Cryptography

CTFlearn-Writeups is a compilation of detailed solutions for various Capture The Flag challenges across multiple domains such as Cryptography, Forensics, and Web security. The tool serves as a reference for practitioners and enthusiasts looking to enhance their skills in cybersecurity challenge-solving. Notable features include categorized writeups that cover a range of problem types, providing structured insights into methodologies and techniques used in each challenge.

ChronoVault is a sophisticated game profile management tool designed to enhance single-player narratives by allowing users to architect alternate realities within their gaming experiences. Unlike traditional save editors, it provides comprehensive features such as relationship mapping, inventory weaving, and resource flow balancing to ensure narrative coherence and immersion. Its responsive interface and multilingual support further elevate the user experience, making it accessible and intuitive for gamers at all levels.

Awesome Privacy Tools is a curated repository that aggregates the best open-source privacy tools, covering categories such as encrypted messaging, anonymous email services, VPNs, and password managers. Its primary use case is to provide users with practical solutions for enhancing privacy across various digital activities. Notable features include a comprehensive list of tools sorted by use case, selection criteria for quality, and links to further resources on privacy-enhancing practices.

Next PGP is a Progressive Web App designed for intuitive PGP key management and secure messaging. It offers robust features such as multi-algorithm key generation, batch file encryption, and a user-friendly interface for seamless operation, while incorporating advanced security measures like end-to-end encryption and efficient cloud key management. The tool leverages modern technologies for a responsive experience, ensuring high performance through web worker multithreading, all while supporting secure local storage and cross-platform access.

Stratum C2 is a cloud persistence framework designed to maintain command-and-control (C2) communication through trusted cloud storage providers like Dropbox and OneDrive, thus avoiding detection by traditional security defenses. Its notable features include end-to-end encryption with RSA and AES, the ability to switch between multiple cloud providers seamlessly, and a structurally unblockable channel that makes it difficult for security operations centers to intercept. The framework supports multiple agent formats for both Windows and Linux without requiring additional dependencies.

dex-common is a monorepo containing shared NuGet libraries for developing microservices using .NET 8. It features modular components for transactional reliability, auditing, messaging, and security, including tools for handling outbox patterns, client-server auditing systems, and securing configuration data. Each module is independently packaged and published, facilitating seamless integration and development of microservices.

ObuscatedBOT is a multi-functional Telegram bot designed for performing instant network scans and providing security insights, aimed at ethical hackers and security enthusiasts. Key features include real-time alerts for suspicious activity, comprehensive vulnerability reports, and a user-friendly interface within the Telegram platform, facilitating easy navigation and interaction.

WinSecRuntime is a Windows runtime security library implemented in C++20, designed to enhance application integrity by providing defensive mechanisms against tampering, debugging, and injection attacks. It features a modular architecture that supports header-only usage, static libraries, and hardened DLLs, allowing developers to configure anti-debugging, anti-hooking, and memory safety checks tailored to their security needs. The library emphasizes redundancy and safe detection methods rather than deceptive techniques, making it suitable for production environments focused on security hardening.

Databoxer is a lightweight, cross-platform data encryption tool designed for efficiency, safety, and user-friendliness. It employs the ChaCha20 encryption algorithm combined with the Poly1305 hash function, allowing for secure, fast encryption of files, which are stored in a unique `.box` format encapsulating data integrity and metadata. Notable features include a profile management system for key storage and planned integration with native keyring tools for enhanced security.

The TikTok X-Mssdk-Info Reverse Engineering & Decrypter is a comprehensive Python tool designed to analyze and decrypt the X-Mssdk-Info telemetry header used by TikTok for device fingerprinting and security measures. It operates without external dependencies, enabling users to generate and decrypt the header payloads for API verification and device registration processes. Notable features include a complete implementation of the XXTEA encryption algorithm used by TikTok, alongside detailed instructions for payload generation and decryption.

Ghidrust is a Rust-based reverse-engineering toolkit designed for analyzing PE and ELF binaries, offering multi-architecture support through Capstone-class listings and pseudo-C decompilation. Its key features include a headless CLI, a GUI interface, an experimental GPU decompilation capability for enhanced performance, and integrated network analysis via Ghidnet for process attribution and IDS records. Ghidrust aims to improve upon Ghidra's analysis speed and output quality while maintaining a small, auditable core.

Secutils.dev is an open-source security toolbox designed for engineers and researchers, bridging the gap between complex enterprise solutions and scattered simple tools. It offers a guided experience for managing diverse security tasks, including webhooks for rapid API mocking, templates for cryptographic testing, and tools for Content Security Policy management. Notable features include user-friendly access to single-page tools, which do not require sign-up and provide stable URLs for easy sharing and AI-agent skills for enhanced automation.

The Cyber Security 101 repository provides comprehensive technical documentation for beginners engaged in the TryHackMe Cyber Security learning path. It includes structured notes, commands, and walkthroughs across 14 modules covering vital topics such as networking, cryptography, operating systems, offensive and defensive security, and career guidance, along with over 56 hands-on labs and essential cybersecurity tools and methodologies. This resource serves as a detailed study notebook, supporting learners in building foundational knowledge and skills in cybersecurity.

Chaos Zero Nightmare ASSet Ripper is a specialized asset extraction tool designed to retrieve encrypted game assets from the Yuna engine and specific anime games. It features support for exporting various formats, including SCT images as PNG, encrypted databases as JSON, and SCSP Spine format, with an integrated viewer for the latter. The tool allows users to navigate a file tree for asset management and enables batch exports of selected files and folders, enhancing usability for game modding and asset repurposing.

Hide.me · VPN client. Encrypt traffic, switch regions and protect sessions on public Wi-Fi. Total feature availability — professional edition behavior on desktop.

KeyDot is a high-performance command-line tool that extracts encryption keys and detects engine versions from compiled Godot Engine games, specifically targeting Windows x64 executables and WebAssembly (`.wasm`) files. Its primary use case is static analysis of game files without requiring runtime execution, which enhances safety and efficiency. Notable features include optimized C++ code for rapid extraction, memory-mapped file usage for low memory consumption, and unique support for WASM files, making it an essential tool for developers working with Godot Engine games.

Zombieland is a browser-based command and control (C2) dashboard frontend designed for educational and authorized penetration testing research. It features mock agent management with grid and list views, a global console for broadcasting commands, and a modular UI that supports customization and enhanced visual effects. The tool is currently in development for backend and agent components, aiming for cross-platform compatibility and improved user management in future releases.

Aegis Vault is an offline password, identity, and secret management tool that operates solely on the user's local machine without requiring any server or cloud connectivity. It allows users to securely store various account types, including logins, API keys, SSH keys, and database credentials, all encrypted under a master password. Notable features include a modern web-based interface, a password generator, easy installation commands for multiple platforms, and robust security measures with no third-party dependencies.

The TikTok Signature Generator is a Python tool designed to create valid signatures for TikTok Web API requests, specifically **X-Gnarly**, **X-Bogus**, and **X-Dynosaur** signatures. It features support for SDK version 5.1.2 and employs advanced encryption and hashing algorithms, including ChaCha20 and RC4, to ensure secure and dynamic signature generation. This lightweight and production-ready implementation is tailored for developers seeking to interact with the TikTok API effectively.

The VSphereRansomwareRecovery tool provides a recovery solution for virtual machines affected by Babuk-family ransomware on ESXi hosts. It facilitates the restoration of virtual disks ending in `.babyk` through partition table rebuilding and file system recovery, ensuring minimal data loss in the process. Notable features include the capability to leverage AI agents for automated recovery steps and the assurance of recovering readable data from the majority of affected disk space.

PW is a web-based tool designed for securely sharing confidential information, with all data encrypted in the browser. Its primary use case includes sharing secrets through supported media types such as text and files while maintaining low resource usage and offering dynamic configuration limits based on IP whitelisting. Notable features include a fast performance due to Svelte and Rust, multi-language localization support, and a user-friendly interface with dark theme options.

Bitwig Nitro Tools is an offline reverse-engineering toolchain specifically designed for the Nitro DSP format used in Bitwig Studio. It facilitates the decryption, decompilation, parsing, editing, and re-serialization of native devices and Grid modules, allowing users to comprehensively analyze and modify the digital signal processing behind each module. Key features include the ability to extract keys from the user's Bitwig installation, decompile modules into readable pseudo-source format, and repack modified modules without altering their byte structure, ensuring a seamless editing experience.

McAFuse is an open-source utility designed for the Digital Forensics and Incident Response (DFIR) community to handle encrypted disk images created with the McAfee Full Disk Encryption (FDE) toolset. The tool provides a static read-only FUSE filesystem, allowing users to access both a plain FAT partition and the encrypted disk image, facilitating the analysis of encrypted data during digital investigations. Notable features include the ability to specify a keyfile for decryption, options for verbose output, and functionality to expose all disk contents beyond just the encrypted volumes.

This repository offers a curated collection of over 70 free cybersecurity books organized by domain and difficulty, facilitating self-paced learning in various cybersecurity disciplines. Notable features include a structured learning roadmap progressing from beginner to advanced levels, an emphasis on community maintenance for up-to-date resources, and a direct link to an extensive Google Drive library containing the materials.

