Malware

rsleigh is a pure-Rust reverse-engineering workbench designed to convert various binary formats, including PE, ELF, and Mach-O, into C-like pseudocode and other structured outputs like disassembly and call graphs. This tool excels in static analysis workflows by enabling users to navigate binaries efficiently, uncover function calls, analyze packed code, and integrate findings with LLMs for automated analysis, without dependence on JVM or C++ bindings. Notably, it supports a multi-architecture API, allowing for flexible integration and insights into binary behavior.

Funny-virus is a collection of harmless, fun scripts designed to simulate playful "virus-like" behaviors for entertainment and educational programming experimentation. Notable features include the generation of random pop-up windows, playful text color changes, and fake system messages, allowing users to safely explore humorous programming concepts without causing any actual harm. The project emphasizes responsible use and is intended solely for non-malicious purposes.

Asur-Rat is a powerful Android remote access tool designed for surveillance and management of Android devices. Its primary use case includes extensive control features such as SMS handling, call management, file operations, GPS location tracking, and real-time screen monitoring, along with administrative capabilities like device formatting and icon hiding. Notable features include a keylogger, live screen streaming, and comprehensive media management, making it a versatile solution for remote device administration.

Zeravynex is a robust static malware analysis platform designed for Windows Portable Executable files, utilizing a combination of deterministic heuristics, YARA signatures, and machine learning techniques to provide explainable security decisions. Notable features include deep PE parsing, a built-in YARA rule engine for malware family detection, automatic indicator of compromise extraction, and a modern web dashboard for real-time analysis visualization, all while ensuring safety by performing static analysis only. The platform facilitates binary inspection through both command-line interface and FastAPI REST API, supporting comprehensive threat triage processes.

The System Programming Roadmap is an educational framework designed to guide users through the fundamentals of compiler development, malware reverse engineering, and kernel development. It emphasizes a structured approach to mastering system programming languages such as C, Rust, and C++, while also covering essential concepts in computer architecture and assembly language. Notable features include a curated list of resources and prerequisites to enhance the learning experience and ensure a comprehensive understanding of low-level programming.

DelphiReSym is a reverse engineering tool that recovers fully qualified Delphi symbol names from the metadata in Delphi executables, facilitating the analysis of Delphi malware and legacy applications. Integrated with Ghidra, it not only restores human-readable context for functions and types but also automatically populates virtual table structures in Ghidra's Data Type Manager. This tool supports multiple Delphi versions, enabling detailed reconstruction of metadata for effective reverse engineering.

Fibratus is a real-time security sensor designed for threat detection and protection, leveraging a behavior-driven rule engine and YARA memory scanning to analyze a wide range of system events. Its notable features include the ability to route events to various output sinks for further analysis, support for custom tool integration via filaments, and forensic capabilities to assist in understanding and responding to security incidents. The tool emphasizes real-time behavior detection, memory scanning, and comprehensive forensic analysis to combat advanced malware and attacker tactics.

The anti-trojan-source tool is designed to detect trojan source attacks that exploit Unicode bidirectional (bidi) characters to inject malicious code into applications. It employs a comprehensive detection mechanism utilizing an explicit list of dangerous Unicode characters as well as category-based detection for invisible characters, ensuring robust protection against various types of attacks. This tool also integrates with ESLint through a dedicated plugin, facilitating real-time detection of potential security vulnerabilities in codebases.

SLEEPWALKER is a passive backdoor tool designed for offensive security tasks, featuring a 64-bit Windows DLL that impersonates `dpapi.dll` and loads into ESET's Management Agent. It utilizes a proprietary command language interpreted through a 23-opcode bytecode system, allowing for various operations including data transmission and remote execution of shellcode upon receiving a specific trigger packet. Notably, the tool includes a Python controller for compiling and encrypting commands, alongside a configurable architecture enabling advanced covert command execution and behavior customization.

FlareVM MCP is a Model Context Protocol server that facilitates remote access to a suite of over 48 Windows malware analysis tools within an isolated FlareVM environment, allowing seamless integration for AI agents and security analysts. Its notable features include remote file operations, comprehensive static and dynamic analysis capabilities, debugger integration, and a standardized interface for automatized workflows. This architecture enables enhanced malware examination while maintaining the security of the analysis environment.

Defango is a Golang tool designed for defanging URLs, IP addresses, and emails to neutralize Indicators of Compromise (IoCs) for safer analysis and sharing. Its primary use case is to convert potentially harmful IoCs into harmless formats for security practitioners. Notable features include easy integration and usage through its package methods, enabling users to sanitize malicious content seamlessly.

freeRASP is a mobile in-app threat detection and security monitoring SDK designed to protect applications from runtime threats such as reverse engineering, repackaging, and unsafe operating environments. It offers a suite of precise security checks, is lightweight with minimal performance impact, and integrates easily with various platforms including iOS, Android, Flutter, and Unity. Notable features include real-time threat response via API, weekly security reports, and adherence to OWASP MASVS standards for resilience against reverse engineering.

THEORY is an open-source tool designed to produce comprehensive threat actor intelligence dossiers by aggregating data from various cybersecurity sources, including MITRE ATT&CK and AlienVault OTX. It leverages a large language model to synthesize information into easily digestible executive summaries and detailed intelligence reports, which feature TTP tables, detection opportunities, and enriched IoCs. Key functionalities include the generation of IR playbooks and export options in multiple formats, making it suitable for threat intelligence analysts, detection engineers, and security researchers.

The repository provides a comprehensive collection of cybersecurity bookmarks curated by a senior information security engineer, focusing on critical topics such as OSINT, exploitation, privilege escalation, and malware analysis. It features over 40 tools for reconnaissance, privacy, and attack methodologies, along with curated news sources, making it a valuable resource for cybersecurity professionals looking to enhance their operational security and situational awareness. Notable features include categorized tools for specific cybersecurity tasks and a visually engaging presentation of the content.

PrestaScan Security is a PrestaShop module designed to scan PrestaShop websites for malware and known vulnerabilities in both the core and its modules. It features an intuitive installation process, regular vulnerability alerts, and is compatible with multiple PrestaShop versions, ensuring comprehensive security for e-commerce sites. This free and open-source tool is supported by a dedicated team of security experts who continually monitor and audit for potential threats.

The Assemblyline Client Library is a Python library designed to simplify the process of issuing requests to the Assemblyline API. Its primary use case is to enable developers to efficiently interact with Assemblyline's services, facilitating integration and automation of cybersecurity-related tasks. The library is notable for its comprehensive documentation and ease of use, streamlining the interaction with the Assemblyline platform.

Awesome Malware Persistence is a curated repository that compiles tools and resources related to malware persistence techniques across various platforms, including Windows, Linux, macOS, and cloud systems. Its primary use case is to provide cybersecurity professionals with insights into how adversaries maintain system access through various persistence methods, as well as strategies for detection, prevention, and removal of these threats. Notable features include a comprehensive categorization of persistence techniques and relevant forensic tools, linked to established frameworks such as MITRE ATT&CK.

BTG Packer is a Rust-based research framework for the analysis, transformation, and virtualization of Windows x86-64 PE32+ executables. It features comprehensive functionality including PE reconstruction, control-flow transformation, RISC lifting, and runtime protection, making it suitable for security research and code modification tasks. Notable capabilities include its ability to generate polymorphic virtual machines, conduct advanced code analysis, and ensure build determinism and structural validation.

x64dbg-MCP Server is a native plugin for x64dbg that enables programmatic control of the debugger over HTTP, utilizing the Model Context Protocol (MCP). Its primary use case is for enhanced reverse engineering, allowing users to manage breakpoints, step through code, and access memory and registers via any MCP-compatible AI assistant. Notable features include zero dependencies, dual transport methods (streamable HTTP and SSE), and comprehensive debugger control with 71 available tools and 22 event callbacks.

Oxide is a cross-platform remote access trojan (RAT) framework designed for security research and detection engineering, allowing users to demonstrate and analyze threat actor tactics, techniques, and procedures (TTPs) at the code level. It includes an implant written in Rust, a C2 panel implemented in Python, and provides comprehensive detection capabilities with paired YARA rules, Sigma rules, and incident response playbooks. The framework facilitates purple team exercises through a structured approach to understanding implant-panel communications and establishing effective detection strategies.

TraceTree is an advanced autonomous security tool designed to enhance development workflows with robust detection and protection capabilities. Its primary use case revolves around analyzing packages for malicious intent through sandbox isolation, syscall parsing, and machine learning-based anomaly detection, enabling developers to maintain security before package installations. Notable features include a multi-agent coordination server, a web dashboard for monitoring, and a behavioral receipt export for summarizing observed behaviors without compromising syscall logs.

Ahtapot is an IOC (Indicators of Compromise) analysis extension that enables users to perform rapid and secure threat assessments directly from their browser. Its primary use case is to analyze various security indicators, such as IP addresses, domains, and hashes, leveraging multiple threat intelligence sources with AI-powered analysis capabilities. Notable features include integration with three AI providers, smart caching for analysis results, customizable provider ordering, and a fully responsive user interface.

IndustrialXPL-Forge (IXF) is an extensive Python-based security assessment and exploitation framework designed specifically for Operational Technology (OT), Industrial Control Systems (ICS), and related environments. It encompasses the entire attack lifecycle from reconnaissance to reporting, and it features over 1,190 modular tools, support for more than 50 protocols, and extensive integration with the MITRE ATT&CK for ICS framework, along with a significant library of vulnerabilities, offering a comprehensive resource for cybersecurity professionals in the industrial sector.

The ANY.RUN SDK is a Python client library designed to interact with the ANY.RUN REST API, facilitating automated malware analysis and threat intelligence workflows. It provides features for file and URL submissions to an interactive sandbox, real-time monitoring of analysis progress, and access to comprehensive threat intelligence, including IOC searches and feeds. Notable functionalities include support for both synchronous and asynchronous operations, along with built-in exception handling and detailed reporting capabilities.

IDA Skill is an AI-powered tool that enables automated malware analysis using IDA Pro, mimicking the capabilities of human security analysts. It features automatic identification of malicious behavior, code functionality understanding, key information extraction, and threat indicator localization, enhancing malware investigation efficiency. Notable components include REAI for AI function analysis and FindCrypt for detecting encryption algorithms, facilitating comprehensive and advanced threat assessment.

Arkana is a comprehensive malware analysis tool that streamlines the investigation process by integrating 308 specialized analysis tools through a single AI-driven interface. It allows users to submit natural language prompts to conduct extensive malware evaluations, including decompilation, vulnerability detection, and real-time data enrichment without switching between multiple applications. Notable features include automated risk scoring, MITRE ATT&CK mapping, and interactive debugging capabilities, all designed to enhance efficiency in analyzing PE, ELF, and other binary formats.

Cyberseek is a comprehensive, local threat intelligence and defensive analysis tool designed for security teams, integrating asset visibility, reconnaissance, and indicator enrichment into a unified workspace. Key features include continuous monitoring of domains and IPs, email exposure checks, and robust reporting capabilities, while it also enables the mapping of observed behaviors to the MITRE ATT&CK framework and utilizes AI for evidence-bound summaries. The tool aims to facilitate investigation workflows by preserving local task history and analyst context, enhancing operational efficiency in cybersecurity tasks.

