outflanknl/Dumpert

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1595 stars · 247 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Dumpert is a proof-of-concept LSASS memory dumper written in C and assembly that uses direct system calls and API unhooking to evade AV/EDR user-mode hooks. It ships as an executable, DLL, and sRDI shellcode version with a Cobalt Strike aggressor script for in-memory dumping without touching disk.

Use cases

• dump lsass memory without getting caught by edr
• bypass av user-mode api hooks when dumping credentials
• red team credential dumping from lsass
• create lsass minidump via cobalt strike beacon
• demonstrate direct syscall techniques for evasion

When to choose

• you need an LSASS dump that evades user-mode API hooking by security products
• you are running a red team engagement with Cobalt Strike and want in-memory dumping
• you want a reference implementation of direct syscalls combined with API unhooking

When to avoid

• you need a maintained tool with active support or a license for production use
• you are doing defensive security research rather than offensive testing
• you need a general-purpose process memory dumper rather than LSASS-specific dumping

Facets

cli-tool · maturity maintenance

security penetration-testing security penetration-testing windows windows cli red-team lsass-dump direct-syscalls edr-evasion cobalt-strike offensive-security

Member repositories

For agents

markdown · JSON · MCP: product_card(name="outflanknl/Dumpert")