NightWriter is a secure document creation tool that employs end-to-end encryption and real-time collaborative editing, making it ideal for users who prioritize document security and collaboration. It utilizes Markdown for exportability, allowing easy conversion to multiple file formats, while its backend is developed using Go, enhancing its performance and scalability. Notable features include a robust encryption scheme based on RSA and AES 256, ensuring that sensitive content and user credentials remain inaccessible to the server or unauthorized users.

crypt.fyi is a secure, zero-knowledge secret sharing platform that employs end-to-end encryption and ML-KEM post-quantum cryptography for the safe transmission of sensitive data. Its notable features include strict content security policies, rate limiting, automatic expiration of secrets, optional password protection, and drag-and-drop file sharing, along with webhook notifications and extensive internationalization support. The architecture ensures that the server never accesses unencrypted data, reinforcing user privacy and data integrity.

C1ZX is a professional dual-table Unicode substitution cipher tool that uses two independent substitution tables to encrypt printable ASCII characters, enhancing security by reducing simple repetition patterns. It features fully reversible encryption, extensive validation, automated self-testing, and supports terminal Unicode compatibility detection, making it robust for various platforms including Windows, Linux, and macOS.

Knife is a comprehensive binary analysis tool designed for reverse engineers, enabling static examination of PE, ELF, and Mach-O file formats without execution. It consolidates multiple analysis functions—such as header parsing, IOCs extraction, and disassembly—into a single command, while providing detailed triage reports on exploit mitigations and dangerous API calls. Key features include a variety of commands for deep analysis, an interactive TUI mode, and extensive output options tailored for vulnerability research and malware analysis.

malsnitch is a command-line tool designed to assist malware reverse engineering by scanning various artifact formats for embedded secrets within binaries. Its notable features include the ability to detect hardcoded credentials, C2 infrastructure, and crypto keys in binary files, with support for multiple input formats such as raw strings dumps, FLOSS JSON output, and Binary Ninja exports. The tool also offers structured JSON output, automatic deduplication, and the capability to scan memory dumps, making it an efficient resource in identifying obscured sensitive information utilized by malware authors.

The Quarkslab repository serves as a comprehensive archive of presentations delivered at various conferences and seminars, focusing on topics related to cybersecurity, reverse engineering, and hardware challenges. It features notable material such as workshop slides and papers on advanced techniques in Bluetooth hacking, binary instrumentation, and exploiting software vulnerabilities. This resource is primarily used for sharing knowledge and promoting discussions within the cybersecurity community through detailed lecture content and insights from industry experts.

Malware Research Hub is a comprehensive local platform designed for malware intelligence, featuring a curated forensic catalog with 2,699 live specimens and a proprietary search engine. Its primary use case is to provide researchers and cybersecurity professionals with an extensive, accessible repository of real malware samples indexed by family and type, while ensuring safety through encrypted storage and a containment-focused design. Notable features include a detailed forensic catalog, an automatic specimen downloader, and a bilingual interface for enhanced usability.

Envy is a local-first secret management tool that encrypts sensitive data using AES-256-GCM, ensuring that secrets are never stored in plaintext, whether on disk or in version control. Its key features include zero-trust storage with master key protection in the OS Keychain, memory-safe secret injection with automatic zeroing of sensitive data, and GitOps-native workflows that allow teams to manage secrets securely without reliance on external services. Additionally, Envy provides a pre-encrypt audit trail for visibility before sealing changes, facilitating multi-team access control with separate passphrases.

This repository offers a collection of tools and scripts specifically designed for reverse engineering computer and console games using Python 3 and MexScript. The scripts are ready to run without compilation, requiring only appropriate interpreters such as Python or quickBMS, making them accessible for game modding projects. Notable features include the variety of tools developed over years of expertise in game reverse engineering, providing practical support for modders.

TinyLoad is a PE crypter and packer for 64-bit Windows executables, designed to protect input binaries against reverse engineering by appending a payload to itself and employing various layers of encryption and compression. It features a custom VM encryption method with obfuscated opcodes, a unique LZ77 compression algorithm, and Veh page fault decryption to keep most of the payload encrypted in memory during execution. Additionally, it includes anti-dumping techniques to safeguard critical APIs and prevent reconstruction of the import table.

The Cybersecurity Handbook is an interactive, open-source knowledge base tailored for cybersecurity professionals, students, and enthusiasts. It offers over 400 comprehensive notes on diverse topics, enhanced by an interactive knowledge graph, full-text search capabilities, and a user-friendly interface that supports dark/light modes and is mobile-friendly. This community-driven resource keeps pace with the rapidly evolving cybersecurity landscape, providing practical insights into real-world threats and defense strategies without any paywalls.

SecureFolderFS is a file encryption tool designed to protect user data through advanced cryptographic algorithms and on-the-fly encryption, ensuring that files are accessible only to authorized users. It offers a seamless experience across multiple platforms, allowing users to create secure vaults for sensitive information, which remain encrypted until the correct credentials are provided for access. Notable features include a user-friendly interface, consistent functionality across various devices, and strong security guarantees that prevent unauthorized decryption.

Brochacha20 is a discontinued static client decryptor for Roblox, designed to extract and decrypt game files from the Roblox client directory. Users can specify a directory path and optional output file via command-line arguments, with features including silent mode and manual issue reporting through GitHub. Despite its current inoperability, the tool provides insights into the decryption process of Roblox's runtime page data.

Awesome Crypto Tools Directory is a comprehensive, curated resource designed for traders, DeFi users, and compliance professionals to efficiently compare and utilize various cryptocurrency and blockchain tools. It categorizes tools across multiple domains such as exchanges, wallets, DeFi protocols, and compliance solutions, allowing users to make informed decisions with detailed feature scores and rankings. Notable features include a broad index for trading, investing, security, research, and building resources, tailored to enhance user accessibility and decision-making in the crypto space.

Android Security is a comprehensive resource aimed at enhancing secure app development for Android through various methodologies such as reverse engineering, vulnerability testing, and data protection best practices. Notable features include a catalog of online analyzers and static analysis tools that facilitate multi-faceted security assessments, providing developers the means to identify and mitigate vulnerabilities within their applications effectively.

appdecrypt is a tool designed to decrypt encrypted application binaries on macOS systems that have System Integrity Protection (SIP) enabled, particularly for versions 11.2.3 and below, as well as macOS 15.0-15.2 leveraging CVE-2025-24204. It provides a command-line interface for both macOS and jailbroken iOS devices, allowing users to specify the paths for the encrypted application and the desired output for the decrypted binary. Notable features include support for processing applications and frameworks within the app bundle, as well as the ability to bypass iOS runtime challenges with a dedicated script for iOS devices.

Flexdecrypt is a decryption tool designed specifically for iOS applications and Mach-O binaries, enabling researchers to decrypt files from disk using mremap_encrypted. It allows for easy installation via a .deb package or manual build through Xcode, supporting custom entitlements with AppSync. Notable features include compatibility with debugging through Xcode and dependency resolution for versions of iOS 12.1 and lower.

IPFS-Chat is a decentralized, peer-to-peer messaging tool that utilizes IPFS pubsub for real-time communication, enabling secure chat, file sharing, and private messaging across both internet and LAN environments. It features a minimal terminal-based interface, automatic NAT-traversal, end-to-end encryption for messages and shared files, and a fully serverless architecture that prevents censorship. Developed in Bash, it is efficient in resource usage and includes malware scanning for shared content, making it suitable for secure and private online communication.

XELIS is a pioneering blockchain platform utilizing a BlockDAG architecture designed to enhance privacy, speed, scalability, and support for smart contracts. Key features include a unique egalitarian PoW algorithm for accessibility, instant synchronization for wallet usability, and a sophisticated difficulty adjustment mechanism employing Kalman Filters to maintain network integrity. Additionally, XELIS offers robust privacy through homomorphic encryption, enabling secure transactions and the deployment of decentralized applications within a sandboxed environment.

A quick and dirty PCAP parser that helps you identify who your applications are sending sensitive data to without encryption.

Grandmaster is a Python-based tool designed for automating the decryption of iOS firmware utilizing libraries such as img4lib and ipwndfu. Its primary use case is to streamline the process of generating configuration files and extracting keys for iOS devices, with notable features including batch processing via multi_grandmaster.py, USB device scanning, and integration with the Foreman keystore server for secure key management.

iphone_backup_decrypt is a Python tool designed to decrypt local iPhone backups created from iOS 13 or newer, utilizing a strong key derivation process involving PBKDF2 with SHA256 and SHA-1. Its primary use case is to extract specific files from encrypted backups, such as call history or WhatsApp messages, through a straightforward API which includes predefined relative paths and domain matching capabilities. Notable features include support for both a fast PBKDF2 implementation for improved performance and flexible extraction methods that allow users to navigate and manage backup contents easily.

RsaCtfTool is an RSA multi-attack framework designed for decrypting data from weak public keys and recovering corresponding private keys through a variety of factorization techniques and non-factorization attacks. It supports multiple algorithms to enhance decryption capabilities while primarily serving educational purposes, with features like Wiener's attack, Hastad's attack, and various integer factorization methods. The tool can be utilized via command-line arguments for specific tasks such as recovering private keys and decrypting files.

ssh-audit is a comprehensive auditing tool for SSH servers that evaluates security configurations and algorithms used in SSH1 and SSH2 protocols. Key features include the ability to gather information about key-exchange, host-key, and encryption algorithms, alongside offering recommendations and security insights based on recognized software versions. With no dependencies and compatibility with multiple Python versions, the tool facilitates detailed analysis while retaining ease of use through various command-line options.