Hacksguard is a high-performance, multi-threaded Terminal UI (TUI) static analysis tool designed for SOC analysts, threat hunters, and reverse engineers to analyze Portable Executable (PE) files. Key features include automatic risk scoring based on multiple heuristic axes, integrated YARA scanning capabilities for threat detection, deep inspection of PE format details, and an interactive dashboard for efficient analysis within the terminal. Additionally, it offers functionality for auto-decoding strings, built-in disassembly of opcodes, and can operate in CLI mode for automation in CI/CD environments.

fnprint is a binary analysis tool that uniquely identifies functions in stripped executables by analyzing their behavioral side effects rather than relying on byte signatures or control-flow graphs. It emulates function execution with fabricated inputs to generate behavior-based fingerprints, allowing for more resilient matches across different compiler optimizations and versions. Key features include indexing known binaries for function identification, differential analysis to detect behavioral changes between builds, and a triage capability to assess potential vulnerabilities based on function behavior comparison.

Yaramail is a Python tool designed for scanning emails using YARA rules, primarily aimed at automating the triage process of phishing reports. It offers comprehensive functionality that allows users to analyze all components of an email, including headers, body content in various formats (Markdown conversion), and various attachment types, while also providing customizable password options for encrypted ZIP files. Notably, Yaramail categorizes emails systematically and parses authentication results for enhanced analysis.

The Assemblyline Overpower service is designed to de-obfuscate and profile PowerShell files for analytical purposes. It utilizes modified open-source tools like PSDecode and PowerShellProfiler to statically analyze scripts and extract behavioral indicators. Key features include configurable submission parameters and integration within the Assemblyline framework for streamlined deployment and operation.

helmd is a comprehensive security analysis plugin designed for the DeepSeek Harness, integrating capabilities across six domains: Android, Web, Native, Protocol, Malware, and AI-Security. This tool facilitates a streamlined installation with ten independently released bundles, enabling users to access all essential functionalities with minimal configuration while maintaining a modular architecture for on-demand knowledge and tool utilization. Notable features include first-round tool anchoring for user queries, specialized routing for domain-related tasks, and a focused referencing system that supports autonomous model decision-making.

DeNuitkanizator is a utility designed for analyzing .exe files compiled with Nuitka and other packagers such as PyInstaller. Its primary use case is for reverse engineers and malware analysts, providing detailed extraction of metadata, strings, modules, and PE structure information, while also disassembling machine code and identifying potential suspicious patterns. Notably, it distinguishes between different packagers, retrieves network-related data, and analyzes the executable's PE structure, although it does not function as a decompiler.

`omp-re` is a reverse-engineering plugin for the Oh My Pi framework that utilizes Radare2 and offers a suite of 22 tools for in-depth binary analysis. Its primary use case is to facilitate the examination of binary files, featuring an interactive function navigator, decompilation capabilities, and a robust evidence storage system that ensures claims in reports are substantiated by gathered facts. Notable features include an HMAC-signable audit log and an evidence citation system, enhancing the reliability and traceability of the analysis process.

memory-forensic is a cross-platform memory forensics toolkit designed for analyzing Windows kernel memory through an independent implementation that matches the output of Volatility 3. It reads various memory dump formats and allows users to retrieve detailed process and network connection information without needing Python or pre-staged symbol catalogs. Notably, it offers a self-profiling capability to locate kernel symbols and validate its results through rigorous comparison with reference implementations, ensuring high correctness in process recovery.

XRefer is a Python plugin for the IDA Pro disassembler that enhances binary analysis through a custom navigation interface. It clusters related functions, highlights execution paths, and integrates external data sources to provide context-rich path graphs, significantly speeding up manual static analysis. Notable features include LLM integration for generating natural language descriptions of code relationships and the ability to incorporate API traces and custom xrefs for improved insights.

Awesome Memory Forensics is a curated repository focused on digital forensic tools and resources specifically for memory forensics, a critical approach for investigating sophisticated cyber attacks that evade traditional detection methods. The repository includes a variety of software tools for memory acquisition, analysis, as well as educational resources such as books, courses, and articles, facilitating a comprehensive exploration of volatile memory analysis in digital forensics. Notable features include a selection of both commercial and open-source tools that allow investigators to capture and analyze critical data in memory, ensuring enhanced effectiveness in digital investigations.

DarkDex is a powerful tool designed to extract and reconstruct the real dex file from packed Android applications, including those protected by advanced packers like ijiami 4th generation. It operates in two modes: a host script that leverages memory reading from outside the Android sandbox, and an APK that runs directly on the device, facilitating full memory dumps in root mode or disk dex pulls without root. Notable features include an event-driven capture system that captures decrypted dex in real-time, as well as utilities for validating, deduplicating, and testing the output disassemblies.

AddUser-SAMR is a tool for creating local administrators via the SAMR API, providing a lower-level alternative to traditional commands like `net.exe` and PowerShell's `New-LocalUser`. It supports multiple programming languages including C#, Python, Rust, Crystal, and Deno, and offers features such as custom username and password input, group specification, and verbose output. The tool requires administrator privileges for operation and retains existing users in the group without updating passwords.

SAMDump is a tool designed for extracting Windows Security Account Manager (SAM) and SYSTEM files utilizing the Volume Shadow Copy Service (VSS) with options for local saving or remote transfer, along with XOR obfuscation for enhanced security. It supports multiple programming languages including C++, C#, Crystal, Deno, and Python, and is capable of listing and creating shadow copies as needed, while automatically cleaning up after use. Noteworthy features include file operation via NT API calls, support for various exfiltration methods, and automatic XOR encoding to protect the extracted data.

Blackbird is a comprehensive real-time malware analysis platform designed for software reverse engineering and intrusion detection. Its primary use case involves performing detailed local analysis of malware through advanced features such as kernel capture, in-process telemetry, and flexible target execution workflows. Notable functionalities include memory behavior tracking, offline capture analysis, and a user-friendly interface that facilitates malware detonation and threat triage within a controlled virtual environment.

Benthic is a comprehensive Windows kernel rootkit designed for educational exploration and practical insights into rootkit development. It features advanced capabilities including process and network stealth, keylogging, and file hiding, all integrated into a modular framework for demonstrating real-world stealth and persistence from kernel mode. While leveraging techniques such as DKOM for process hiding and using the Windows Filtering Platform for network obfuscation, Benthic serves as a foundational resource for those venturing into the complexities of rootkit creation.

Packing Box is a Docker container that offers a command-line interface (CLI) environment designed for the static detection of executable packing. It integrates various executable analyzers, packing detectors, and tools for generating datasets, specifically tailored for evaluating detection techniques and automating machine learning pipelines involving packed and unpacked executables across different formats such as PE, ELF, and Mach-O. The toolkit features a user-friendly YAML configuration system, enabling straightforward customization for research evaluations and model training.

The Malware Analysis tool focuses on dissecting and evaluating the risk associated with PDF-based malware (maldoc). It provides an in-depth exploration of PDF structures, including headers and encoding techniques, making it a valuable resource for security researchers aiming to understand and analyze malicious code embedded within PDFs. Notable features include detailed explanations of malware behaviors, obfuscation techniques, and how to identify command and control (C&C) mechanisms within PDF binaries.

The VSphereRansomwareRecovery tool provides a recovery solution for virtual machines affected by Babuk-family ransomware on ESXi hosts. It facilitates the restoration of virtual disks ending in `.babyk` through partition table rebuilding and file system recovery, ensuring minimal data loss in the process. Notable features include the capability to leverage AI agents for automated recovery steps and the assurance of recovering readable data from the majority of affected disk space.

JADX MCP Server is a pure-Java Model Context Protocol server that facilitates the reverse engineering of Android APK files utilizing the JADX decompiler. Designed for security researchers and developers, it enables detailed analysis through features such as APK loading, code decompilation, component extraction, and comprehensive manifest analysis, all while maintaining cross-platform compatibility and requiring no external dependencies.

PeNet Analyzer is a tool designed for analyzing Portable Executable (PE) files to identify anomalies and potential malware behaviors. Its primary use case involves facilitating the detection of suspicious characteristics in executable files, which aids in malware analysis and forensics. Notable features include its focused analysis on PE formats, making it suitable for cybersecurity professionals dealing with malicious software investigations.

Assemblyline Docker Compose is a tool that facilitates the deployment of the Assemblyline 4 framework using Docker Compose, allowing users to easily set up a scalable and customizable environment for malware analysis. Its primary use case includes providing varied deployment profiles such as minimal, full, and archive setups, enabling users to tailor the system's capabilities according to specific requirements, including metrics collection and logging. Notable features include flexibility in configuring profiles, self-signed certificate generation for secure communication, and comprehensive documentation for streamlined installation and setup.

Assemblyline 4 Documentation repository provides comprehensive documentation for the Assemblyline platform, facilitating user and developer understanding of its capabilities and functionalities. The primary use case is to assist in contributing to or utilizing the Assemblyline cybersecurity tool, with notable features including inline editing on GitHub and local setup instructions for developers.

The URL Shorteners tool provides a curated collection of over one thousand URL shortener domains intended for use in whitelisting, blacklisting, and assessing domain trustworthiness. Notable features include separate lists for active and inactive domains, aiding in network security and minimizing false positives in risk assessments. This resource is valuable for enhancing privacy protection across various network environments.

Awesome AI in Cybersecurity is a curated repository that provides an extensive collection of resources focused on the application of artificial intelligence in various cybersecurity domains. It categorizes AI uses within cybersecurity into prediction, prevention, detection, response, and monitoring, while also detailing tools for penetration testing, malware analysis, and security for AI SaaS environments. Notable features include automated penetration testing frameworks, and support for network protocol verification, enhancing traditional security measures with AI-driven insights and efficiencies.

AI for the Win is a hands-on training platform designed for security practitioners to develop AI-powered tools specifically for threat detection, incident response, and security automation. It features over 50 labs, including capstone projects and CTF challenges, focusing on practical applications such as phishing detection and security log analysis using advanced algorithms like Random Forest and LLMs. The platform also offers a Docker lab environment, sample datasets, and solution walkthroughs to facilitate immersive learning experiences.

Assemblyline 4 - Core is a foundational service suite designed to manage and process submissions in cybersecurity workflows. Its primary use case lies in orchestrating various tasks such as alerting, archiving, dispatching, and managing service loads dynamically. Notable features include a scalable architecture, automated expiry handling, and comprehensive metrics generation to ensure effective monitoring and management of cybersecurity operations.

Assemblyline UI is a component of the Assemblyline 4 framework that provides a user interface along with various APIs and SocketIO endpoints for interaction and data retrieval. Its primary use case is to facilitate real-time information exchange about system alerts, submissions, and overall health through a consistent JSON output format. Notable features include a comprehensive set of APIs for data access and live updates via SocketIO for seamless user notifications.

Assemblyline 4 - Service Base provides the foundational functionality for developing services within the Assemblyline 4 framework, facilitating the creation of new services via a provided template. Notable features include various image variants for stable and development builds, along with comprehensive documentation to guide service development. This tool is primarily utilized by developers looking to extend the capabilities of the Assemblyline platform in cybersecurity contexts.

