{"adoption": {"forks": 330, "observed_at": "2026-08-28T04:06:23.051312+00:00", "stars": 2179}, "canonical_url": "https://ross.abutalabs.com/products/shad0w", "card": {"archived": false, "artifact_type": "framework", "description": "A post exploitation framework designed to operate covertly on heavily monitored environments", "domain": ["security", "penetration-testing"], "enriched": true, "function": ["security", "cryptography", "cli", "developer-tools"], "health_score": 20, "homepage": "https://blog.dylan.codes/shad0w/", "language": "C", "license": "MIT", "license_family": "permissive", "maturity": "maintenance", "member_repos": ["bats3c/shad0w"], "name": "bats3c/shad0w", "platform": ["windows", "python", "c"], "pushed_at": "2021-09-29T00:15:36+00:00", "repo": "bats3c/shad0w", "stars": 2179, "tags": ["c2", "red-team", "post-exploitation", "edr-evasion", "av-bypass", "penetration-testing", "beacon", "process-injection", "shellcode", "donut", "command-line", "docker", "linux"], "topics": ["shad0w", "c2", "red-team", "c", "docker", "dotnet", "shellcode"], "urls": [], "use_cases": ["run a covert C2 server for red team operations", "evade EDR and AV during penetration tests", "execute .NET assemblies fully in memory on Windows targets", "bypass userland API hooking with dynamically resolved syscalls", "mirror a legitimate website to disguise C2 traffic", "steal credentials with Mimikatz through a beacon", "disable Sysmon and ETW logging on a compromised host", "exfiltrate files over an encrypted HTTPS channel"], "what_it_is": "SHAD0W is a modular post-exploitation C2 (command and control) framework written in Python and C, designed to operate covertly in heavily monitored environments. It evades EDR and AV using syscalls, process injection, and in-memory execution of .NET assemblies via Donut, with encrypted HTTPS beacon communication.", "when_to_avoid": ["you need a commercially supported C2 with enterprise guarantees", "you want a actively maintained tool - the last release was 2021 and the project is beta", "you lack authorization to test systems - this is offensive tooling", "you need non-Windows implant support as beacons primarily target Windows"], "when_to_choose": ["you need a free, modular, Docker-based C2 for authorized red team engagements", "you want in-memory execution of offensive tooling to avoid detection", "you need HTTPS-encrypted beacon traffic with proxy awareness", "you want a CLI-driven C2 with extensible Python modules"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/shad0w", "repo": "bats3c/shad0w", "role": "main", "score": 23}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:06:23.051312+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T02:48:45.660619+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "620eb28aa33768d34d7e2f7bf752c1cf14501c69e33a17b2980427eb2d4adeae", "fetched_at": "2026-08-28T04:06:23.051312+00:00", "kind": "readme", "missing": false, "url": "https://github.com/bats3c/shad0w"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:06:23.051312+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T02:48:45.660619+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "620eb28aa33768d34d7e2f7bf752c1cf14501c69e33a17b2980427eb2d4adeae", "fetched_at": "2026-08-28T04:06:23.051312+00:00", "kind": "readme", "missing": false, "url": "https://github.com/bats3c/shad0w"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T02:48:45.660619+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "620eb28aa33768d34d7e2f7bf752c1cf14501c69e33a17b2980427eb2d4adeae", "fetched_at": "2026-08-28T04:06:23.051312+00:00", "kind": "readme", "missing": false, "url": "https://github.com/bats3c/shad0w"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:06:23.051312+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:06:23.051312+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:06:23.051312+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T02:48:45.660619+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "620eb28aa33768d34d7e2f7bf752c1cf14501c69e33a17b2980427eb2d4adeae", "fetched_at": "2026-08-28T04:06:23.051312+00:00", "kind": "readme", "missing": false, "url": "https://github.com/bats3c/shad0w"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:06:23.051312+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:06:23.051312+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T02:48:45.660619+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "620eb28aa33768d34d7e2f7bf752c1cf14501c69e33a17b2980427eb2d4adeae", "fetched_at": "2026-08-28T04:06:23.051312+00:00", "kind": "readme", "missing": false, "url": "https://github.com/bats3c/shad0w"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:06:23.051312+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:06:23.051312+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:06:23.051312+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T02:48:45.660619+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "620eb28aa33768d34d7e2f7bf752c1cf14501c69e33a17b2980427eb2d4adeae", "fetched_at": "2026-08-28T04:06:23.051312+00:00", "kind": "readme", "missing": false, "url": "https://github.com/bats3c/shad0w"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:06:23.051312+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:06:23.051312+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T02:48:45.660619+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "620eb28aa33768d34d7e2f7bf752c1cf14501c69e33a17b2980427eb2d4adeae", "fetched_at": "2026-08-28T04:06:23.051312+00:00", "kind": "readme", "missing": false, "url": "https://github.com/bats3c/shad0w"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T02:48:45.660619+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "620eb28aa33768d34d7e2f7bf752c1cf14501c69e33a17b2980427eb2d4adeae", "fetched_at": "2026-08-28T04:06:23.051312+00:00", "kind": "readme", "missing": false, "url": "https://github.com/bats3c/shad0w"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T02:48:45.660619+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "620eb28aa33768d34d7e2f7bf752c1cf14501c69e33a17b2980427eb2d4adeae", "fetched_at": "2026-08-28T04:06:23.051312+00:00", "kind": "readme", "missing": false, "url": "https://github.com/bats3c/shad0w"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T02:48:45.660619+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "620eb28aa33768d34d7e2f7bf752c1cf14501c69e33a17b2980427eb2d4adeae", "fetched_at": "2026-08-28T04:06:23.051312+00:00", "kind": "readme", "missing": false, "url": "https://github.com/bats3c/shad0w"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 0, "longevity": 100, "rhythm": 8}, "computed_at": "2026-09-03T02:20:16.233290+00:00", "flags": [], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 2318, "days_push": 1800, "days_rel": null, "gap_med": null, "n_releases_24m": 0}, "score": 23, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}