The tool "teams_dump" is a proof of concept for extracting and decrypting cookies from the latest version of Microsoft Teams. Its primary use case is to enable users to list and dump cookie data from the Teams database into a JSON file, facilitating access to stored cookie information. Notable features include a Python script for direct extraction and a bundled executable version, simplifying the extraction process for users.

Tinfoil-Chat is a simple chat application that implements 2048-bit RSA encryption, designed primarily for educational purposes in learning encryption, GUI development, and networking concepts. Notable features include a user verification process to mitigate man-in-the-middle attacks and the utilization of randomly generated usernames and RSA keys for enhanced anonymity. However, the tool comes with significant security vulnerabilities, such as susceptibility to attacks due to the use of the pickle library and flaws in the RSA key management.

JWCrypto is a Python library that implements specifications from the JOSE Working Group, including JSON Web Signature (JWS), JSON Web Encryption (JWE), and JSON Web Token (JWT). Its primary use case is to facilitate secure signing and encryption of JSON objects for authentication and authorization purposes. Notable features include support for multiple cryptographic algorithms and comprehensive documentation, although it notes the deprecation of the RSA1_5 algorithm due to security vulnerabilities.

The NYU CTF Automation Framework comprises advanced LLM agents designed to automate the solving of Capture the Flag (CTF) challenges within a Docker environment. Key components include the D-CIPHER multi-agent framework, which features a planner, executor, and auto-prompter for enhanced problem-solving interactions, as well as a baseline agent for comparison purposes. This framework is intended for researchers and developers aiming to leverage AI in cybersecurity competitions and is built to facilitate easy setup and experimentation with CTF datasets.

Tomato is a steganography tool that embeds hidden messages within natural language text by utilizing minimum-entropy coupling (MEC) code, enabling the creation of undetectable stegotext. Its primary use case is to securely encode and decode plaintext messages while preserving the statistical properties of the cover text, ensuring seamless integration and accurate retrieval of hidden information. Notable features include the use of an LLM for generating coherent cover text and a user-friendly command-line interface for encoding and decoding functionalities.

pager-sec is a research project aimed at highlighting and addressing security vulnerabilities in medical pager systems, which often transmit sensitive health information without encryption. It demonstrates the ease of intercepting and decoding pager messages using affordable hardware like SDRs, and provides a proof of concept for enhancing pager security through practical solutions. Notable features include the use of software-defined radio for message interception and an Arduino-based implementation to illustrate security improvements.

The "Awesome Node.js for pentesters" repository provides a curated list of Node.js packages tailored for penetration testing, exploitation, reverse engineering, and cryptography. Its primary use case is to serve as a comprehensive toolkit for security professionals, featuring various modules for tasks such as OSINT, network scanning, brute-forcing, and post-exploitation techniques. Notable features include integration with the OWASP ZAP API, access to Shodan and Censys APIs, as well as utilities for geolocation and fingerprinting.

Ghidra FindCrypt is an analysis module for Ghidra that automates the detection of cryptographic constants within binary files. It leverages the Ghidra API to efficiently label identified constants with their associated algorithms, which are grouped under the prefix `CRYPT_` in the Symbol Tree. Notable features include automatic datatype assignment for found constants and detailed comments that specify the type and size of detected cryptographic data.

Ticker is a terminal-based tool designed for monitoring live stock and cryptocurrency prices, alongside tracking the value of stock positions with support for multiple cost basis lots. Its notable features include pre and post-market price quotes, customizable watchlists, and detailed summaries of stock positions, providing a comprehensive overview of investment metrics.

Trillian is a scalable implementation of verifiable data structures, particularly designed for transparency logging applications, such as Certificate Transparency. It utilizes a Merkle tree architecture to provide a robust, append-only log mode that supports large data volumes, enabling developers to create custom applications, or "personalities," on top of its core functionality. Although Trillian is in maintenance mode and encourages the use of its successor Tessera for new implementations, it remains a valuable tool for organizations requiring a stable transparency log system.

BEAR-C2 is a command and control (C2) framework designed for simulating attacks that mimic techniques utilized by Russian APT groups. It features robust encryption methods such as AES and RSA for secure communications between malware payloads and operators, along with advanced functionalities like payload execution, SmartScreen bypass, and UAC evasion. This tool is intended solely for educational and research purposes, emphasizing the importance of ethical usage.

Vault is a secure tool designed for managing and accessing secrets, such as API keys and passwords, with a focus on tight access control and detailed audit logging. Its primary use case is providing dynamic and secure secret storage while enabling features like dynamic secret generation, data encryption, lease management, and revocation capabilities. Notable features include encrypted storage, on-demand secret generation for cloud services, and comprehensive auditing of access and operations for security compliance.

AgileStringDecryptor is a dynamic decryption tool designed to reverse agile strings using the Invoke framework. Its primary use case is to facilitate the analysis of obfuscated strings in code, particularly for security professionals assessing malware or reverse engineering applications. Notable features include its reliance on dynamic invocation techniques to decrypt data effectively.

Cryptoshark is a self-optimizing cross-platform code tracer that operates at the machine code level using dynamic recompilation, facilitated by Frida and Capstone. Its primary use case is to analyze and log API function calls in real time, enabling developers to study targeted functions by injecting instrumentation code without requiring the source code. Notable features include thread tagging based on API usage and a robust build system that supports creating portable binaries for various operating systems.

dumpdecrypted is a tool designed for obtaining decrypted copies of iPhone applications, serving as a more effective alternative to GDB scripts in scenarios where GDB is not functional. Its primary use case is for security researchers, allowing them to inspect application binaries by dumping the decrypted executable while addressing sandboxing challenges encountered during operation. Notable features include automated detection of encrypted data, support for FAT binaries, and the capability to write decrypted output to designated locations, accommodating various sandbox constraints.

sslscan is a security tool designed for scanning SSL/TLS services, providing detailed analysis of supported protocols, cipher suites, and certificate details. Its notable features include the ability to scan legacy and modern protocols, comprehensive output for identifying weaknesses (such as weak ciphers and certificates), and support for the latest cryptographic standards, as well as legacy systems. The tool also offers extensive configuration options and outputs, including XML formatting, making it highly adaptable for various security assessments.

Swift Crypto is an open-source library that implements a significant portion of Apple's CryptoKit API for use on Linux and ARM64 Windows platforms, facilitating cross-platform cryptographic functionality. It provides safe and abstracted APIs for various cryptographic operations such as key exchange, encryption, hashing, and authentication, while ensuring adherence to cryptographic best practices. Notably, Swift Crypto includes a backing implementation utilizing BoringSSL and XKCP, and offers an additional product, CryptoExtras, which contains APIs specifically designed for server applications.

TP-Link Decrypt is a tool designed to extract RSA and DES keys from TP-Link firmware, facilitating the analysis of network switch firmware for security research. It supports both traditional TP-Link devices and Omada switches, enabling users to decrypt firmware files for vulnerability assessment. Notable features include an easy-to-use extraction script and preinstallation guidance to satisfy dependencies, while ensuring compliance with TP-Link's licensing terms.

TP-Link Decrypt is a tool designed to extract RSA keys from TP-Link firmware, enabling security researchers to analyze firmware for vulnerabilities without the risk of creating unauthorized firmware. Notable features include a dependency script, key extraction capabilities, and the ability to decrypt firmware files, while ensuring compliance with TP-Link's rights by using publicly available RSA keys. This project has been deprecated as of October 2025, with ongoing support transitioned to a different repository.

TrollDecryptor is a tool designed to decrypt App Store applications for use with TrollStore. Its primary use case is to enable users to extract and access the decrypted .ipa files of applications by providing the app's process ID (pid) obtained from CocoaTop. Notable features include a straightforward user interface for decryption and integration with Theos for building the application package.

Awesome Infosec is a curated collection of Information Security resources and tools designed to aid individuals in their studies and practices of cybersecurity. It encompasses various topics, including recon, web security, penetration testing, and exploit development, while also providing links to educational courses and labs. The continuously updated repository serves as a valuable resource for both beginners and experts in the field.

Golden dMSA is a cybersecurity tool that facilitates the exploitation of delegated Managed Service Accounts (dMSAs) through the "Golden DMSA" attack, allowing unauthorized password generation for dMSAs offline. Key features include the ability to extract KDS Root keys, enumerate dMSA accounts, guess ManagedPasswordIDs, and generate valid passwords, making it a potent tool for penetration testing and security assessments of systems with vulnerabilities in dMSA authentication. The tool is built for .NET Framework 4.7.2 and includes functionalities for password conversion, information gathering on dMSAs and KDS keys, as well as brute force password attacks.

rfxn-defense is a Linux defense tool that provides a responsive mitigation layer against local privilege escalation (LPE) vulnerabilities by deploying kernel-level protections as soon as new vulnerabilities are identified. It supports automatic updates every four hours and requires no system reboots to apply mitigations, currently covering seven LPE classes across two families, including various techniques such as `LD_PRELOAD` and `modprobe` interventions. This tool is designed for ease of installation and ongoing security management within environments running Enterprise Linux distributions.