MalZoo is a mass static malware analysis tool designed to catalog malware samples by storing metadata in a MongoDB database and organizing samples into a directory structure based on their MD5 hashes. Its primary use cases include analyzing large sets of malware for insights (such as identifying compilation languages and packers) and monitoring emails for malicious attachments. Notable features include support for Docker and AWS Serverless deployment, extensive data collection capabilities, and integration options with tools like Splunk for enhanced analysis and visualization.

apihash_to_yara is a tool designed to generate YARA signatures based on Windows API hashes, facilitating malware detection and hunting through obscured imports. It allows users to extract API exports from DLLs and creates YARA rules with customizable thresholds for various hash variants, making it particularly useful against malware that utilizes API hashing techniques to evade detection. Notable features include support for custom API lists and the generation of multiple hash variants to enhance detection capabilities in malware analysis workflows.

AIDebug is a command-line interface and terminal UI tool designed for malware reverse engineering, emphasizing evidence collection and analysis. Its primary use case involves deterministic offline triage of PE and ELF files, whole-file hex inspection, and in-depth structure analysis with features such as Ghidra-backed reconstruction and local ELF debugging, while also offering optional integration with large language models for enhanced review capabilities. Notable functionalities include paged hex viewing, customizable output formats for analyst reviews, and a robust history tracking system for SHA-256 indexed analyses.

Revagent is a black-box program analysis agent that leverages natural language processing to automate reverse engineering tasks across various file formats, including APKs, firmware, and executable binaries. Users can query the agent directly for insights, bypassing manual command inputs, while it dynamically assembles the necessary tools for tasks like unpacking, disassembly, and reporting findings. Notable features include support for Android and automotive firmware analysis, as well as a unified interface for interacting with different artifact types through a single command.

apk-info is a comprehensive tool for parsing Android APK files, designed primarily for analyzing and extracting information regarding APK contents and signatures. Its notable features include support for multiple APK signature schemes, excellent extraction capabilities for Android Binary XML and resources, and user-friendly command-line and Python bindings for easy integration into workflows. The tool also enhances malware analysis with its specialized extraction functionalities and provides accurate identification of the main activity in Android applications.

This repository offers a curated collection of over 70 free cybersecurity books organized by domain and difficulty, facilitating self-paced learning in various cybersecurity disciplines. Notable features include a structured learning roadmap progressing from beginner to advanced levels, an emphasis on community maintenance for up-to-date resources, and a direct link to an extensive Google Drive library containing the materials.

ShadowRAT is a Telegram-based Remote Access Trojan designed for Windows that provides complete remote control of a machine using Telegram bot commands with password authentication. Primarily targeted at cybersecurity professionals, security researchers, and educators, it serves to demonstrate RAT functionalities, enhance malware detection techniques, and facilitate authorized penetration testing in controlled environments. The tool emphasizes responsible use solely for educational and research purposes, providing insights into attacker methodologies and improving defensive security measures.

Malware-Sandbox-mcp is a cloud-based tool designed to detonate suspicious files and URLs within multiple third-party malware sandboxes, providing normalized reports with threat intelligence data such as verdicts, indicators of compromise (IOCs), and MITRE ATT&CK techniques. It offers a streamlined asynchronous submission and polling mechanism, allowing users to efficiently manage and analyze malware reports while integrating with nine backend services and twenty analytical tools. Key features include a uniform report schema, customizable API key management for backends, and safety mechanisms to prevent exposure of sensitive data.

Malware2.0Database is a repository designed to catalog and archive various malware samples for educational purposes. Its primary use case is to provide researchers and security professionals with access to an up-to-date collection of malware, facilitating the study of malware behavior and trends. Notable features include an organized system for uploading new malware strains while archiving older versions.

Acest repository oferă un curs amplu despre analiza malware-ului, combinând concepte teoretice și metode practice pentru investigarea și contracararea amenințărilor informatice. Structurat în module, cursul acoperă subiecte precum tipologiile malware-ului, ingineria inversă, tehnici de detecție și analize comportamentale, dotând participanții cu abilitățile necesare pentru a înțelege și a combate atacurile cibernetice. Notabilele sale caracteristici includ discuții despre criptografie, tehnici avansate de analiză, utilizarea instrumentelor specializate și o privire detaliată asupra strategiilor de infecție și persistență.

Anya is a fast, offline static malware analysis platform that processes a wide variety of file formats, including PE, ELF, PDF, and Office documents, without executing them. Key features include high-speed analysis of over 250 files per minute, detailed output such as hashes, entropy, and risk scores, while offering integration with MITRE ATT&CK mappings and support for both GUI and CLI interfaces across multiple operating systems. It should be noted that Anya is transitioning its development to the MalChela project for future enhancements.

dotscope is a high-performance, cross-platform framework designed for the analysis, reverse engineering, and modification of .NET PE executables, implemented in pure Rust. It offers features such as efficient memory access, comprehensive metadata analysis, assembly modification capabilities, and a full bytecode interpreter, allowing users to manipulate CIL bytecode and structure without dependence on Windows or the .NET runtime. Additionally, it incorporates advanced functionalities like deobfuscation and static analysis, making it a versatile tool for .NET developers and security researchers.

RAMBreaker is a modular memory-forensics framework that simplifies the analysis of RAM images using Volatility 2 and 3. It automatically detects the operating system and the appropriate Volatility engine to generate a self-contained, interactive HTML report, supporting Windows, Linux, and macOS environments. Notable features include the ability to extract Linux kernel symbols from the RAM image itself, minimizing reliance on external resources, and clear communication of limitations when analysis cannot be completed.

Knife is a comprehensive binary analysis tool designed for reverse engineers, enabling static examination of PE, ELF, and Mach-O file formats without execution. It consolidates multiple analysis functions—such as header parsing, IOCs extraction, and disassembly—into a single command, while providing detailed triage reports on exploit mitigations and dangerous API calls. Key features include a variety of commands for deep analysis, an interactive TUI mode, and extensive output options tailored for vulnerability research and malware analysis.

RVBBIT is an educational proof-of-concept tool for researching Linux kernel rootkits, focusing on how they obscure the actual kernel state from userspace observations. It implements various rootkit techniques, including process and module hiding, syscall interception, and manipulation of filesystem and network visibility, all aimed at understanding these evasion methods in a controlled environment. Notably, the tool is designed strictly for research and education, lacking functional capabilities for exploitation or propagation.

HydraDragonAV Mobile is an advanced Android antivirus solution designed to provide comprehensive threat protection through a multi-layered security architecture. It utilizes static and dynamic analysis techniques, including YARA-X and ClamAV signatures, alongside a lightweight machine learning classifier for real-time detection of malware, ransomware, and other threats. Key features include a high-speed scanning engine, native Rust implementation for efficiency, and a Zero-Trust approach to ensure that known-good applications are exempt from false positives.

PE-pal is a web-based Portable Executable (PE) file analysis tool that translates the internal structure of Windows executables into a user-friendly format, making it accessible for beginners. It features entropy analysis to detect anomalies, classification of imported functions, and string flagging for suspicious elements, all while ensuring that file processing occurs locally in the user's browser for privacy. Notably, PE-pal does not function as a virus scanner but provides insights into the file's behavior and characteristics.

Ghost is a robust process injection detection tool developed in Rust, designed to monitor running processes for signs of code injection, memory manipulation, and other malicious activities on Windows, Linux, and macOS. Its notable features include detection of memory anomalies, shellcode patterns, API hooks, and thread hijacking, all while mapping behaviors to the MITRE ATT&CK framework to aid in threat documentation. The tool offers both a command-line interface and an interactive terminal UI, providing real-time scanning results and support for extensible features like YARA rule scanning and neural ML integration.

malsnitch is a command-line tool designed to assist malware reverse engineering by scanning various artifact formats for embedded secrets within binaries. Its notable features include the ability to detect hardcoded credentials, C2 infrastructure, and crypto keys in binary files, with support for multiple input formats such as raw strings dumps, FLOSS JSON output, and Binary Ninja exports. The tool also offers structured JSON output, automatic deduplication, and the capability to scan memory dumps, making it an efficient resource in identifying obscured sensitive information utilized by malware authors.

Azazel is a lightweight eBPF-based runtime security tracer specifically designed for malware analysis sandboxes. It operates within isolated Docker containers to capture detailed telemetry data, such as syscalls, file interactions, and network activities, producing a JSON output that allows integration with various data processing tools. Notable features include zero runtime dependencies, compile-once run-everywhere capability, and built-in heuristics for automatic alerts on suspicious behaviors.

Atomdrift Scan is a machine learning-based malware scanner designed for detecting 0-day attacks in the software supply chain. Its primary use case revolves around scanning files, URLs, and processes with support for over 100 file formats and more than 100,000 detection rules, delivering an 82% detection rate. Notable features include advanced static analysis with reinforcement learning for frequent rule updates, automated binary reverse engineering, and flexible integration into existing workflows.

Malware Research Hub is a comprehensive local platform designed for malware intelligence, featuring a curated forensic catalog with 2,699 live specimens and a proprietary search engine. Its primary use case is to provide researchers and cybersecurity professionals with an extensive, accessible repository of real malware samples indexed by family and type, while ensuring safety through encrypted storage and a containment-focused design. Notable features include a detailed forensic catalog, an automatic specimen downloader, and a bilingual interface for enhanced usability.

The NPM Supply Chain Security Scanner is a robust tool designed to identify vulnerabilities in NPM and PyPI dependencies, specifically targeting known compromised packages associated with significant supply chain attacks from 2025 to 2026. Key features include comprehensive detection of transitive dependencies, integration with multiple programming ecosystems, and careful analysis of installation scripts and entangled dependencies for malicious patterns, alongside automated script options for continuous security monitoring and reporting.

Rustinel is an open-source endpoint detection tool designed for Windows, Linux, and macOS systems, focusing on providing native telemetry and alerting capabilities. It supports detection formats like Sigma and YARA, enabling rule reuse without needing proprietary adaptations, and produces SIEM-ready alerts in the Elastic Common Schema format. Key features include hot reloading for rules and IOC management, active response options for Windows and Linux, and comprehensive logging of alerts.

Java Triage is a static analysis tool designed for examining suspicious Java codebases, decompiled JARs, and Minecraft mods. It features extensive capabilities including decompilation with CFR, advanced string recovery, and detection of malicious indicators and behaviors, all while producing comprehensive reports in various formats. Notable functionalities include runtime command and control resolution, detailed scoring for findings, and support for detecting obfuscation tactics commonly used in malware.

CILFI (Common Intermediate Language Function Identification) is a specialized tool designed to match methods in .NET binaries against a library of known signatures, facilitating the reverse engineering process. Its notable features include the ability to create generalized signatures using wildcards and regular expressions, support for batch analysis with multiple binaries, and output compatible with .NET deobfuscators. CILFI is offered as both a standalone binary and a reusable library, making it accessible for various analytical workflows.

Unpacker is a modular tool designed for malware analysts to detect and unpack various malware packers such as UPX, ASPack, Themida, and VMProtect, facilitating static analysis. It leverages multiple detection methods including section names, entropy, and heuristics, allowing users to unpack multi-layer packed samples through a streamlined command pipeline. The tool outputs an unpacked file along with validation notes, enhancing the analyst's ability to perform further examinations and providing outputs suitable for integration with other analysis tools.

