mdsecactivebreach/SharpShooter

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1988 stars · 368 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

SharpShooter is a payload creation framework for retrieving and executing arbitrary CSharp source code, generating payloads in formats like HTA, JS, VBS, WSF, VBA, and Excel 4 macros. It supports staged and stageless delivery via web or DNS, RC4 encryption, sandbox detection, AMSI bypass, and HTML smuggling for red team operations.

Use cases

• generate malicious document payloads for red team engagements
• create HTA, JS, VBS or WSF payloads that execute shellcode
• deliver payloads via web or DNS staging
• bypass AMSI and evade antivirus detection in penetration tests
• embed payloads in HTML files using HTML smuggling
• generate macro-enabled Office documents with embedded shellcode

When to choose

• you are a red teamer needing script-based payload generation for Windows targets
• you need staged or stageless shellcode execution across multiple scripting formats
• you want sandbox evasion and environment keying built into payloads

When to avoid

• you need a defensive or detection tool rather than offensive payload generation
• you target non-Windows platforms, since it relies on .NET and Windows scripting hosts
• you want a maintained tool with modern evasion guarantees, as techniques like AMSI bypass may be outdated

Facets

framework · maturity maintenance

penetration-testing security security penetration-testing windows python cli payload-generation red-team offensive-security shellcode macro-payloads amsi-bypass html-smuggling dotnettojscript

Member repositories

For agents

markdown · JSON · MCP: product_card(name="mdsecactivebreach/SharpShooter")