Bifrost is an open-source command and control (C2) tool implemented as a Discord bot, allowing users to manage and communicate with compromised clients through the Discord API. It supports multiple platforms and provides features such as keylogging, antivirus enumeration, real-time encrypted communication, and file management capabilities. Designed for educational and authorized security testing purposes, Bifrost leverages the Discord infrastructure to maintain a stealthy connection with clients.

DecryptRDCManager is a .NET tool designed to decrypt credentials stored in Remote Desktop Manager (.rdg) files, leveraging the functionality of RDCMan.DLL. Its primary use case is to extract and read encrypted user credentials, particularly those contained within the more reliable `<credentialsProfile>` section, while also providing an option to automate file detection via user settings. Notable features include the ease of building the tool and its ability to handle paths for .rdg files seamlessly, along with a focus on credential profile extraction for enhanced reliability.

Agent Loader is a modular command-and-control (C2) tool designed to facilitate the deployment of in-memory payloads and covert operations through a DNS-over-HTTPS channel. Its notable features include dynamic function encryption, a reverse-shell module, and extensive file system management capabilities, alongside a customizable CLI builder for creating tailored implants via Python. The tool also offers a Node.js web panel for interactive management, showcasing a bot list and persistence mechanisms through OneDrive and Task Scheduler.

MsfMania is a Python-based payload obfuscation framework primarily aimed at evading endpoint detection and antivirus systems on Windows platforms. It boasts notable features such as dynamic code generation, multi-layer encryption using RC4, local memory injection, and extensive metadata spoofing, making it suitable for authorized security testing and research activities.

BYOB is an open-source post-exploitation framework designed for educational purposes that facilitates command and control operations following a system compromise. It features a comprehensive web GUI for managing post-exploitation tasks, customizable payload generation for multiple platforms, and the ability to dynamically load third-party packages without leaving traces on the disk. The framework is optimized for ease of use, allowing students, researchers, and developers to extend its capabilities with minimal effort.

CryptoLyzer is a comprehensive security auditing tool that analyzes various cryptographic protocols, including TLS, SSL, SSH, IKE, and DNSSEC. It uniquely identifies over 400 cipher suites and cryptographic algorithms using a custom implementation that operates independently of OpenSSL, enabling the detection of vulnerabilities often missed by traditional tools. With both command-line and API interfaces, CryptoLyzer offers versatile output formats and a unified approach, making it an essential solution for security assessments across multiple cryptographic attack surfaces.

FerroCrypt is a specialized Rust library, CLI, and desktop application designed for secure file and directory encryption and decryption using both password-based and key-pair encryption methods. It allows users to create encrypted `.fcr` files that can securely be accessed by designated recipients through specific passphrase or public-key decryption methods. Notable features include an interactive command-line interface, support for multiple encryption methods, and an easy-to-use desktop application for end-users.

OpenShield is an open-source Cloud Security Posture Management (CSPM) tool designed specifically for Azure environments, enabling users to detect misconfigurations and improve security compliance by mapping issues to frameworks like CIS, NIST, and ISO 27001. Notable features include a comprehensive misconfiguration scanner, which evaluates over fifty security rules across various Azure services, and the ability to identify classical cryptographic assets that require migration to quantum-safe alternatives. The tool facilitates remediation through a single command, providing a user-friendly approach to enhancing cloud security for startups and small to medium-sized enterprises.

1time.io is a zero-knowledge one-time secret sharing tool that allows users to securely share passwords, API keys, and sensitive text via self-destructing links, utilizing end-to-end encryption. Key features include browser-based encryption with AES-GCM, self-destructing links post-read, encrypted file sharing, and support for a command-line interface, all without requiring user accounts. The tool can also be self-hosted using Docker Compose, enhancing flexibility for individual or organizational use.

Ward is a local-first secret firewall designed for development environments, ensuring that project environment variables are securely encrypted in a `.env.vault` file while allowing seamless terminal workflows and scoped access for AI agents. Notable features include a simple recovery flow that keeps plaintext secrets off servers, human mode for terminal session protection, and support for agent workflows through generated instructions, all while maintaining local metadata storage for added security.

Darkelf is a comprehensive ecosystem that offers a suite of privacy-focused browsers and security tools for cybersecurity professionals, researchers, and privacy-conscious users. It features enterprise-grade browsing capabilities, AI-assisted analysis tools, OSINT utilities, and extensive documentation to support both users and developers in utilizing and contributing to its projects. Notable technologies include post-quantum cryptography readiness, anti-fingerprinting research, and local AI security analysis.

Awesome Cryptography is a comprehensive repository that curates a variety of cryptography resources, tools, and frameworks, categorized for ease of access. Its primary use case is as a centralized knowledge base for cryptographic theory, algorithms, and practical tools across multiple programming languages. Notable features include an extensive listing of symmetric and asymmetric encryption algorithms, hash functions, and various educational materials, making it an invaluable resource for developers and researchers in the field of cryptography.

Nakamoto is a two-layer encryption tool designed to secure sensitive data and cryptocurrency private keys. It offers functionalities for generating random passwords, as well as encrypting and decrypting files, making it suitable for users seeking to enhance their data protection measures. Notable features include its dependency on OpenSSL for cryptographic operations and straightforward command-line usage for various encryption tasks.

`nix-secrets` is a lightweight secret management solution for NixOS that integrates seamlessly into the Nix module system, eliminating the need for external configuration files. It utilizes the age encryption format for secure secret storage and management, featuring templates, placeholders, and a simple CLI interface for key generation and secret editing. Notably, `nix-secrets` minimizes intermediate states and avoids public key leakage, offering a compact binary footprint compared to existing solutions like `sops-nix` or `agenix`.

Super Hash is a cross-platform file integrity verifier designed for generating and validating file hashes (MD5, SHA) with a focus on speed and a minimal footprint. Notable features include support for both Windows and macOS, a web app version, custom themes, and adherence to Material Design 3 principles, making it user-friendly and aesthetically pleasing. The tool is lightweight, with desktop installations around 3MB and web resources about 1MB, and offers both dark mode and PWA capabilities.

Drain is an open-source EVM wallet rescue and token migration tool designed to streamline the process of transferring native gas tokens and ERC-20 assets between wallets. It offers a user-friendly interface that connects to your wallet, identifies balances, and facilitates selective asset transfers while handling gas fees intelligently through atomic batched or sequential transfers. Notable features include the ability to resolve ENS names, display token logos and estimated USD values, and a non-custodial approach that ensures user control over private keys and transactions.

Meow-meow is a repository that compiles a diverse range of cybersecurity research results, showcasing both successful and experimental practical cases. Its primary use case is to serve as a resource for cybersecurity professionals and enthusiasts seeking insights into malware development and practical applications of ethical hacking. Notable features include links to various related publications and books authored by the creator, providing additional context and depth in the field of cybersecurity.

Awesome is an open-source repository that aggregates a variety of tools and resources across multiple domains including communication, development, finance, and information security. Its primary use case is to provide users with a centralized catalog of high-quality software, libraries, and educational resources, aiding in quick access to knowledge and tools. Notable features include a structured table of contents for easy navigation and a focus on simplicity, readability, and collaboration best practices.

Kagura is an LLVM-based code obfuscation and anti-tamper toolkit designed for mobile, desktop, and WebAssembly applications. It supports extensive protection mechanisms against threats such as static string extraction, decompiler-readable control flows, and dynamic instrumentation, employing techniques like string encryption, control flow flattening, and runtime checks. The toolkit integrates seamlessly with multiple platforms without requiring modification of the LLVM source tree, making it versatile for developers seeking enhanced security for their applications.

ReverseLab is an open-source reverse engineering lab designed for capturing and analyzing various attack scenarios across multiple domains, including CTF pentesting, APK reverse engineering, and PE binary analysis. Its notable features include a comprehensive knowledge base organized into specialized categories, over 100 automation tools for rapid execution, and a modular architecture that supports various signal types and attack chains. Users can easily set up the tool on multiple platforms with provided scripts, ensuring a streamlined onboarding experience.

Ghidra FindCrypt is an auto-analysis module designed for Ghidra to identify and label cryptographic constants within binary files. Its primary use case is to enhance code analysis by automatically recognizing cryptographic algorithms and assigning appropriate labels to found constants, which are prefixed with `CRYPT_` for easy identification. Notable features include integration with the Ghidra API for improved functionality, automatic datatype assignment for recognized constants, and the ability to rerun analyses safely.

TryHackMeWriteups is a comprehensive repository that curates free TryHackMe rooms, providing organized resources for cybersecurity enthusiasts to learn and practice various skills. Notable features include categorized rooms across diverse topics, detailed notes and summaries, step-by-step writeups for Capture The Flag challenges, and continuous updates, making it an ideal starting point for beginners in cybersecurity and ethical hacking.

Zemer-Cipher is an Android library designed for YouTube cipher deobfuscation and PoToken generation, facilitating the extraction of streaming URLs from obfuscated JavaScript. Key features include signature cipher deobfuscation, n-parameter transformations to mitigate throttling, and remote-updateable player configurations that allow real-time updates without requiring app releases. This library is crucial for applications leveraging the YouTube API to maintain functionality amid frequent player script rotations.

cryptz is an advanced encryption and decryption tool designed for secure data handling. Its primary use case involves encrypting sensitive information to prevent unauthorized access, and it features a user-friendly command-line interface to facilitate easy implementation. The tool is built using Python, with dependencies managed via a requirements file.