Sublime Platform is an open-source tool designed for detecting and preventing various email attacks, including Business Email Compromise (BEC), malware, and credential phishing. It utilizes Message Query Language (MQL), allowing users to define and share Detections-as-Code in a provider-agnostic manner, enhancing threat visibility and collaboration. The platform can be deployed via Docker for small to medium-sized environments, with recommendations for larger or production use cases in AWS cloud deployments.

DracoLure is a dragon vector honeypot designed to deceive and analyze attackers by serving realistic fake web assets, thereby enticing them to interact. It features real-time detection and classification of probing attacks, assigns threat scores from 0–100, and automatically quarantines malicious sources when they exceed predefined threat thresholds. With its comprehensive signature library for various attack vectors and real-time response mechanisms, it provides a robust defense mechanism for cybersecurity environments.

IOCX is a deterministic static IOC extraction engine designed for modern security pipelines, specifically focusing on malware analysis and incident response. It ensures zero execution risk by performing pure static analysis on Portable Executable (PE) files, delivering stable and reproducible outputs while effectively handling adversarial input. Key features include a binary-aware parser, high-performance extraction, and compatibility with CI/CD environments, positioning IOCX as a reliable tool for automated threat detection and defense.

The Malware-Sample repository provides a collection of malware samples, each identified by their SHA256 hashes and detailed with links to related posts that describe their functionalities and impacts. The primary use case is to analyze and understand various malware strains, including backdoors, ransomware, and phishing tools, facilitating cybersecurity research and threat detection. Notable features include categorized malware samples, accompanying documentation, and links to external analyses for deeper insights into specific threats.

Awesome Reverse Engineering & Malware Analysis is a comprehensive resource that serves as a curated guide for reverse engineering and malware analysis tools, methodologies, and educational content. It categorizes entries across various disciplines such as static and dynamic analysis, exploit development, and digital forensics while providing quality assurance by checking all links and content for relevance. Notable features include structured learning tracks for different areas of focus, detailed tagging for easy navigation, and inclusion of community resources to enhance collaboration and knowledge sharing.

CollapseScanner is a static security analysis tool specializing in the inspection of Java JARs, class files, and nested archives without executing them. It detects high-risk elements such as hardcoded secrets, suspicious APIs, and obfuscation techniques, allowing for customizable scans through various detection modes and options for detailed reporting. Notable features include support for configuration via TOML files, multi-threading for enhanced performance, and output in machine-readable JSON format for easier integration into automated workflows.

Android Security is a comprehensive resource aimed at enhancing secure app development for Android through various methodologies such as reverse engineering, vulnerability testing, and data protection best practices. Notable features include a catalog of online analyzers and static analysis tools that facilitate multi-faceted security assessments, providing developers the means to identify and mitigate vulnerabilities within their applications effectively.

The "malware-indicators" repository by Citizen Lab provides a comprehensive collection of malware indicators discovered during various investigations, with each directory corresponding to a specific analysis report. Primarily used for tracking and understanding malware-related threats, the tool facilitates research and security analysis by documenting incidents in a structured format. Notable features include detailed reports linking to original findings and organized directories for easy access to specific cases.

Indicators of Compromises (IOC) of our various investigations

The Linux Malware Analysis Container is a Docker solution designed for dynamic analysis of Linux malware, providing a robust environment to isolate malware samples from the host system. It includes pre-installed reverse engineering tools such as strace, gdb, and objdump, allowing analysts to efficiently analyze malicious binaries. Notably, the container can be easily reset for multiple analyses, enhancing operational efficiency in malware research.

The Malware Configuration Extractor (mwcfg) is a tool designed for extracting configurations from various malware samples efficiently. It supports modular extension through MalDuck, allows for multi-threaded processing, and can be utilized via command-line or through a server using Docker. Notable features include the ability to list modules, debug options, and pretty print configurations, making it versatile for cybersecurity professionals analyzing malware behavior.

Karton is a distributed malware processing framework that facilitates the creation of flexible and lightweight backend systems for malware analysis using Python, Redis, and S3 storage. Its primary use case is to streamline malware analysis workflows by integrating various analysis scripts into a cohesive pipeline, enhancing task management and logging capabilities. Notable features include the ability to process tasks through customizable classes, a command-line interface for management, and the option to monitor execution and manage logs, making it suitable for both malware analysis and broader microservice-oriented projects.

MalConfScan is a Volatility plugin designed for extracting and analyzing configuration data from known malware within memory images. It supports various malware families such as Ursnif, Emotet, and CobaltStrike, enabling users to retrieve decoded configuration data and referenced strings. Notable features include functionality for both Windows and Linux memory images, as well as integration capabilities with Cuckoo Sandbox for automated malware analysis.

Malduck is a robust malware analysis library designed to enhance script efficiency and functionality for security professionals. It supports a wide range of cryptographic and compression algorithms, memory model objects for handling various data types, and an extraction engine for modular data retrieval from files and dumps. Notable features include support for fixed integer types, string operations, and a streamlined interface for advanced analysis tasks.

Mquery is a web-based GUI tool designed for malware analysts to swiftly search through large volumes of malware samples using Yara queries. It leverages the UrsaDB for accelerated querying through n-grams, allowing rapid indexing and search functionalities for terabytes of data. Notable features include easy setup with Docker, a user-friendly interface for query execution, and efficient indexing capabilities to manage extensive sample collections.

The mwcfg-modules repository offers tools for extracting malware configurations using the Malduck framework, specifically designed for analyzing various malware types. Its primary use case is to facilitate the extraction of configuration data from known malware variants, including Azorult and Emotet, among others. Notable features include a command-line utility for seamless integration and support for multiple malware configurations, enhancing threat analysis capabilities.

Stitch is a cross-platform Python-based Remote Administration Tool designed for educational and research purposes, enabling users to create customizable payloads for Windows, Mac OSX, and Linux environments. It incorporates features such as command auto-completion, keylogging, file manipulation, and system monitoring, while ensuring secure communication through AES encryption. The tool also facilitates the creation of installers for payload deployment and supports various functionalities specific to each operating system, such as webcam access and password dumping.

DroidDetective is a Python-based machine learning framework designed to analyze Android application packages (APKs) for potential malware behavior. It utilizes a Random Forest classifier trained on data from approximately 14 malware families and 100 benign apps, examining permissions specified in the APK's AndroidManifest.xml file to provide predictions on whether an app is malicious. Notably, the tool offers the ability to retrain its model with new datasets and can output results in both the CLI and JSON format for further analysis.

FIDL is a Python library designed to facilitate the use of the decompiler API within IDA Pro, focusing on vulnerability research and bug hunting in binaries. It provides a set of utilities that simplify the decompilation process for reverse engineering tasks, making it accessible for both specific security assessments and wider reverse engineering applications. Notable features include easy installation via pip, support for development mode with live editing, and comprehensive online documentation.

The Reverse Engineering Android Malware tool provides a comprehensive guide for analyzing and deconstructing malicious Android applications, focusing specifically on the identification of Command and Control (C2) servers within these apps. Notable features include a detailed flow of malware analysis from discovery to reverse engineering, illustrated by a case study of SpyNote malware, which serves as a practical example for users. This repository serves as a resource for cybersecurity professionals looking to enhance their skills in Android malware investigation.

CyberThreatIntel is a tool designed for the analysis of malware and cyber threat intelligence related to Advanced Persistent Threats (APTs) and cybercriminal groups. Its primary use case is to provide detailed analyses and insights on various threat actors, including their techniques, tactics, and procedures (TTPs), by documenting incidents and campaigns over time. Notable features include extensive documentation of specific APTs and malware analyses, enabling cybersecurity professionals to enhance their understanding of threat landscapes and to strategize effective countermeasures.

DECAF is a dynamic executable code analysis framework based on QEMU, focused on binary analysis for security tasks. Its latest iteration, DECAF++, enhances performance significantly with a 2X faster taint analysis and only 4% overhead during normal operations, making it particularly suitable for use in Intrusion Detection Systems. Notable features include its elasticity, allowing selective input analysis and improved efficiency even under heavy workloads.

Awesome Infosec is a curated collection of Information Security resources and tools designed to aid individuals in their studies and practices of cybersecurity. It encompasses various topics, including recon, web security, penetration testing, and exploit development, while also providing links to educational courses and labs. The continuously updated repository serves as a valuable resource for both beginners and experts in the field.

Flanders-Trojan is a Windows-based trojan developed for academic purposes that employs C++ and consists of three main components: a Loader for initial setup and privilege escalation, a Payload for executing various malicious actions (such as file encryption, keylogging, and DDoS attacks), and a Server that functions as the command and control center for managing infected devices. Notable features include VM detection, UAC bypass, and real-time communication with a C2 server, highlighting its capabilities in orchestrating cyberattacks and gathering sensitive information.

The Fuck-Windows-Security script is a malicious tool designed to disable various Windows security features through registry manipulation, effectively bypassing User Account Control (UAC) and gaining elevated privileges. It implements an anti-virtual machine feature to ensure execution on actual systems, while also providing persistence through self-replication by copying itself to the startup folder. Notably, it disables numerous critical security aspects, including Windows Defender, Firewall, and system recovery options, allowing for potential exploitation of the target environment.

The repository titled "Fuck-Windows-Security" appears to be a tongue-in-cheek commentary rather than a functional cybersecurity tool. It does not provide a specific use case or notable features for any security-related applications.

Apollo is a lightweight Remote Access Tool (RAT) developed in Python, designed for post-exploitation tasks, enabling remote code execution and system information retrieval across multiple platforms including Windows, Linux, FreeBSD, and macOS. Key features include AES-256 encrypted communication, support for handling multiple clients simultaneously, basic port scanning capabilities, and functionality to eradicate traces of its presence on the client system.

Auto-PostXploit is a Windows post-exploitation tool designed for Red Team operations, facilitating immediate system reconnaissance following an exploit. Its primary use case involves executing post-exploitation actions on compromised systems using Meterpreter, enabling security professionals to gather critical system information efficiently. Notable features include the ability to upload and execute scripts on target systems and automate information gathering, aiding in the assessment of security postures.

A flexible cross-platform post-exploitation agent written in Go with basic functionalities

Poet is a post-exploitation tool that facilitates remote control and management of compromised machines through a client-server architecture. It allows attackers to perform various operations on the target, such as reconnaissance, file exfiltration, remote execution, and self-destruction of the client. Notable features include a control shell for executing commands, automatic reconnection capabilities, and the ability to remove traces post-exploitation.

PostShell is a post-exploitation tool designed to facilitate advanced shell access through both bind and backconnect methods, enabling attackers to maintain an interactive TTY session with job control while remaining stealthy. Notably, it features cloaked process names to minimize detection, a compact stub size of less than 14kb for easy deployment on Unix-like systems, and built-in anti-debugging mechanisms to enhance resilience against analysis. The tool's design allows for operation in environments with limited dependencies, improving post-exploitation flexibility.

AdbNet is an exploitation tool designed for identifying and compromising vulnerable Android devices across the globe. Key features include post-exploitation modules, device scanning functionalities, IP address management, and integration with APIs from Censys and Shodan for discovering susceptible devices. Users can connect to these devices through common ports, execute commands, and utilize various exploits to gain control over the target systems.

