
A shellcode generator that creates position-independent code for loading and executing .NET Assemblies, PE files, and Windows payloads from memory.
Checked October 2026.
Donut is a position-independent shellcode generator that creates x86, x64, or AMD64+x86 shellcode for loading and executing various Windows payloads from memory.
The tool supports multiple payload types including .NET Assemblies, PE files, and other Windows executables. It generates shellcode that can load these payloads directly from memory without requiring them to be written to disk.
The generated shellcode is position-independent, meaning it can execute from any memory location without requiring specific memory addresses. This characteristic makes it suitable for various exploitation scenarios where memory layout may be unpredictable.
Donut allows users to pass parameters to the loaded payloads, providing flexibility in how the executed code receives input. The tool supports multiple processor architectures, enabling compatibility across different Windows systems.
The shellcode generation process converts standard executable files into a format that can be injected and executed within existing processes, making it useful for post-exploitation activities and payload delivery mechanisms.
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about Donut: features, pricing and alternatives.
Donut is a product in the Red-Team & Adversary Emulation category. It covers PE File, Shellcode and Windows.
Donut is free. Download and setup instructions are at https://github.com/TheWover/donut/.
Alternatives to Donut listed on CybersecTools:
Compare all Donut alternatives at https://cybersectools.com/alternatives/donut
Donut is available as on-premises. It is listed for mid-market and enterprise organizations. It is free.
Side by side: features, pricing model and the company behind each one.
A DNS rebinding toolkit
DNS spoofer tool for redirecting DNS lookup requests.
A reconnaissance tool that analyzes expired domains for categorization, reputation, and Archive.org history to identify candidates suitable for phishing and C2 operations.
AI agent platform for automating offensive security operations and evals.
A DNS rebinding exploitation framework
Ebowla is a tool for generating payloads in Python, GO, and PowerShell with support for Reflective DLLs.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,027 products.
Connect your AI