FCracker is a command-line tool designed for brute-forcing password-protected files, supporting various formats including zip, rar, pdf, and gpg on Linux systems. Intended for personal and capture the flag (CTF) usage, it integrates with John the Ripper or Hashcat for enhanced cracking capabilities. The tool requires specific dependencies and allows users to input target files and wordlists for the cracking process.

Flagy is a comprehensive toolkit designed for Capture The Flag competitions, integrating a wide array of cybersecurity tools across multiple domains including cryptography, forensics, reversing, steganography, and web security. Notable features include automated cryptanalysis tools, credential dumping utilities, and advanced reversing frameworks like Ghidra and radare2, all aimed at facilitating the installation and use of essential tools for both beginners and advanced users in security challenges.

The MT19937 Symbolic Execution and Solver tool provides a mechanism for symbolic execution of the MT19937 pseudorandom number generator, alongside a solver for GF(2) matrices, enabling cloning of the generator based on known outputs. Notable features include a Python-only solver for faster performance without dependencies and a wrapper for Cryptominisat, which enhances speed with proper compilation. The tool also facilitates state reversal of the MT19937 generator to predict prior outputs, despite some current limitations in functionality.

`patsac` is a Python toolkit designed to assist users in solving cryptography challenges, particularly in Capture The Flag (CTF) competitions. The toolkit includes functionalities for various cryptographic attacks, such as RSA decryption using Fermat's method and Linear Congruential Generators (LCG) cracking, making it a practical resource for cryptographic analysis and experimentation. It relies on several external libraries for enhanced computational capabilities, although it is still under development and may lack comprehensive documentation.

RSA-Common-Modulus-Attack is a Python 3 script designed to exploit the common modulus vulnerability in RSA encryption by recovering plaintext messages from two ciphertexts encrypted with the same modulus but different exponents. The tool requires the public keys of both ciphertexts and operates under the condition that the greatest common divisor of the two exponents is 1. Notable features include a simple command-line interface for inputting ciphertexts and public keys, as well as dependency management through a requirements file for easy installation.

Stegreg is a C++ based steganography tool that enables users to encrypt and conceal data within image files, specifically supporting JPG and PNG formats. Its primary use case is to hide messages within images through byte manipulation, while also allowing for easy extraction of the hidden data. Notable features include command-line options for encoding and decoding messages, as well as a straightforward installation process.

0xTwin is a Python-based tool for encoding and decoding text using the Twin-Hex Cipher, which transforms original text into a hex format, encoding two characters at a time. Its primary use case is for participants in Capture The Flag (CTF) events who need an offline utility to handle this specific cipher without relying on online resources. Notable features include simple command-line options for encoding and decoding, making it straightforward to use in various cybersecurity challenges.

BaseCrack is a Python-based decoding tool that supports a wide range of alphanumeric base encoding schemes, allowing for the rapid decoding of both single and multi-encoded inputs. Notable features include the ability to decode bases embedded in image EXIF data, perform OCR on images, and process multiple encodings from files, making it particularly useful for tackling complex Capture The Flag (CTF) challenges and steganography tasks.

Cryptosploit is a module-based cryptographic tool designed to streamline the process of decryption, decoding, and cracking through an organized library of scripts. It automates common cryptographic tasks, allowing users to easily search and execute various cryptographic modules without the need for extensive command-line flags or multiple tools. Key features include a user-friendly console interface for module selection, variable management, and the ability to search for modules using regular expressions.

CTF-CryptoTool is a Python-based utility designed for deciphering encrypted text encountered in Capture The Flag (CTF) challenges by employing brute-force techniques across a comprehensive array of known ciphers, encodings, and obfuscators. It allows users to input cipher text and optional keys to facilitate decoding, making it particularly useful for cryptanalysis tasks where keys may be unknown. Notable features include support for multiple ciphers such as Caesar, Vigenere, and various encoding formats like Base64 and Hex.

The `padding_oracle.py` tool automates padding oracle attacks in Python, enabling efficient decryption and encryption of vulnerable tokens. It features multi-threaded execution for improved performance, customizable logging options, and includes additional functionalities for URL and base64 encoding/decoding. This tool is particularly useful in penetration testing scenarios where padding oracle vulnerabilities are present.

Sobbu is a versatile cryptography tool that provides various encoding and encryption algorithms, along with a hash cracking utility designed to enhance cybersecurity tasks. Notable features include a user-friendly GUI, support for multiple platforms (Windows and Linux), and a wide range of algorithms, including classic ciphers and modern encryption methods. It also includes functionalities for hash decryption and a RainbowTable bot for efficient hash cracking.

The TryHackMe - Hackers Learning Path repository provides a structured framework for beginners in cybersecurity to learn and practice through a series of rooms and hands-on exercises. Key features include an automated environment setup script, instructional content covering foundational topics like Linux, networking, and various security tools (e.g., Nmap, Burp Suite, Metasploit), and practical penetration testing exercises to simulate real-world attacks. This resource is designed to guide users incrementally from introductory levels to more advanced cybersecurity skills.

xorhunx is a cryptography tool that implements the XOR cipher, featuring capabilities for encoding, decoding, and brute-forcing encrypted data. It is designed for multi-platform use, with installation instructions available for Linux, Windows, and Termux. Notable features include a straightforward command-line interface to manage the ciphering processes efficiently.

BerylEnigma is a comprehensive CTF and penetration testing toolkit designed to perform a variety of encryption, coding, and text manipulation functions. It features modern and classical cryptographic methods, encoding formats, and practical utilities including image processing and Red Team capabilities such as reverse shell generation and payload conversion. Built with JDK17 and the JAVAFX framework, it aims to assist security professionals and researchers with a wide range of functionalities in a user-friendly interface.

The CTF Resources repository is a comprehensive collection of cybersecurity tools and practice platforms specifically designed for Capture the Flag (CTF) competitions. It includes an extensive array of tools categorized into areas such as Open Source Intelligence (OSINT), steganography, and anonymous communication, offering functionalities from data gathering and analysis to secure and anonymous internet browsing. Notable features include links to various open-source tools, detailed descriptions, and categorization for ease of use, supporting users in enhancing their digital security skills.

Dragoman is a versatile decoding tool designed specifically for tackling cryptography challenges in Capture The Flag (CTF) competitions, providing a comprehensive suite of decoding scripts. It includes functionalities for a wide range of ciphers and encoding schemes, such as Base64, Caesar cipher, Morse code, and more, streamlining the process of flag extraction. This tool enhances efficiency by consolidating multiple decoding methods into a single framework, allowing users to quickly switch between different decoders.

Karkinos is a lightweight penetration testing tool designed for ethical hacking and CTF competitions, offering functionalities such as encoding/decoding, encryption/decryption, and hash cracking/generating. It features three distinct modules and includes a new port scanning demo, allowing users to test applications and networks they have authorization to assess. Built primarily using PHP and Python, Karkinos is compatible with any server capable of hosting PHP and is designed to be Raspberry Pi Zero friendly.

stegbrute is a rapid steganography brute-force tool developed in Rust, designed for extracting hidden data from media files that use the steghide utility. It offers multiple installation methods, including Cargo, Debian packages, and Docker, catering to various operating systems and user preferences. Notable features include customizable options for brute-forcing password protection and the ability to save results efficiently in a designated volume when used with Docker.

TryHackMe is a free cybersecurity learning path designed to advance users from novice to expert through a range of practical exercises, introductory Capture The Flag (CTF) challenges, and educational modules covering topics like OpenVPN, Linux fundamentals, web scanning, and Metasploit. This resource is suitable for both newcomers to the field and those looking to enhance their skills, and it culminates in a comprehensive foundation in cybersecurity, preparing users to address more complex challenges. Notable features include diverse content formats, hands-on labs, and accessible learning materials to foster practical experience in cybersecurity practices.

The Vigenère Cipher Decoder is a Python tool designed to decrypt Vigenère cipher text efficiently, utilizing known plaintext or flag formats to significantly reduce decryption time. Key features include an interactive menu for input, command line argument support for flexibility, and a brute force capability for discovering possible keys. This decoder is particularly useful for cybersecurity professionals engaged in cryptanalysis and CTF (Capture The Flag) challenges.

Common-CTF-Challenges is a comprehensive resource for Capture the Flag (CTF) competitions, providing categorized notes, command references, and ready-to-use Python scripts for various exploitation techniques including cryptography, binary exploitation, web vulnerabilities, and forensics. Notable features include a structured directory for easy navigation and search functionality using tools like `grep` and `ripgrep` to quickly locate relevant resources during challenges. This tool serves as a practical aid for participants by consolidating essential techniques and scripts in a single, accessible repository.

CTF Tools is a curated repository that aggregates a variety of resources, websites, and tools specifically designed to assist in solving Capture The Flag (CTF) challenges. It organizes tools by category, providing practical links ranging from ASCII tables to cryptographic calculators, thus serving as a quick reference resource for CTF participants and teams during competitions. Notable features include a wide assortment of utility tools for cryptography, data conversion, and training resources, as well as guidelines for collaborative contributions to the repository.

CTF Kit is a versatile toolkit designed to enhance the efficiency of solving Capture The Flag (CTF) challenges by leveraging AI assistance for analysis and documentation. It features seamless integration with AI coding agents through the Claude Code Plugin, automating tasks such as challenge categorization, vulnerability detection, and writeup generation, while also supporting over 20 diverse tool integrations. Its dual architecture consists of a command-line interface for direct interactions and AI-powered skills to enhance the challenge-solving workflow during competitions.