Awesome Malware is a curated repository of various malware, botnets, and post-exploitation tools designed for research and educational purposes. It offers extensive categories such as analysis tools, banking trojans, C2 frameworks, credential stuffing checkers, and more, enabling users to explore and understand malicious software dynamics. Noteworthy features include a focus on free software projects and the inclusion of both historical and contemporary malware resources for comprehensive analysis.

Shennina is an automated host exploitation framework that leverages Artificial Intelligence for comprehensive scanning, vulnerability analysis, and exploitation of target systems. Integrated with Metasploit and Nmap, it features a self-learning AI engine for identifying exploits, supports post-exploitation capabilities, and automates data exfiltration while covering over 40 techniques from the MITRE ATT&CK framework. Notable features include heuristics mode for exploit recommendations, high concurrency performance, and cross-platform support for various operating systems.

Ghost Framework is an Android post-exploitation tool that leverages the Android Debug Bridge for remote device administration. It provides a user-friendly interface to execute various remote management tasks such as accessing the device shell, installing applications, capturing screenshots, and managing device settings. Notable features include password removal capabilities and comprehensive system information retrieval.

awesome-cyber is a curated repository that aggregates a diverse range of cybersecurity tools catering to red, blue, and purple team operations. This resource aims to provide an up-to-date collection of tools across various cybersecurity domains, including offensive and defensive techniques, forensics, and incident response. Notable features include organized categories for easy navigation and an open invitation for community contributions to keep the toolset relevant.

C_keylogger is a stealthy keylogging tool developed in C for Windows that utilizes a traditional approach to log keystrokes without relying on WinAPI hooks. It features persistence, remote activation, a stealth handler to hide the Command Prompt window, and efficient memory management through variable reuse. The tool is designed for educational purposes in a controlled lab environment, requiring specific amendments before compilation to ensure connectivity.

C2KepExec is a Command and Control (C2) server designed to manage a BotNet of machines running a Remote Administration Trojan and is developed for educational purposes. Its notable features include remote keylogging, file management capabilities (uploading and downloading), integrated session control for multiple targets, and persistent infection techniques on Windows systems. The tool also allows for advanced monitoring functions such as screen captures and webcam access.

GOD-OF-RAT is an advanced Python Remote Access Trojan (RAT) framework designed for authorized penetration testing, offering extensive control over compromised systems. Its notable features include live screen controlling, credentials harvesting from various sources, an interactive agent builder with encryption capabilities, and advanced evasion techniques. The framework also supports remote shell access, file system management, and a suite of fun modules for additional functionalities.

MagikIndex is an advanced keylogger designed for stealthy data capture, boasting a low detection rate and various persistence mechanisms. It retrieves logged information via email, supports clipboard monitoring, and can capture screenshots with configurable modes while encrypting logs for security. Notable features include an auto-update capability, extensive system information logging, and a customizable architecture for tailored functionality.

Powtel is a remote system control tool designed for Windows environments, utilizing PowerShell and Telegram as its communication interface. Its primary use case is for authorized security testing and post-exploitation activities, providing features such as task scheduling, file upload/download capabilities, and screenshot functionality. The tool emphasizes ethical usage, aiming to aid cybersecurity professionals and researchers in controlled settings.

PyIris is a modular remote access trojan (RAT) toolkit implemented in Python, designed for the dynamic creation, encoding, and encryption of RAT payloads to facilitate the remote control of compromised systems. Its notable features include cross-platform compatibility for both Windows and Linux, robust error handling, dynamic payload generation, and advanced functionalities such as keylogging, webcam access, and file manipulation, making it a versatile tool for malicious actors. The ongoing development aims to enhance its capabilities further with improved encryption methods and operational persistence techniques.

PythonRAT is a Command and Control (C2) server that orchestrates multiple machines infected with a Remote Administration Trojan (RAT), enabling the formation of a botnet cluster. Its primary use case is for educational purposes in cybersecurity training, allowing users to remotely control, monitor, and manipulate target sessions. Notable features include an integrated keylogger, screenshot and webcam capture, file transfer capabilities, privilege checking, and the ability to issue commands to all active sessions simultaneously.

Reave is a post-exploitation framework developed for hypervisor endpoints, designed to facilitate automated penetration testing in heavily virtualized environments. This Python-based tool operates on a listener/agent model, offering features such as real-time interactive terminal sessions, automatic hypervisor enumeration, and modular payloads for tasks including exfiltration and persistence. Notably, Reave supports versatile configurations for agents, enabling comprehensive control over operations and network interactions.

RedVision is a collection of custom-designed HTML user interfaces specifically intended for Command & Control (C2) systems. Its primary use case is to enhance the operational efficiency of security professionals by providing a visually appealing and functional interface for managing C2 capabilities. Notable features include an array of templates, each visually distinct, allowing for flexible customization to suit various C2 deployment scenarios.

ReHTTP is a PowerShell-based HTTP shell that features a web user interface, designed primarily for remote management and control of clients on a Windows platform. Key functionalities include executing PowerShell commands, managing client connections, and creating custom modules and variables, along with sophisticated event handling capabilities for connection management. This tool also supports scheduled tasks and offers a history feature for command execution, enhancing its usability in system administration and penetration testing contexts.

RustVersary is a comprehensive toolkit designed for malware development and penetration testing using the Rust programming language. It includes a variety of tools and scripts that facilitate tasks such as enumeration, exploitation, and post-exploitation, each thoroughly documented to aid both personal use and community contributions. Notable features include advanced techniques for process injection, persistence mechanisms, and a structured catalog of utilities tailored for security assessment challenges.

The SeaShell Framework is a post-exploitation tool designed for iOS and macOS that facilitates remote access to devices, allowing for control and extraction of sensitive data. Its notable features include a powerful payload named Pwny which supports custom post-exploitation modules, encrypted communication via TLS 1.3, and a basic set of modules for exfiltrating user data such as SMS, voicemail, and browsing history. Actively updated, it supports a wide array of iOS versions susceptible to specific vulnerabilities, enhancing its utility in security assessments and penetration testing.

Silkwire is a gRPC-based Command and Control (C2) framework designed for authorized penetration testing and red team operations. It supports multiple platforms (Windows, Linux, macOS) and offers advanced features including dynamic implant generation, post-exploitation modules, keylogging, and enhanced evasion techniques against detection mechanisms. The tool emphasizes encryption for communications and session management, making it a robust option for security professionals in performing comprehensive security assessments.

Unicorn is a Command and Control (C2) framework designed for post-exploitation and remote control operations. Built using Python and Flask, it features a client-server architecture that supports multiple listeners, dynamic command execution, and client chat synchronization, while still being in development with planned enhancements such as a proxy server and GUI integration. This tool is aimed at cybersecurity professionals for managing agents and executing commands in compromised environments.

ZeroPulse is a modern Command & Control (C2) platform designed for secure remote management and monitoring of systems, utilizing Cloudflare Tunnel technology for encrypted connections. Key features include built-in authentication, support for WinRM and SSH interactions, a responsive React interface with real-time terminal integration, and comprehensive DNS management. The tool is currently in active development and is intended primarily for testing and evaluation purposes.

ShellCode Elevator is a sophisticated tool for bypassing User Account Control (UAC) and injecting shellcode into processes on x64 systems while maintaining stealth and undetectability. Its primary features include fully undetectable operation, privilege escalation, memory-only execution, and anti-debugging mechanisms to prevent detection by security tools. This makes it a potent option for executing malicious payloads without alerts on target systems.

Argus is a comprehensive security scanning tool that integrates Static Application Security Testing (SAST), container security, Infrastructure as Code (IaC) scanning, and dynamic application security testing (DAST) into a single command-line interface (CLI) or GitHub Actions workflow. It supports various scanners such as Bandit, Gitleaks, and Trivy, enabling users to detect vulnerabilities, secrets, and security weaknesses across code, containers, and cloud configurations. Notable features include an interactive terminal UI for triaging scan findings, customizable integration with CI pipelines, and export options for results.

Osprey is a free, open-source browser extension that enhances online security by protecting users from phishing, malware, and other threats through real-time site verification against over 20 threat-intelligence providers. It features a privacy-respecting architecture that anonymizes user data and allows customization of protection settings, making it suitable for both individual and business use. Notably, Osprey never collects or sells browsing data, ensuring user privacy.

Soterios is an open-source security and system maintenance suite designed for Windows, enabling users to scan files, inspect processes, audit system settings, manage firewall configurations, and assess password strength while ensuring privacy through local-first operation. Notable features include a comprehensive security dashboard, malware scanning powered by ClamAV, real-time protection controls, and detailed reports on system health and security assessments. The tool emphasizes user privacy by operating without telemetry or analytics, performing all analysis locally on the user's machine.

UTMStack is an open-source unified threat management platform that combines SIEM (Security Information and Event Management) and XDR (Extended Detection and Response) functionalities for real-time correlation of log data, threat intelligence, and malware activity patterns. Its notable features include advanced threat detection and response, log management, AI-powered analysis, and security compliance support, allowing organizations to effectively identify and mitigate complex threats efficiently. By enabling correlation prior to data ingestion, UTMStack enhances the overall threat prevention capabilities and response times within cybersecurity infrastructures.

ApkClaw is a tool that enables users to control Android devices by sending plain language messages through popular chat applications like WeChat, Telegram, and Discord. Its primary use case involves delegating tasks such as opening apps, tapping buttons, and checking status directly from a computer, leveraging an AI agent for task execution on the Android device. Notable features include multi-platform messaging support, easy setup instructions, and the ability to manage Android tasks remotely, simplifying user interactions with their devices.

AssemblyLine 4 is an open-source automated malware analysis framework designed to support both manual analysis and large-scale enterprise security operations through scalable file triage. Built on Kubernetes and Docker, it offers extensive integration capabilities with various security tools and provides a REST API for customizable extensions. Notable features include deep file analysis, interoperability with threat knowledge bases, and the ability to create additional analysis services via Python.

Assemblyline Base is a foundational package for the Assemblyline suite, providing essential libraries, cachestore, datastore, filestore, and remote datatypes necessary for operational functionality. It is specifically designed for environments running Python 3.11 on Linux systems, with support for both stable and development builds. Key features include robust dependency management and compatibility with containerized deployment via Docker images.

The Assemblyline CAPE Service integrates with CAPEv2 to facilitate the submission of files for automated malware analysis, utilizing a REST API to manage task distribution across virtual victim machines. It retrieves and summarizes analysis reports, providing users with both summarized results and full report access through the Assemblyline UI. This service requires a private CAPE deployment and additional configuration for optimal functionality and reporting.

box-ps is a PowerShell sandboxing utility designed to execute PowerShell scripts in a controlled environment, mitigating security risks associated with running untrusted code. Its primary use case includes testing and analyzing scripts while allowing specific behaviors, such as file system manipulation and process management, through a defined set of properties. Notable features include detailed behavior tracking for code execution, subprocess control, and network probing, along with comprehensive error handling to address various operational issues.

Capa is an advanced tool designed to analyze executable files, specifically PE, ELF, .NET modules, and shellcode, by detecting their operational capabilities. It provides detailed insights into potential functionalities, such as backdoor activities and methods of communication, while allowing interactive exploration of results via a web interface. Notable features include the ability to respond to custom rules, integration with the MITRE ATT&CK framework, and multiple output options for comprehensive analysis.

