Flagship tool
DLLHijackHunter
Automated discovery, validation, and confirmation of DLL hijacking paths on Windows.
- language
- C# / .NET 8.0
- license
- MIT
- platform
- Windows
- stars
- — ★
Most scanners stop at detection and leave you to triage a wall of maybes. DLLHijackHunter goes one step further: it proves a hijack actually loads before it ever calls it a finding.
Selected for Arsenal
DLLHijackHunter: Validation-Driven Discovery and Confirmation of DLL Hijacking Paths on Windows
Black Hat SECTOR Arsenal · Toronto · October 6–8, 2026
The differentiator
Canary confirmation
A canary is a harmless, uniquely-named DLL. DLLHijackHunter plants it into a candidate directory and watches for it to load. If it loads, the path is proven exploitable. If it does not, the tool refuses to call it a finding.
The unique per-run name makes confirmation unambiguous: the DLL that loaded is our DLL, in this run, from this directory. That is what separates a confirmed path from a hopeful one, and it is why the output stays clean where Robber, DLLSpy and WinPEAS produce noise.
Capabilities
What it does
Canary confirmation
A benign, uniquely-named DLL is planted into each candidate directory. If it loads, the path is confirmed. If it never loads, it is never reported as exploitable. This is the core of the tool.
False-positive elimination
KnownDLLs, fully-qualified paths, SxS manifests and non-writable directories are filtered out before confirmation, so the output is signal, not noise.
Impact scoring
Confirmed paths are ranked by writability, integrity delta, autostart potential and blast radius, so the highest-impact issue sits at the top.
Reports that travel
Console, JSON and HTML output, ready to drop straight into an assessment, a ticket, or a CI pipeline.
How it runs
A four-phase pipeline
Confirmation only makes sense as the final gate of a disciplined pipeline. Each phase narrows the field before the next begins.
- 01
Discovery
Enumerate load targets and the DLLs they resolve by name, accounting for the full Windows search order and its short-circuits.
- 02
Filtration
Drop candidates that are provably safe: KnownDLLs, fully-qualified paths, non-writable directories, manifest-pinned assemblies.
- 03core
Canary Confirmation
Plant a canary, trigger the target, observe the load. The step that turns a suspected path into a confirmed one.
- 04
Scoring
Rank confirmed paths by impact so triage starts where it matters most.
Configuration
Five scan profiles
The same pipeline runs at different levels of aggression, because a red-team operator and a defender hardening a build server want very different behaviour.
SafeRead-only reconnaissance. No canaries are planted.
StrictConfirm only, minimal footprint, conservative triggering.
AggressiveExhaustive discovery and broad confirmation.
RedteamConfirmation tuned for operational realism and stealth.
UAC-bypassFocus on paths that cross an integrity boundary.
Output formats
- Console
- JSON
- HTML
Every format carries the same verdict: each reported path is confirmed, with the canary evidence attached.
Presented at
Black Hat SECTOR Arsenal 2026
Arsenal · SECTOR
- Location
- Toronto
- Dates
- October 6–8, 2026
Session
DLLHijackHunter: Validation-Driven Discovery and Confirmation of DLL Hijacking Paths on Windows
Black Hat Arsenal is the event's live tooling track, where researchers demonstrate open-source security tools to the community. DLLHijackHunter was selected to present its validation-driven approach to DLL hijacking on Windows.