CTF-Writeups is a comprehensive repository offering detailed solutions and methodologies for various Capture The Flag (CTF) challenges, organized by categories such as Forensics and Cryptography. Its notable features include a step-by-step approach to problem-solving, a Graph View for visual exploration of relationships between challenges and concepts, and a dedicated section for tools and fundamental knowledge applicable to CTFs. This project serves as both a learning resource and a documentation platform for both solved and original challenges.

CTFever is a comprehensive toolkit designed for Capture The Flag (CTF) participants, offering a variety of tools to assist in solving challenges. Its notable features include a wide range of utilities such as encoding/decoding formats (Base64, ROT13), cryptography tools (Caesar cipher, Vigenère cipher), and data analysis options (CRC checks, IP geolocation). This suite aims to streamline the CTF experience by providing essential resources in a user-friendly manner.

MyCTFLib is a collection of templates for Capture The Flag (CTF) competitions, designed to assist with various challenge types, including exploitation, cryptography, and web vulnerabilities. It features scripts to easily copy relevant libraries for pwn, crypto, and web challenges, streamlining the setup process for participants. The library includes specific tools and functionalities such as exploited scripts, cryptographic algorithms, and web exploitation techniques.

CodExt is a Python library that enhances the native codecs library by incorporating over 120 additional encodings and custom character mappings, supporting both Python 2 and 3. It features a unique guess mode for multilayer encoding decoding and offers CLI tools for ease of use, facilitating seamless encoding and decoding of various formats including Morse and Braille. Its extensibility allows users to contribute new codecs and macros, making it a versatile tool for developers dealing with diverse encoding requirements.

RsaCracker is a robust tool designed for breaking RSA encryption, particularly beneficial in Capture The Flag (CTF) competitions. It supports a variety of formats including RSA, X509, and OPENSSH, enabling users to recover private keys and decipher messages through a comprehensive suite of targeted attacks and heuristics. Notable features include support for both PEM and DER formats, a flexible command-line interface, and advanced functionalities for multi-key attacks and various cryptographic operations.

StegoForge is an advanced steganography toolkit designed for embedding and extracting hidden data within images, audio, and video files, while also providing a comprehensive suite for digital forensics analysis. Its features include AES-256-GCM encryption, a local web UI for interactions, support for batch processing, and the ability to simulate network behavior on payloads, making it suitable for security researchers and CTF (Capture The Flag) participants. The framework offers zero-dependency binaries for easy deployment across multiple operating systems.

CryptoCat is a secure messaging tool designed for private communication via end-to-end encryption. Its primary use case is to enable users to chat in real-time while ensuring that messages remain confidential. Notable features include anonymous chat rooms and the ability to communicate securely without data logging.

PyCript is a Burp Suite extension designed for encrypting and decrypting HTTP requests, responses, and WebSocket messages, catering to both manual and automated application penetration testing. It enables the creation of custom encryption and decryption logic utilizing multiple programming languages, thus allowing users extensive flexibility for tailored security implementations. Notable features include automatic request encryption, decryption of multiple requests, and the ability to manipulate encrypted traffic seamlessly within Burp Suite.

The Penetration Testing Roadmap provides a comprehensive learning path designed to transition individuals from beginner to junior penetration tester by covering essential topics, tools, and hands-on labs. It is structured into phases, including foundational skills, web and infrastructure security, specialization tracks, and certification preparation. Notable features include a live roadmap, curated guides for various subjects, and links to practice labs and certifications, facilitating an organized and effective learning experience.

RustChain Bounties facilitates user engagement in the RustChain ecosystem by offering a bounty program where contributors can earn RTC (RustChain Token) for completing various tasks. The tool supports multiple categories, including code, content, and security-related tasks, providing clear difficulty ratings and compensation structures, thus incentivizing participation from both experienced developers and newcomers. Notable features include an extensive list of open bounties, specific payout procedures, and a comprehensive security protocol to safeguard against fraud.

The Frey-Rück Attack implementation allows for the extraction of the ECDSA secret key ("K") from vulnerable Bitcoin transactions. This tool is particularly useful for cryptocurrency analysts and researchers studying signature vulnerabilities in blockchain protocols, enabling them to restore Bitcoin wallets by solving the discrete logarithm problem through compromised signatures. Notable features include practical examples of vulnerable Bitcoin addresses and methodologies for conducting cryptanalysis efficiently.

Awesome Hacking & Cybersecurity Learning Path is a comprehensive resource designed to guide individuals from beginner to advanced levels in ethical hacking, penetration testing, and cybersecurity. It features curated materials on bug bounty hunting, OSINT tools, CTF challenges, and practical exercises for real-world scenarios, alongside essential concepts in networking and web application security. Notable features include detailed roadmaps for penetration testing, hands-on labs from platforms like TryHackMe and HackTheBox, and extensive coverage of privilege escalation techniques across multiple operating systems.

FalconEye is a comprehensive, self-hosted OSINT investigator's toolkit designed to streamline the investigation process through eighteen specialized modules. It facilitates a wide range of investigative tasks including cryptocurrency wallet tracing, phishing kit analysis, and domain intelligence, all integrated within a single interface that promotes one-click connectivity between related tools. Key features include LLM-powered scam detection for email headers, multi-source IP reputation assessments, and a fictional persona generator, making it a versatile platform for cybersecurity professionals.

Crypto OSINT investigation toolkit

NotLoBi's NotLoBi is an OSINT (Open Source Intelligence) framework designed to provide comprehensive cheat sheets and tools for various intelligence-gathering methodologies. It includes resources across multiple domains such as social media investigation, image analysis, geospatial intelligence, deep and dark web information, as well as financial and drug-related intelligence. Notable features include categorized tools for people's search, reconnaissance, cryptocurrency analysis, and anonymization techniques, making it a versatile resource for researchers and investigators.

Horus is a comprehensive investigative tool designed to assist users with data compilation and API interactions, serving as a pre-operations assistant. It features a modular architecture allowing for API configuration, functionality checks, and integration with services like Shodan, while requiring specific CLI tools for additional capabilities. The tool aims to streamline investigations by providing essential data management and interaction tools in one package.

Intel Codex is a comprehensive operational manual designed for digital investigators and security analysts, emphasizing OSINT methodologies and security protocols. It features over 40 standard operating procedures (SOPs), guides for various social media platforms, and case studies that illustrate practical applications in real-world investigations. Notable elements include legal and ethical compliance frameworks, detailed investigation techniques, and a focus on malware analysis and penetration testing methods.

The OSINT repository by JambaAcademy is a comprehensive resource for enhancing open-source intelligence gathering and analysis, providing templates and tools tailored for a variety of professional applications. Key features include AI-driven methodologies, standardized reporting templates, and extensive coverage of over 100 OSINT tools across multiple investigative categories. This repository aims to streamline investigative processes while ensuring ethical standards and legal compliance.

Crypto-Scam and Crypto-Phishing Threat Intel Feed provides a continuously updated feed of active cryptocurrency phishing and scam websites, helping organizations block these threats effectively. The tool is designed to be compatible with various blocking solutions, including Pi-hole and firewall systems, and features a daily update cycle to ensure users have access to the latest malicious domains. Additionally, it offers insights into domain characteristics, such as the prevalence of certain TLDs among scams, and supports reconnaissance activities for identifying rogue infrastructure.

RAR-NextgenerationAI-expliot is a robust toolkit designed for conducting scientific investigations into malware development and evasion techniques. It encompasses a variety of functionalities, including executable file creation, RAR file assembly with both documents and payloads, process injection, and advanced AI-driven methods to evade detection by security mechanisms. Additionally, it integrates polymorphic code and persistence techniques to enhance stealth and maintain access, culminating in a comprehensive resource for malware analysis and research.

The tool described in the repository focuses on utilizing blockchain analysis to uncover relationships between dark web services and trace cryptocurrency transactions, specifically Bitcoin. It leverages tools like Fresh Onions and Wallet Explorer to identify digital fingerprints of onion sites and analyze wallet connections, thereby enhancing the investigative capabilities of OSINT activities related to cryptocurrency crimes. Notable features include the ability to link onion sites, trace transactions to exchanges, and reveal ownership connections among dark web platforms.

Exploit is an offensive hacking tool designed to assist cybersecurity professionals and ethical hackers in executing exploits and conducting penetration testing. Its primary use case is to facilitate hacking activities, enabling users to automate various exploitation tasks. Notable features include ease of installation on any Linux distribution and comprehensive support for dependency management through a requirements file.

WiFi Security & Router Diagnostics is a cross-platform Python script designed to extract and display details of saved WiFi profiles, including passwords, authentication types, and encryption methods across Windows, Linux, and macOS systems. Notable features include an interactive menu for filtering, searching, exporting results to various formats, and an auto-install mechanism for dependencies like `colorama`. The tool prioritizes user consent by implementing a Terms and Conditions agreement before data retrieval, ensuring compliance with ethical standards.

StegCloak is a tool designed to conceal secrets within plain text by compressing and encrypting the data, and then embedding it using invisible Unicode characters, enabling covert communication in various digital platforms. With features such as AES-256-CTR encryption, password protection, and high performance in both plaintext and encrypted modes, it allows users to watermark strings or engage in discreet messaging. The tool is also compatible with WebAssembly (Wasm) for integration in web applications.