Defensive Security Hub is a comprehensive repository designed to support Security Operations Center (SOC) analysts by providing a curated collection of resources, tools, and references across various cybersecurity domains. Its primary use case involves enhancing the capabilities of SOC teams through structured access to training materials, threat hunting tools, DFIR methodologies, and intelligence frameworks. Notable features include a well-organized repository structure with sections on training courses, articles, blogs, and various security tools, facilitating quick navigation and resource discovery.

DFIRWS is a digital forensics and incident response (DFIR) tool designed to operate within a Windows Sandbox environment, facilitating streamlined setup and maintenance of necessary forensics tools. Its notable features include automated downloading and updating of DFIR tools through a PowerShell script, synchronization capabilities for offline environments, and a user-friendly configuration process for sandbox setups. This tool is particularly advantageous for cybersecurity professionals seeking to perform incident response without the complexities of managing an extensive DFIR toolkit.

dotscope is a high-performance, cross-platform framework designed for analyzing, reverse engineering, and modifying .NET PE executables using Rust. Its key features include efficient memory access for parsing and modifying CIL bytecode, comprehensive metadata analysis, method injection capabilities, and a rich set of tools for static analysis and deobfuscation. The tool supports native PE operations and is built with robustness in mind, providing memory safety and extensive error handling.

DRAKVUF Sandbox is an automated black-box malware analysis system that operates without requiring agents on the guest operating system, utilizing the DRAKVUF engine for its core functionality. It features a user-friendly web interface for uploading and analyzing suspicious files, along with an installer that simplifies the setup process for beginners while allowing for advanced configuration by experienced users. This tool is designed to facilitate the identification of malicious files efficiently, though it requires specific hardware and software setups for optimal performance.

fast16 is a collection of IDA Pro databases and analysis artifacts specifically for the fast16 Windows malware framework, which features an embedded Lua 5.0 runtime and complex propagation mechanisms. This tool serves as a resource for researchers to verify and extend their analyses of the malware’s component interactions and behavior, offering detailed insights into its operation through reconstructed source code and a structural catalog of its rules. Notable features include the inclusion of decompiled Lua code, mappings of function calls, and a comprehensive database of the malware's execution environment.

Figment is a tool designed to streamline the creation of a malware analysis lab by automating the deployment of FlareVM, REMnux, and CAPE Server through a series of commands. It leverages Packer for image building and Ansible for provisioning, enabling users to set up an isolated, host-only network for capturing network traffic between different VMs. Notable features include compatibility with major hypervisors like VMware, VirtualBox, and QEMU/KVM, as well as the option to use prebuilt Vagrant boxes for rapid setup.

The FLARE Obfuscated String Solver (FLOSS) is a static analysis tool designed to automatically extract and deobfuscate strings from malware binaries, enhancing the traditional `strings.exe` utility. It effectively identifies and extracts various types of obfuscated strings, including static, stack, and decoded strings, thereby improving the analysis of potential malware artifacts. Notable features include support for language-specific string formats and the ability to interface with other tools like Binary Ninja and IDA Pro through additional scripts.

The "Awesome Malware Analysis" repository is a curated collection of malware analysis tools and resources, aimed at facilitating comprehensive malware research and detection. It features a wide array of categories, including malware collections, detection tools, honeypots, and online scanners, providing users with diverse methodologies for malware investigation and analysis. Notable features include organization by specific use cases, such as memory forensics and deobfuscation, which enhance the accessibility of relevant resources for researchers and analysts in the cybersecurity domain.

Ghidra CLI is a Rust-based command-line tool designed for automating reverse engineering tasks within the Ghidra framework. It features a direct communication bridge to Ghidra's JVM, enabling fast, in-memory queries and program analysis without the overhead of separate JVM invocations for each command. Notable functionalities include batch operations, flexible output formats, type system manipulation, and the ability to execute scripts, all of which enhance the efficiency of reverse engineering workflows.

Hydra Dragon Antivirus is an open-source antivirus tool primarily designed for x86-64 Windows systems, focusing on real-time protection against automated threats while avoiding the overhead of heavy signature-based detection. The tool features a minimalistic approach by utilizing key components like Owlyshield and OpenEDR, emphasizing efficiency and instant threat response without interfering with legitimate user actions. It is currently in active development, intended for expert malware analysts, and anticipates future alignment with professional testing standards.

IOC Finder is a tool designed to extract indicators of compromise (IOCs) such as URLs and email addresses from textual data. Its primary use case is enhancing threat detection and analysis by parsing relevant observables from various text sources. Notable features include interactive documentation and a focus on community support for ongoing improvements.

Lancelot is an Intel x86(-64) code analysis library designed to reconstruct control flow, facilitating detailed program analysis. It supports WebAssembly, enabling execution in browser environments, and includes a Zydis-based disassembler for enhanced disassembly capabilities. Notable features include integration with Cranelift for advanced code generation and the ability to create JavaScript bindings for easy deployment in Node.js and browser contexts.

Lenspect is a lightweight security threat scanner that utilizes VirusTotal to analyze potential threats. Its primary use case is to provide users with quick and efficient scans for security vulnerabilities within their systems. Notable features include support for installation via Flatpak and AppImage, providing accessibility across various Linux distributions, as well as a user-friendly interface for enhanced usability.

LIEF is a cross-platform library designed for parsing, modifying, and abstracting executable formats such as ELF, PE, and Mach-O, along with others like COFF, OAT, and DEX. Notable features include a user-friendly API for accessing format internals, support for runtime information, debugging data, and disassembler functionality for multiple architectures. The library provides interfaces for various programming languages including C++, Python, Rust, C, and Node.js, making it highly versatile for developers in the cybersecurity domain.

Macaron is a software supply chain security analysis tool developed by Oracle Labs, designed to verify the build integrity of software artifacts and their dependencies across various ecosystems such as PyPI and npm. Notable features include attestation verification for provenance validation, detection of malicious packages, identification of vulnerable GitHub Actions, and support for reproducible builds through static analysis of build scripts, enhancing the security and traceability of software development workflows.

Malware DB is a malware knowledge management system designed to catalog and manage the lifecycle of malware, benign, and unknown file samples, including their hashes, origins, and similarity metrics. Targeted at malware researchers and forensic investigators, it offers features such as sample categorization via custom taxonomies, group-based access permissions, file encryption, and advanced search capabilities based on file characteristics and Yara rules. This tool is currently in beta and emphasizes best practices for handling potentially harmful samples.

Meow-meow is a repository that compiles a diverse range of cybersecurity research results, showcasing both successful and experimental practical cases. Its primary use case is to serve as a resource for cybersecurity professionals and enthusiasts seeking insights into malware development and practical applications of ethical hacking. Notable features include links to various related publications and books authored by the creator, providing additional context and depth in the field of cybersecurity.

Mobile Security Framework (MobSF) is a comprehensive security research platform for analyzing mobile applications across Android, iOS, and Windows Mobile ecosystems. It facilitates static and dynamic analysis, enabling use cases such as penetration testing, malware analysis, and privacy assessments, all of which can be integrated into DevSecOps workflows via REST APIs and CLI tools. Notable features include support for multiple mobile binary formats, runtime data analysis, and interactive instrumentation for comprehensive security evaluations.

MobileAudit is a Django web application designed for static analysis and malware detection in Android APKs. It provides a comprehensive dashboard that aggregates SAST findings, app metadata, security vulnerabilities, and malware checks, while integrating with VirusTotal and optional tools like DefectDojo. Key features include customizable SAST rules, export capabilities for scan reports, and a token-based API with user management for secure access.

MWDB Core is a malware repository component designed for automated malware collection and analysis systems, facilitating the management and examination of malware binaries and their configurations. Notable features include a robust storage solution, relationship tracking and visualization between objects, a user-friendly interface for querying datasets, and integration capabilities through webhooks and plugins. The tool is aimed at enhancing the effectiveness of malware analysis by providing comprehensive data sharing and user management mechanisms.

PacketSnitch is a network analysis tool that processes packet capture (.pcap) files, providing searchable, protocol-aware insights for security professionals and researchers. Its key features include an Electron-based frontend for interactive browsing and filtering of network traffic, GeoIP integration for location visualization, payload analysis, and support for various protocols. Additionally, it offers AI-generated summaries and a plugin engine for extended functionalities.

PE Library is a modern C++ library focused on parsing and manipulating Windows Portable Executable (PE) files, supporting both PE32 and PE32+ formats. Key features include comprehensive access to PE file headers and sections, utilities for address conversions, and specific structures like import/export tables and resource directories. The library emphasizes performance and simplicity, and it includes a fuzzer that has been utilized to enhance its robustness by identifying and resolving parsing edge cases.

PeNet is a C# library designed for parsing Windows Portable Executable (PE) headers without relying on native Windows APIs. Its primary use case is in malware analysis, providing features such as Import Hash generation, Certificate Revocation List extraction, and various hash computations to facilitate the analysis and manipulation of PE files.

PETriage is a cross-platform Portable Executable (PE) surface analysis tool designed for malware triage, implemented in Rust for efficiency on Linux, macOS, and Windows. It offers a static-only analysis approach, ensuring the PE files are not executed, making it suitable for safe malware examination. Key features include a command-line interface for batch processing, interactive and graphical interfaces for detailed analysis, and extensive detection capabilities that encompass anomaly detection, OPSEC analysis, and PE file manipulation functionalities.

procscope is an eBPF-based process tracer for Linux that enables real-time observation of process behavior, including lifecycle events, file activity, and network connections, with minimal overhead and configuration. It is primarily designed for security researchers and incident responders to trace malware behavior and audit container workloads without the complexities of traditional monitoring tools like EDR. Notable features include support for various process-related events, file operations, and privilege transitions, allowing users to effectively monitor and analyze runtime activity.

PseudoNote is an AI-enhanced plugin for IDA Pro that streamlines malware reverse engineering by automating tasks such as function renaming, code explanation, and generating human-readable C code. Its key features include a markdown editor for analyst notes, customizable AI prompts for specific functions, and the capability to produce detailed forensic reports, with all generated data saved directly to the IDB file for persistent access. This tool is particularly beneficial for malware analysts seeking efficiency in their analysis workflows.

The Rust Malware Sample Gallery is a curated collection designed to assist malware reverse engineers by providing samples of malware written in the Rust programming language. Its primary use case is to enhance the understanding and skills necessary for reversing Rust binaries, particularly as malicious software in Rust becomes increasingly prevalent. Notable features include links to downloadable samples from reputable sources and technical writeups that explore various malware families, offering insights into their characteristics and behaviors.

Speakeasy is a Windows malware emulation framework designed to execute binaries, drivers, and shellcode within a modeled Windows runtime environment, rather than a full virtual machine. Its primary use case is to provide realistic execution paths for malware analysis by emulating various system behaviors, including APIs, file systems, and network activity. Notable features include the ability to run from a command-line interface for quick triage and the option to integrate as a Python library that generates structured JSON reports.

StringSifter is a machine learning tool designed for ranking strings to enhance malware analysis efficiency. It mimics GNU binutils' `strings` functionality while providing additional capabilities like ranking strings based on relevance, supporting batch processing, and offering customizable output options. Notably, it integrates with various input sources, making it adaptable for extracting insights from memory dumps and obfuscated binaries.

