Cooling · Security · Go · +30 stars measured 2026-10-15, 00:21–02:28 UTC, ≈ 169 by evening
   AI autonomous penetration testing system with a Go backend and Next.js frontend: agents explore assets and hunt for vulnerabilities, with traffic recording, human-in-the-loop approval, and asset sync from ScopeSentry.
   Full card: https://gitnova.dev/en/r/mhtsec/ARTEX.md
4. **BitterSecurity/Decepticon** — 5.1 · Breakout · Security · Python · +6 stars measured 2026-10-15, 00:22–02:28 UTC, ≈ 74 by evening
   An LLM-driven autonomous red team agent that executes full attack chains (recon, exploitation, privilege escalation, C2) inside an isolated Kali sandbox orchestrated by LangGraph. Before any action it generates an engagement package: RoE,…
   Full card: https://gitnova.dev/en/r/BitterSecurity/Decepticon.md
5. **Zfinix/eleven** — 4.8 · Early signal · Security · TypeScript · +1 star measured 2026-10-15, 00:21–02:28 UTC, ≈ 27 by evening
   A reverse-engineering app for macOS, Windows and Linux where ACP agents read binaries, APKs and GPU kernels, rename functions and suggest patches under your control. Uses Ghidra, Rizin, jadx and LLDB.
   Full card: https://gitnova.dev/en/r/Zfinix/eleven.md

---

Magnitude (0–10) measures how fast and how unusually interest in a repository is growing right now. It is not a quality score.
Days are UTC. “So far today” is a fact; “expected by the end of the day” is a forecast.
Summaries and use cases are written by an LLM (DeepSeek V4.1 Flash) from the README and may be inaccurate: verify specific claims (benchmarks, speed, hardware) in the repository itself.
Data as of 2026-10-15 02:41 UTC, updated every 30 minutes.