BlackBerryC2 is an encrypted remote administration and command-and-control (C2) framework primarily designed for educational and security research purposes within controlled environments. It features a custom TCP-based server that employs application-layer cryptography, including AES-256-GCM encryption and HMAC-SHA256 authentication, facilitating secure client communication, remote command execution, and file transfers. Key capabilities include session management, support for multiple concurrent clients, interactive console operations, and robust flood detection mechanisms.

Ferrox is a research-focused Windows stealer written in Rust, designed to harvest sensitive data including browser credentials, cryptocurrency wallet information, and messaging app sessions while employing various evasion techniques to bypass antivirus and endpoint detection systems. Its notable features include polymorphic builds, compile-time encryption of strings, direct syscall execution, anti-analysis measures, and the ability to exfiltrate stolen data via Discord or Telegram within a stealthy execution environment. The tool is intended strictly for educational purposes in understanding modern attack methodologies for enhancing cybersecurity defenses.

The PULSE C2 Framework is a command and control (C2) infrastructure designed for remote management of Windows agents through a secure HTTPS connection, featuring a web dashboard for real-time interaction. Key features include TLS encryption, a custom encrypted communication protocol, and capabilities for executing remote shell commands, file exfiltration, and agent control. This framework is intended for educational use, offering a simplified setup derived from a more complex rootkit project.

RustiveDump is a Rust-based tool specifically developed to perform memory dumps of the lsass.exe process using only NT system calls, creating minimalistic minidump files that include crucial data such as SystemInfo and ModuleList. Notable features include Position Independent Code (PIC) support, XOR encryption for enhanced security, and remote transmission capabilities, along with efficient memory handling and a lean build size of 18KB due to its no_std and CRT-independent design.

The TryHackMe-Beginner-Roadmap is a structured learning resource designed for novices in cybersecurity, providing a step-by-step guide to essential concepts and skills via the TryHackMe platform. It covers foundational topics such as operating system fundamentals, basic security principles, reconnaissance techniques, scripting for automation, and web security vulnerabilities, while incorporating hands-on exercises to reinforce learning through practical application. Notable features include a comprehensive overview of key cybersecurity tools and methodologies, facilitating knowledge development in both theoretical and practical dimensions.

The Microsoft SQL TDS Downgrade Attack tool performs a Man-in-the-Middle attack by intercepting Tabular Data Stream (TDS) packets between a client and MSSQL server, enabling the downgrading of encryption for TDS login packets. Its primary use case is to extract sensitive login credentials (username and password) by manipulating traffic through ARP spoofing and modifying intercepted packets. Notable features include automatic cleanup of the ARP spoofing and iptables rules upon stopping the script, and requirements for running include a Linux host with root privileges and necessary dependencies like arpspoof and iptables.

CyberChef MCP Server provides an interface for the Model Context Protocol (MCP) to utilize CyberChef's extensive library of 463 data manipulation operations, facilitating seamless integration with AI assistants for tasks such as encryption, encoding, and forensic analysis. Notable features include the ability to execute complex multi-step transformations with the `cyberchef_bake` tool, recipe management for saving and reusing workflows, and advanced enterprise capabilities like batch processing and telemetry analytics. This tool effectively bridges natural language AI intent with deterministic data processing capabilities.

WindowsShell-Injector is a shellcode execution framework designed for security research and penetration testing on Windows systems. It features encrypted payloads, anti-debugging mechanisms, and an intuitive Qt-based GUI, allowing for seamless loading and execution of shellcode. Notable capabilities include asynchronous execution via separate threads, dynamic memory protection, and runtime API resolution to enhance evasion of static analysis tools.

grafanaExp is a tool designed to exploit the CVE-2021-43798 vulnerability in Grafana, enabling automated detection of vulnerable instances, extraction of keys, and decryption of server database files. Its primary use case is to assist in the security assessment of Grafana installations by providing the capability to reveal sensitive configuration data and datasource information. Notable features include an 'exp' command for vulnerability detection and information retrieval, and a 'decode' command for local decryption of large database files.

Padre is an advanced tool designed for conducting Padding Oracle attacks against CBC mode encryption, enabling the decryption of tokens and encryption of arbitrary data. It features automatic fingerprinting of padding oracles, detection of cipher block lengths, and provides hints for overcoming failures during operations, all while supporting various encoding rules for enhanced flexibility. Particularly useful for security researchers and penetration testers, Padre can effectively exploit vulnerabilities to disclose encrypted session information or bypass authentication mechanisms.

Cryptolocker is an open-source encryption tool developed in Visual C++ that employs a robust 256-bit AES encryption algorithm to secure files, rendering them unreadable without a password. Its primary use case involves encrypting files across system drives while providing features such as a multi-threaded encryption process for efficiency, lockdown functionality to restrict system access, and a web admin interface for management. This tool is intended solely for educational purposes and emphasizes user responsibility regarding legal usage.

AES-Encoder is a PowerShell-based tool designed for crypting and obfuscating PowerShell scripts, primarily to evade modern antivirus detection. It features advanced capabilities such as variable name randomization, compression, and encryption, as well as support for recursive layering and AMSI bypassing for enhanced security. The tool is open-source, allowing users to easily modify and create their own variants for educational purposes.

GhostLock is a research tool designed to demonstrate the potential for ransomware-equivalent availability impacts on SMB shares by utilizing file-level and directory-level locking techniques without writing or encrypting data. It enables low-privileged Windows domain users to effectively lock files or entire directories, rendering them operationally invisible while maintaining read access at known paths, thus bypassing traditional security measures with no detectable writes or anomalies. Notable features include a 32-thread parallel scanner for file locking and a single handle directory lock method, making it a significant concern for SMB-based environments.

NightCloak is a statically-linked Go binary designed for metadata steganography and string obfuscation, allowing users to embed encrypted payloads into various file formats through a sophisticated multi-layer pipeline involving obfuscation, authenticated encryption, and binary injection. It supports distributed resiliency via Reed-Solomon erasure coding and enables discovery through CRC64 algebraic beacons, making it highly effective for covert data storage and transmission. The tool modernizes and ports previous versions while preserving core functionalities and operational models.

PH4NTØM ROOTKIT is a Windows usermode rootkit designed for educational research, featuring techniques for stealth, privilege escalation, and command-and-control (C2) infrastructure. Notable features include token stealing and named pipe impersonation for privilege escalation, inline hooking for process and file hiding, and a comprehensive C2 setup allowing for real-time keylogging and remote execution commands. It emphasizes defensive learning while providing extensive evasion mechanisms against analysis and detection.

Proteus is a Rust-based command-and-control (C2) agent designed for integration with the Mythic framework, featuring capabilities such as raw shellcode production, COFF file analysis, and robust data-section obfuscation. Its key innovations include a shuffle pipeline that randomizes function order while repairing internal references, combined with ChaCha20-based encryption for added security. This tool serves as both a payload generator and a development aid, supporting advanced persistence and clandestine operations in targeted environments.

ReconMind is an AI-powered bug bounty agent designed to emulate the decision-making process of a senior penetration tester, automating the entire vulnerability assessment workflow from reconnaissance through to reporting. Key features include an LLM-driven approach that intelligently selects targets and scans, filters false positives, and generates platform-ready reports for services like HackerOne and Bugcrowd. Its streamlined pipeline ensures comprehensive coverage, while being free to use, and provides flexibility with local and cloud-based LLM integrations.

ChromiumSpecter is a tactical auditing suite for security assessments of Chromium-based browsers (such as Chrome, Edge, and Brave) on Windows, focusing on credential extraction and data exfiltration. It features a highly discreet and resilient decryption engine that utilizes SYSTEM impersonation with legitimate Windows APIs, making it less detectable compared to traditional code injection methods. Key functionalities include a professional dashboard for real-time statistics, support for multiple encryption schemes, and seamless integration with the latest browser versions.

KHAØS LOADER is a multi-stage Windows x64 loader that utilizes AES-256-CBC to decrypt and inject donut shellcode into a `rundll32.exe` process spawned under `explorer.exe`, employing advanced evasion techniques such as indirect syscalls with call stack spoofing. Notable features include early-bird APC injection, unhooking capabilities, and robust sandbox evasion mechanisms, which ensure stealthy operation against various security measures. This tool is designed for authorized use only and integrates multiple sophisticated methods to remain undetected during execution.

Omniscient V3 is a comprehensive reconnaissance and adversary simulation framework designed to enhance security assessments by consolidating over 130 best-in-class tools into a unified pipeline. Key features include AI-driven results augmentation, distributed execution across platforms such as Kubernetes and Docker, advanced stealth techniques for emulating sophisticated attacks, and immutable audit trails for compliance and reporting. This tool is primarily aimed at security professionals, providing a streamlined approach to identifying vulnerabilities in complex attack surfaces.

CloudGuard Security is a browser-based demonstration tool that exploits the File System Access API to simulate file encryption and delivery attacks without requiring software installation. It operates in two modes: the 'lock' mode, which encrypts files using AES-256-GCM and displays a countdown alert, and the 'drop' mode, which silently writes a specified payload to the user's file system. The tool emphasizes social engineering techniques for permission granting, making it a practical resource for red-team exercises.