The 'suspicious_IPs' repository provides a compiled list of potentially malicious or harmful IP addresses. Its primary use case is for cybersecurity professionals to enhance threat detection and mitigation measures by identifying and blocking traffic from these suspicious IPs. Notable features include a straightforward format that allows for easy integration into firewall rules and intrusion detection systems.

SussyFinder is a PHP web application designed to scan directories for files with specific extensions, particularly PHP scripts, and identify potential malicious content through token and pattern analysis. It features a token-based comparison method that accounts for obfuscation techniques, allows for MD5 hash-based whitelisting and blacklisting, and presents results with color highlights for easy identification. The tool is particularly useful for web server environments but requires cautious use due to the potential for false positives and file deletion capabilities.

ThreatIntel-Reports is a comprehensive repository designed for the extraction and search of content from numerous threat intelligence reports, enabling users to automatically gather data from various feeds. Its primary use case is to facilitate the exploration of threat intelligence through keyword-based searches in both a web interface and command-line interface, with capabilities to store results in JSON format for integration. Notable features include a custom search bar for predefined results and Python scripts that allow users to perform keyword searches and manage output flexibly.

Triager is a DFIR automation platform designed for Windows triage collections, facilitating the processing and organization of various digital artifacts into investigation-ready CSV files. It features a command-line interface (Triager CLI) for parsing and searching processed results, as well as a web console for multi-case management, enabling centralized evidence analysis, role-based access, and collaboration across multiple machines. Notable capabilities include built-in support for integrating various forensic tools, cross-machine correlation, and advanced features such as AI assistance for generating reports and findings.

The Awesome Bootkits & Rootkits Development repository provides a comprehensive collection of resources focused on the development of bootkits and rootkits, targeting both BIOS/UEFI specifications and Windows kernel intricacies. Notable features include analysis tools, tutorials, source code examples for various operating systems, and insights into kernel security mechanisms such as Driver Signature Enforcement and Kernel Patch Protection. This repository serves as a vital resource for security researchers and developers interested in low-level malware development and analysis.

The Native Predicate Solver is a C++ plugin for Binary Ninja that efficiently removes opaque predicates from binary functions, thereby optimizing decompilation and analysis. It leverages multi-threading for parallel function processing and conducts iterative analysis to ensure comprehensive removal of constant conditional branches. The tool is designed for speed and performance, making it particularly effective for managing large binaries.

Reversecore MCP is an AI-powered server designed to facilitate reverse engineering and security analysis by integrating 120 analysis tools into a unified interface. It utilizes natural language processing to allow AI assistants to perform tasks like malware analysis, vulnerability research, and source code auditing, significantly simplifying the interaction with complex command-line tools. Notable features include structured tool results that AI can reason about and chain into follow-up queries, making it highly efficient for rapid security assessments and investigations.

The Rootkits Development Starter Pack provides a collection of Windows kernel-mode driver examples that demonstrate fundamental rootkit functionalities such as thread creation, process callbacks, and filesystem filtering. Its primary use case is to educate users on kernel-level development and guide them through creating modular steps for advanced rootkit development. Notable features include a comprehensive set of proof-of-concepts, detailed instructions on building drivers, and essential information on Windows kernel operations and security measures.

The Mandiant VM-Packages repository provides PowerShell scripts that facilitate the installation and configuration of tools for binary analysis environments, specifically FLARE VM and CommandoVM. Notable features include automated package building and testing using GitHub Actions, a public MyGet package feed for easy access, and community contributions for package development and improvement. This setup enhances transparency and reduces manual maintenance for users, ensuring that tools can be effortlessly integrated into their virtual machine environments.

Awesome is an open-source repository that aggregates a variety of tools and resources across multiple domains including communication, development, finance, and information security. Its primary use case is to provide users with a centralized catalog of high-quality software, libraries, and educational resources, aiding in quick access to knowledge and tools. Notable features include a structured table of contents for easy navigation and a focus on simplicity, readability, and collaboration best practices.

capa-rs is a file capability extractor designed to analyze executable files, including PE, ELF, Mach-O, and .NET binaries. It identifies specific capabilities and behaviors, such as potential backdoor functions or security attributes like ASLR and NX, while providing a command-line interface for ease of use. The tool is a Rust implementation of the original Python capa, offering high accuracy and customizable security checks, making it suitable for in-depth malware analysis and binary security assessments.

APKdevastate is a Windows application designed for the security analysis of Android APK files, focusing on identifying malware signatures, potential security risks, and suspicious behaviors by evaluating permissions, certificate details, and known RAT indicators. Key features include permission analysis, certificate verification, RAT detection, hash generation, and risk assessments, streamlining the process of evaluating APKs for malicious content. The tool also supports a CLI version for Linux users, further enhancing its accessibility for different platforms.

disrobe is a static Rust binary designed for decompiling, deobfuscating, and unpacking compiled software across more than 20 programming ecosystems, including Python, JVM, .NET, JavaScript, and native binaries. It operates without executing the sample code, ensuring byte-identical outputs across platforms, supported by rigorous testing and validation against known references. Key features include automated pipeline composition for various formats and robust reporting on coverage and limits, with an option to run in-browser for experimentation.

dz6 is a fast Vim-inspired hex editor designed for terminal environments, enabling efficient editing of large files in hex or ASCII formats. Notable features include Vim-like key bindings, customizable options, regex string filtering, and the ability to parse PE/ELF headers, making it suitable for tasks involving low-level file inspection and manipulation. The tool is cross-platform, open-source, and offers a variety of navigation and editing commands to enhance user experience.

Malcontent is a subtle malware discovery tool that leverages context, differential analysis, and over 14,500 YARA rules to uncover supply chain compromises, primarily targeting Linux binaries but also supporting other UNIX platforms and Windows. Its three operational modes—analyze, diff, and scan—facilitate extensive program capability assessments, risk-weighted comparisons, and threshold-based scanning. Key features include support for multiple binary formats, various output formats, integration within CI/CD pipelines, and specific configurations for handling archives and container images.

MWEmu is a Rust-based hardware emulator and OS process simulator primarily designed for dynamic malware analysis and testing, focusing on Windows processes with some Linux support. It features fast and reliable x86 32/64-bit emulation, extensive implementation of 339 CPU instructions, and 260 WinAPI calls, as well as tools for memory tracking, state exploration, and interaction with various shellcodes and malware payloads. Notable functionalities include command-line, Rust, and Python library interfaces, as well as advanced dynamic analysis capabilities like iteration detection and PE execution.

ReverseLab is an open-source reverse engineering lab designed for capturing and analyzing various attack scenarios across multiple domains, including CTF pentesting, APK reverse engineering, and PE binary analysis. Its notable features include a comprehensive knowledge base organized into specialized categories, over 100 automation tools for rapid execution, and a modular architecture that supports various signal types and attack chains. Users can easily set up the tool on multiple platforms with provided scripts, ensuring a streamlined onboarding experience.

ShadowStrike Phantom is an open-source endpoint protection platform for Windows 10/11 that aims to deliver advanced threat detection capabilities comparable to commercial EDR solutions. Notable features include a custom kernel driver with 20 detection subsystems, an on-device analysis engine utilizing neural networks, and a malware emulation engine—all designed to ensure transparency and audibility in its security processes.

ttd-capa is a capability extractor that works with Time Travel Debugging (TTD) traces to identify the capabilities exercised by a binary during its runtime execution. Designed to enhance the analysis of packed or obfuscated malware, it generates CAPA-compatible reports that allow for the extraction of runtime capabilities, leveraging full execution context and timestamp data for detailed analysis. Notable features include automatic resolution of string arguments, reconstruction of execution order, and integration with existing CAPA rule sets for comprehensive malware triage.

r2morph is a metamorphic mutation engine that enables tracked binary transformations, operating with structured validation and reporting. It supports various architectures and binary formats, offering 18 diverse mutation passes along with multiple validation modes and comprehensive reporting capabilities in formats such as SARIF and JSON. Key features include session management for rollback, a detection suite for various signatures, and the ability to analyze virtual machine handlers for devirtualization.

The TryHackMeRoadmap repository provides a curated list of over 350 free TryHackMe rooms, categorized by skill level and topic, aimed at enhancing the learning experience for cybersecurity enthusiasts. Its notable features include a structured approach that covers various areas such as network security and web exploitation, alongside self-contained rooms with practical exercises to facilitate hands-on learning. Regular updates ensure relevance and accessibility to new resources in the evolving cybersecurity landscape.

The Advanced Anti-Sandbox Virtual Machine tool develops techniques to counteract sandbox detection in malware analysis environments. Its primary use case is to assist security researchers and malware developers in executing samples without triggering detection in virtualized analysis frameworks by employing various bypass strategies, including path verification and time-based checks. Notable features include static bypassing capabilities, integration with C++ programming, and the ability to adapt to various sandbox systems, enhancing the efficacy of evasion techniques.

Brovan is an interactive x86_64 binary emulator designed for the analysis and execution of untrusted software while providing advanced features for reverse engineering, API tracing, and network traffic interception. It supports multiple binary formats, leverages hardware acceleration through WHP and KVM backends, and includes a custom Vulkan graphics layer for rendering applications. Primarily aimed at cybersecurity professionals and researchers, Brovan facilitates safe program execution and detailed inspection of system calls and network activity.

Detect It Easy (DiE) is a versatile file type identification tool designed for malware analysts and cybersecurity experts, employing both signature-based and heuristic analysis to deliver accurate file inspections across Windows, Linux, and MacOS platforms. Its key features include flexible signature management for customizable detection rules, a JavaScript-like scripting capability for tailored analysis, and a comprehensive support for various executable and archive formats. The tool aims to minimize false positives, making it an essential resource for digital forensics and malware detection.

Glaurung is a modern reverse engineering framework that aims to provide an AI-native binary analysis experience, effectively serving as a contemporary alternative to Ghidra. Utilizing Rust for performance and Python for accessibility, it integrates AI throughout the analysis pipeline, offering capabilities like automated format detection and decompilation for x86/x64 and ARM architectures. Notable features include a persistent knowledge base, a Python API for scripting, and built-in AI tools, making Glaurung suitable for both automated analysis and advanced reverse engineering workflows.

HikariSystem HexCore is an open-source IDE designed for reverse engineering, binary analysis, and controlled emulation within the VS Code environment. It features a comprehensive disassembly and decompilation pipeline, supporting targeted analyses of PE and ELF binaries, and offers automated batch processing for pipeline tasks. Notably, it integrates sophisticated tools like LLVM IR lifting, semantic queries via HikariSystem Query Language, and a vulnerability audit engine, positioning itself as a powerful solution for analyzing complex binaries and improving the reverse engineering workflow.

Nauz File Detector is a portable utility designed to identify linkers, compilers, and packers used in files across macOS, Linux, and Windows platforms. Its primary use case is for reverse engineering and malware analysis, providing users with the ability to quickly analyze file formats. Notable features include cross-platform compatibility and easy access to detailed documentation for setup and usage.

Radare2 is a comprehensive reverse engineering framework designed for Unix environments, providing a suite of tools and libraries to facilitate tasks such as binary analysis, disassembly, and debugging. Notable features include support for scripting through an embedded JavaScript interpreter, local and remote debugging capabilities, and extensive plugin architecture that enables users to extend its functionality with various plugins. This tool is especially aimed at security researchers and developers looking for powerful solutions in binary exploitation and reverse engineering.

