git404hub

what is byor fr?

joasasantos/byor — explained in plain English

Analysis updated 2026-05-18

29Audience · developer

tl;dr

A curated research list of writeups and tools about bypassing reputation based security defenses like Windows SmartScreen by hijacking existing trust.

vibe map

mindmap
  root((BYOR))
    What it does
      Curated research list
      Reputation bypass techniques
      No installable code
    Tech stack
      Research writeups
      PoC links
    Use cases
      Study bypass techniques
      Defensive research
      Find CVE writeups
    Audience
      Security researchers
      Red teams
    Topics
      SmartScreen MOTW
      WDAC bypass
      Supply chain abuse

Code map

Detail Auto

An interactive map of this repo's files and how they connect — its source is parsed live in your browser. Click Visualize to build it.

filefunction / class

what do people make with this?

VIBE 1

Research how reputation based defenses like SmartScreen or Safe Browsing can be bypassed.

VIBE 2

Find published writeups and CVEs about Mark of the Web bypass techniques.

VIBE 3

Understand supply chain and domain reputation abuse for defensive security work.

how it stacks up fr

joasasantos/byor2836048681/cc-switch-codexcontable-rip/cc-visionrouter
Stars292929
LanguageRustJavaScript
Setup difficultymoderateeasy
Complexity3/52/5
Audiencedeveloperdeveloperdeveloper

Figures from each repo's GitHub metadata at analysis time.

in plain english

This repository is a curated reading list, not a piece of software, that collects writeups, research, tools, and proof of concept code about a category of security bypass technique called Bring Your Own Reputation, or BYOR. The core idea it documents is that many security defenses on Windows and the web decide whether to trust a file or website based on reputation signals, such as how old a file is, how many people have downloaded it, whether it carries a valid digital signature, or how a domain has behaved in the past. Attackers can sometimes sidestep these checks not by building trust from scratch but by hijacking trust that already exists, for example reusing an old signed program, a purchased certificate, or a popular cloud subdomain. The list is organized by defense mechanism. It covers Windows SmartScreen and the Mark of the Web flag that browsers attach to downloaded files, ways attackers have bypassed that flag using container file formats like ISO or VHD disk images, Windows Defender Application Control policies, the newer Smart App Control feature, and Google Safe Browsing along with broader domain and email reputation systems. It also covers abuse of trusted cloud hosting platforms, malicious advertising networks, and trust placed in already popular websites, plus a section on abusing trust within the software supply chain itself, such as compromised maintainer accounts. Each section links out to external blog posts, security research reports, published CVE writeups, and open source proof of concept tools that demonstrate a specific technique, along with a mapping to the industry standard MITRE ATT&CK framework for classifying attacker behavior. The README frames this explicitly as research material: understanding how reputation based defenses can be bypassed so that defenders, red teams, and security researchers can recognize and close these gaps. There are no installation instructions because the repository itself is just a structured index of links, and it accepts community contributions of new techniques and sources.

prompts (copy fr)

prompt 1
Summarize the main categories of reputation based defense bypasses covered in this list.
prompt 2
Explain how the Mark of the Web bypass with container files like ISO or VHD works.
prompt 3
Help me map the techniques in this list to the MITRE ATT&CK framework.
prompt 4
What defensive steps could mitigate the Smart App Control bypass techniques listed here?
peek the repo → explain another one

This repo across BitVibe Labs

double-check against the repo, no cap.