# Donut

Donut is a Red-Team & Adversary Emulation product. It runs on-premises. Pricing is free.

A shellcode generator that creates position-independent code for loading and executing .NET Assemblies, PE files, and Windows payloads from memory.

Checked October 2026.

## What is Donut?

Donut is a position-independent shellcode generator that creates x86, x64, or AMD64+x86 shellcode for loading and executing various Windows payloads from memory.

The tool supports multiple payload types including .NET Assemblies, PE files, and other Windows executables. It generates shellcode that can load these payloads directly from memory without requiring them to be written to disk.

The generated shellcode is position-independent, meaning it can execute from any memory location without requiring specific memory addresses. This characteristic makes it suitable for various exploitation scenarios where memory layout may be unpredictable.

Donut allows users to pass parameters to the loaded payloads, providing flexibility in how the executed code receives input. The tool supports multiple processor architectures, enabling compatibility across different Windows systems.

The shellcode generation process converts standard executable files into a format that can be injected and executed within existing processes, making it useful for post-exploitation activities and payload delivery mechanisms.

Tags: PE File, Shellcode, Windows, Code Injection, Payload Generation, Process Injection, Memory Forensics

## Quick facts

- Category: [Offensive Security](https://cybersectools.com/categories/offensive-security-testing) · [Red-Team & Adversary Emulation](https://cybersectools.com/categories/offensive-security)
- Deployment: On-Premises
- Company size fit: Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 4,492
- Website: github.com

## Donut FAQ

### What is Donut?

Donut is a product in the Red-Team & Adversary Emulation category. It covers PE File, Shellcode and Windows.

### What is the pricing for Donut?

Donut is free. Download and setup instructions are at https://github.com/TheWover/donut/.

### What are alternatives to Donut?

Alternatives to Donut listed on CybersecTools:

1. [Fortra Cobalt Strike](https://cybersectools.com/tools/fortra-cobalt-strike) - Threat emulation product for adversary simulations and red team operations (Commercial)
2. [Core Security Outflank Security Tooling](https://cybersectools.com/tools/core-security-outflank-security-tooling) - Red team toolkit for EDR evasion, initial access, and post-exploitation. (Commercial)
3. [Trickest Attack Surface Management](https://cybersectools.com/tools/trickest-attack-surface-management) - Platform for offensive security operations including ASM, VA, and DAST (Commercial)
4. [GoSecure Titan® Adversarial Simulation](https://cybersectools.com/tools/gosecure-titanr-adversarial-simulation) - Human-led adversary emulation service testing detection & response capabilities (Commercial)

Compare all Donut alternatives at [https://cybersectools.com/alternatives/donut](https://cybersectools.com/alternatives/donut)

### What deployment and organization size does Donut fit?

Donut is available as on-premises. It is listed for mid-market and enterprise organizations. It is free.

## Compare Donut with similar solutions

- [Donut vs Fortra Cobalt Strike](https://cybersectools.com/compare/donut-vs-fortra-cobalt-strike)
- [Donut vs Core Security Outflank Security Tooling](https://cybersectools.com/compare/core-security-outflank-security-tooling-vs-donut)
- [Donut vs Trickest Attack Surface Management](https://cybersectools.com/compare/donut-vs-trickest-attack-surface-management)

All alternatives to Donut: [/alternatives/donut](https://cybersectools.com/alternatives/donut)

---

Source: https://cybersectools.com/tools/donut

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on Donut: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md