Miner In The Middle is a Python-based tool that facilitates the injection of JavaScript cryptocurrency miners into HTTP responses of targets on a local network via ARP spoofing. It features configurable options for injection scripts and IP constraints to ensure targeted use, along with an easy setup process that automates iptables configuration and packet forwarding. Users can also implement custom JavaScript for injection and execute various attack modes, including standard miner attacks and popunder techniques.

SATAN2 is an advanced counter-forensics framework designed for security professionals, Red Teams, and privacy advocates, offering features for multi-pass data destruction, nested encryption, and forensic artifact forgery. Its primary use case is to effectively eliminate sensitive information and mislead forensic analysis, making it a formidable tool against incident-response efforts. Notable features include cross-platform support, modular architecture, and specialized modules for thorough deletion and deception on both Linux and Windows systems.

ShadowLab is a modular Command & Control (C2) framework designed for educational purposes in cybersecurity research, focusing on the engineering principles of modern C2 infrastructures. Key features include AES-128 encrypted communications, payload generation, and a dynamic post-exploitation module system, all intended for use in controlled environments to enhance learning and understanding of cybersecurity concepts rather than for offensive tactics.

Supernova_CN is an open-source shellcode encryption tool developed in Golang, designed to facilitate the encryption of raw shellcode using various algorithms such as XOR, RC4, AES, and CHACHA20. It allows users to convert the encrypted shellcode into compatible formats for multiple programming languages, and provides corresponding decryption code as guidance for implementation. Notably, the tool includes a comprehensive command-line interface and supports encryption in Base64 formats for added versatility.

The iOS Binary Security Analyzer is a script designed for performing static analysis on iOS application binaries to identify security weaknesses such as insecure functions, weak cryptographic implementations, and missing security features like code signatures and PIE. Notable features include checks for core binary security mitigations, dynamic library dependencies analysis, and detection of anti-analysis indicators, making it a valuable tool for assessing the security posture of iOS applications on jailbroken devices.

EgnakeRAT is an advanced remote administration tool (RAT) designed for authorized penetration testing and red team operations on Android devices. It features a fully asynchronous command and control (C2) server utilizing AES-256-CBC encryption for secure communications, along with a real-time web dashboard for device management and various tactical modules such as remote shell access and keylogging. Its use of a length-prefixed JSON protocol and automatic reconnection handling enhances its performance and user experience, making it a robust solution for security researchers.

OctoC2 is a GitHub-native command-and-control framework designed for authorized cybersecurity research, featuring encrypted multi-channel transport and resilient failover capabilities. Its architecture includes a TypeScript beacon, a durable controller, a local operator dashboard, and a comprehensive CLI, enabling secure task execution and management via various transport methods. Notable features include the use of GitHub artifacts for task exchange, a signed task protocol, and a focus on least-privilege credentials for robust security during operations.

The Big Brother V5.0 is an advanced Open Source Intelligence (OSINT) framework designed for comprehensive reconnaissance on individuals, organizations, or groups. It features a highly interactive holographic dashboard supported by 21 distinct intelligence modules that facilitate deep investigative analysis. The tool allows users to conduct detailed searches and surveillance, enhancing the capabilities for gathering critical data while also offering an exclusive service for more intensive intelligence requirements.

The 'Daily Bug Bounty Writeups' repository provides a collection of detailed writeups related to bug bounty exploits and vulnerabilities. It's primarily aimed at cybersecurity professionals and bug bounty hunters seeking insights on various security misconfigurations, pentesting techniques, and practical exploit scenarios. Notable features include links to external articles that cover cloud security misconfigurations, advanced web application security testing, and guides for utilizing GitHub as a reconnaissance tool.

The OWASP Mobile Application Security Testing Guide (MASTG) serves as a comprehensive resource for mobile app security testing and reverse engineering, aligning with the OWASP Mobile Security Weakness Enumeration (MASWE) and the Mobile Application Verification Standard (MASVS). It features detailed methodologies for validating security weaknesses and offers tools like mobile app security checklists and interactive exercises, enhancing both understanding and practical application of mobile security principles.

pSlip is a comprehensive security scanning tool for Android applications, designed to detect cryptographic vulnerabilities, OAuth implementations, and manifest issues using a streamlined HTML reporting engine. Its notable features include a powerful searchable HTML report leveraging a field-scoped query language, structured extraction and export of recovered key material and secrets, and a user-friendly interface that supports rapid identification of findings without requiring Java dependencies. The tool optimizes scanning performance and minimizes false positives, enhancing the efficiency of mobile application security assessments.

VULNRΞPO is a client-side vulnerability report manager designed for security professionals, enabling users to generate, store, and manage vulnerability reports locally with a focus on privacy. The tool features client-side encryption, customizable issue templates for various security frameworks, and supports imports from multiple scanners, along with diverse export formats such as PDF and DOCX. Notable capabilities include integrated methodology tools, automated versioning, and optional backend storage via API for enhanced reporting functionalities.

Writeups by zer00d4y

The ctf-skills repository provides an extensive collection of agent skills designed to facilitate the solving of Capture The Flag (CTF) challenges across various domains, including web exploitation, binary pwn, reverse engineering, and more. Notable features include support for multiple installation methods, a comprehensive tool installer script, and detailed skill documentation for on-demand use, allowing users to efficiently integrate the necessary tools as challenges arise. It is compatible with any tool adhering to the Agent Skills specification, enhancing its versatility in competitive cybersecurity contexts.

GpgFrontend is a modern encryption tool that leverages GnuPG to facilitate easy and secure encryption and signing of texts and files across multiple platforms, including Windows, macOS, and Linux. Key features include a portable solution that can be run from a USB drive, flexible management of key databases, and a strong focus on user privacy through various safety measures. The tool also supports extensive module development, allowing for customizable user experiences and features.

BurpCrypto is a collection of burpsuite encryption plug-ins, support AES/RSA/DES/ExecJs(execute JS encryption code in burpsuite). 支持多种加密算法或直接执行JS代码的用于爆破前端加密的BurpSuite插件

Captfencoder is opensource a rapid cross platform network security tool suite, providing network security related code conversion, classical cryptography, cryptography, asymmetric encryption, miscellaneous tools, and aggregating all kinds of online tools.

⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡

🧰 A zero trust swiss army knife for working with X509, OAuth, JWT, OATH OTP, etc.

CloakifyFactory - Data Exfiltration & Infiltration In Plain Sight; Convert any filetype into list of everyday strings, using Text-Based Steganography; Evade DLP/MLS Devices, Defeat Data Whitelisting Controls, Social Engineering of Analysts, Evade AV Detection

Application secrets and configuration management for developers.

Python implementations of cryptographic attacks and utilities.

CTF竞赛权威指南

Fantastic toolkit for CTFers and everyone.

CTF Cheat Sheet + Writeups / Files for some of the Cyber CTFs that I've done

Deep Learning models for network traffic classification

Real-time phishing & scam domain blocklist — 99,000+ curated threats, 828K+ community, free API, multiple formats

a secure dotenv–from the creator of `dotenv`

An automated, modular cryptanalysis tool; i.e., a Weapon of Math Destruction

Loading Remote AES Encrypted PE in memory , Decrypted it and run it

pull decrypted ipa from jailbreak device

the fastest and most powerful android decompiler(native tool working without Java VM) for the APK, DEX, ODEX, OAT, JAR, AAR, and CLASS file. which supports malicious behavior detection, privacy leaking detection, vulnerability detection, path solving, packer identification, variable tracking, deobfuscation, python&java scripts, device memory extraction, data decryption, and encryption, etc.

A Linux Ransomware

Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).

Security Apps for Android

IDA Pro plugin with a rich set of features: decryption, deobfuscation, patching, lib code recognition and various pseudocode transformations

🚀🚀 This is a 🎇🔥 REAL WORLD🔥 🎇 Malware Collection I have Compiled & analysed by researchers🔥 to understand more about Malware threats😈, analysis and mitigation🧐.

A tool to quickly identify relevant, publicly-available open source intelligence ("OSINT") tools and resources, saving valuable time during investigations, research, and analysis.

🔥 A powerful MongoDB auditing and pentesting tool 🔥

Here we discuss how one can investigate crypto hacks and security incidents, and collect all the possible tools and manuals! PRs are welcome! If any tool is missing - please open PR!

Open Source Security Guide. Learn all about Security Standards (FIPS, CIS, FedRAMP, FISMA, etc.), Frameworks, Threat Models, Encryption, and Benchmarks.

OSINT open-source tools catalog

🔐 Securely share sensitive information with automatic expiration & deletion after a set number of views or duration. Track who, what and when with full audit logs.

High Octane Triage Analysis

A collection of practical security-focused guides and checklists for smart contract development

Hide secrets with invisible characters in plain text securely using passwords 🧙🏻‍♂️⭐

👻Stowaway -- Multi-hop Proxy Tool for pentesters

This repository contains a simple vulnerability scanner for the Terrapin attack present in the paper "Terrapin Attack: Breaking SSH Channel Integrity By Sequence Number Manipulation".

跨平台密码学工具箱。包含编解码，编码转换，加解密， 哈希，MAC，签名，大数运算，压缩，二维码功能，CTF等功能。

微信小程序反编译工具，.wxapkg 文件扫描 + 解密 + 解包工具

A PowerShell script anti-virus evasion tool