Lumina Sentinel is a behavioral anomaly detection and orchestration framework designed for security researchers and threat analysts to analyze the behavior of credential stealers and remote access trojans (RATs) in a controlled environment. Its notable features include a Behavior Replay Engine that reconstructs infostealer actions with MITRE ATT&CK™ mapping, real-time process tree visualization via D3.js, and multilingual intelligence reporting to facilitate global collaboration. The framework emphasizes security and education by operating in isolated containers without affecting the host system.

The "Reverse Engineering" repository provides a thorough and free tutorial series focused on reverse engineering across multiple architectures, including x86, x64, ARM, AVR, and RISC-V. Its primary use case is to educate users on the principles and techniques of reverse engineering, complemented by practical resources such as tool links, a Ghidra plugin, and a companion e-book. Notable features include hands-on challenges and links to additional hacking courses and CTFs designed to deepen practitioners' understanding of embedded systems and software security.

TryHackMeWriteups is a comprehensive repository that curates free TryHackMe rooms, providing organized resources for cybersecurity enthusiasts to learn and practice various skills. Notable features include categorized rooms across diverse topics, detailed notes and summaries, step-by-step writeups for Capture The Flag challenges, and continuous updates, making it an ideal starting point for beginners in cybersecurity and ethical hacking.

Project Chisel is a comprehensive modding toolkit for Geometry Dash, enabling developers and reverse engineers to deeply analyze and modify the game through a robust framework built on full decompilation analysis. It features a precision modification engine that allows granular control over game systems, seamless integration with the Geode mod loader, and a responsive UI framework for custom in-game menus. Notable capabilities include non-destructive overrides, automated patching for version-specific binaries, and multilingual support for localized modding experiences.

XAPKDetector is a cross-platform tool designed for detecting and analyzing Android APK and DEX files, providing information on build tools, libraries, and security protections. Its primary use case lies in aiding developers and security analysts in assessing the integrity and characteristics of APK files. Notable features include comprehensive reporting on the application's components and support for multiple operating systems including Windows, Linux, and MacOS.

1337kit is a 64-bit Loadable Kernel Module (LKM) rootkit builder designed for educational use, allowing users to create custom rootkits based on YAML configurations. Its notable features include remote shell connectivity, the ability to hide files, process IDs, and network connections, as well as obfuscation and encryption options for enhanced stealth. This tool is tailored for malware analysts and cybersecurity practitioners involved in creating Capture The Flag (CTF) exercises.

flarevm-up automates the provisioning of Windows 10 virtual machines with FLARE VM tools installed, specifically designed for digital forensics and malware analysis. This tool utilizes Vagrant and VirtualBox to quickly set up multiple environments for blue team operations, facilitating rapid deployment for analysis tasks. Notable features include seamless integration of necessary forensic tools and straightforward setup instructions.

YAPS is a lightweight PHP reverse shell that operates as a single file, allowing users to execute commands on remote systems through a TCP listener. It features customizable password protection, enumeration capabilities for gathering system information, and the ability to manage concurrent connections and execute PHP code remotely. Notably, it can auto-download enumeration tools, exploit known vulnerabilities like CVE-2021-4034, and send shellcode to the target host while supporting operations on both Linux and Windows in future updates.

The CTF Resources repository is a comprehensive collection of cybersecurity tools and practice platforms specifically designed for Capture the Flag (CTF) competitions. It includes an extensive array of tools categorized into areas such as Open Source Intelligence (OSINT), steganography, and anonymous communication, offering functionalities from data gathering and analysis to secure and anonymous internet browsing. Notable features include links to various open-source tools, detailed descriptions, and categorization for ease of use, supporting users in enhancing their digital security skills.

My Reversing Utils is a collection of open-source tools designed for reversing, debugging, and software analysis, offering utilities for process management as well as web and binary analysis. Key features include the ProcSuspender, which enables users to launch processes in a suspended state for detailed debugging. This repository serves as a practical resource for security researchers and developers looking to facilitate their software analysis tasks.

The Reversing Bits Cheatsheets repository serves as a comprehensive resource for assembly programming, reverse engineering, and binary analysis tools. It includes in-depth guides on installation, usage examples, and advanced tips for a variety of tools, such as assemblers, debuggers, disassemblers, and binary analysis frameworks, catering to different operating systems and user needs in the field of cybersecurity. Notably, it features prominent tools like Ghidra, IDA Pro, and GDB, making it a valuable reference for professionals involved in security and malware analysis.

libdebug is a Python library designed for programmatic debugging of userland binary executables, aimed primarily at developers and researchers in reverse engineering and exploitation. Its notable features include the ability to access process memory and registers, control execution flow, handle syscalls and signals, and debug multithreaded applications, all while emphasizing high performance. The tool provides seamless integration with GDB for interactive analysis and supports debugging on various Linux architectures.

sentinel-reverse is an AI-powered autonomous binary reverse engineering tool designed to enhance the efficiency of analyzing complex binaries by automating traditional manual processes. It features capabilities such as AI-driven function decompilation, LLM-based semantic inference for variable naming, and context-aware vulnerability detection, enabling analysis of 50-200 functions per hour with complete data privacy and zero API costs. This tool leverages GPU acceleration and incorporates a multi-round confidence-driven analysis to optimize the reverse engineering workflow.

Security Books is a comprehensive repository offering over 160 curated cybersecurity-related books, guides, and resources, catering to various skill levels from beginners to advanced practitioners. This tool features a fully categorized structure with clickable links for instant access to each resource, ensuring that the cybersecurity community has free access to critical knowledge. With a commitment to regular updates, it serves as a valuable, continually expanding library for topics ranging from ethical hacking to network defense.

APKX-Hunter is a comprehensive open-source Android Static Analysis Framework developed in C, tailored for security assessments, malware analysis, and penetration testing of Android applications. It supports a wide array of package formats and features advanced capabilities such as recursive multi-APK scanning, integration of OWASP MASVS compliance checks across 15 categories, and a machine learning-based secret classification engine for efficient vulnerability prioritization. Notable features include detailed scan statistics, various decompilation methods, and streamlined integration for Debian systems, making it a robust tool for security researchers.

Packj is a GitHub Action that audits pull requests for malicious or risky open-source dependencies across NPM, PyPI, and RubyGems ecosystems. It employs static, metadata, and dynamic analysis to identify security vulnerabilities, flagging packages based on over 40 risky attributes derived from extensive research on supply chain attacks. Notable features include the ability to integrate seamlessly into GitHub workflows and provide feedback via comments on pull requests when risky dependencies are detected.

aur_checker is a command-line security analysis tool designed for inspecting Arch Linux AUR PKGBUILD files to detect potential vulnerabilities. It employs a context-aware static analysis methodology, optionally enhanced with AI inspection, resulting in detailed risk assessments that include trust signals and explainable scoring. Key features include a user-friendly output format, JSON integration for CI purposes, and the ability to analyze multiple packages or files simultaneously.

ClawSecure is an independent security scanning and auditing platform designed for the OpenClaw ecosystem, which focuses on ensuring the integrity and safety of AI agent skills and workflows. It features a proprietary 3-Layer Audit Protocol that has examined over 3,000 skills against all OWASP ASI Top 10 security vulnerabilities, revealing that 41% of audited skills contain security flaws. It also offers free developer tools to enhance functionality and user experience within the OpenClaw framework.

Wordfence CLI is a high-performance security scanner designed for detecting PHP malware and vulnerabilities in WordPress installations. Written in Python, it operates in a multi-process environment, allowing for parallel scans, scheduling, and integration with other commands via input and output piping. Notable features include the ability to scan directories for malware and vulnerabilities efficiently, as well as comprehensive installation and configuration documentation.

DLL Hijacking Vulnerability Scanner is a specialized tool for identifying DLL hijacking vulnerabilities within signed Windows executable files. It features automated scanning, DLL dependency analysis, and comprehensive filtering options, enabling security professionals to test executables for hijacking susceptibility and analyze their DLL loading behaviors, as well as generating detailed vulnerability reports.

BitDefender Total Security Ultimate Protection is a comprehensive cybersecurity suite that functions as a modular framework for fortifying network defenses against a wide array of cyber threats. Its primary use case revolves around system hardening, employing features such as vulnerability scanning, real-time threat correlation, and sandbox-based execution to protect various environments from evolving threats. Notable capabilities include automated policy enforcement, advanced heuristic analysis, and deep kernel inspection for rootkit remediation, all integrated within a responsive interface supporting multilingual operations and continuous 24/7 support.

The Shai-Hulud 2.0 Detector is a cybersecurity tool designed to protect projects from the Shai-Hulud 2.0 npm supply chain attack, a significant threat that compromised numerous packages in the npm ecosystem. Its primary use case involves detecting vulnerable packages and facilitating community reporting of compromised software, enhancing the security posture of development environments. Notable features include automated daily updates of an affected packages database, advanced configuration options for tailored scanning, and support for various integration methods including GitHub Actions and local CLI usage.

FalconEye is a comprehensive, self-hosted OSINT investigator's toolkit designed to streamline the investigation process through eighteen specialized modules. It facilitates a wide range of investigative tasks including cryptocurrency wallet tracing, phishing kit analysis, and domain intelligence, all integrated within a single interface that promotes one-click connectivity between related tools. Key features include LLM-powered scam detection for email headers, multi-source IP reputation assessments, and a fictional persona generator, making it a versatile platform for cybersecurity professionals.

Intel Codex is a comprehensive operational manual designed for digital investigators and security analysts, emphasizing OSINT methodologies and security protocols. It features over 40 standard operating procedures (SOPs), guides for various social media platforms, and case studies that illustrate practical applications in real-world investigations. Notable elements include legal and ethical compliance frameworks, detailed investigation techniques, and a focus on malware analysis and penetration testing methods.

Navi Multitool is a high-performance terminal application designed for security testing and OSINT exploration, featuring a modern user interface and an extensive suite of specialized modules. Notable functionalities include Discord operations, advanced exploitation tools such as a Discord RAT and SQL scanner, and utilities for network mapping and cryptography. This tool caters to various use cases from automation of Discord tasks to targeted intelligence gathering and exploitation, providing users with a comprehensive arsenal for cybersecurity tasks.

The Excalibra cybersecurity repository serves as a comprehensive educational resource designed to enhance skills in ethical hacking, penetration testing, and cybersecurity fundamentals. Key features include detailed sections on Open Source Intelligence (OSINT), the use of Nmap for network discovery and security auditing, insights into social engineering tactics, and guidance on employing Kali Linux, making it a valuable tool for individuals seeking a structured learning path in cybersecurity.

IntelOwl is an open-source Threat Intelligence management tool designed to provide comprehensive threat data regarding malware, IP addresses, and domains through a single API request. It features a fully-fledged REST API, a built-in graphical user interface for data visualization, and a modular plugin framework that allows for integration with various analyzers and connectors, facilitating automation for security analysts. Its scalability and speed in retrieving intelligence data make it suitable for enhancing the efficiency of security operations centers (SOCs).

The phishing_kits repository provides an archive of phishing kits collected from suspicious domains identified by phishunt.io. Its primary use case is for research and OSINT purposes, offering a structured layout for easy access to these kits while maintaining the original capture format. Notable features include organization by date and hostname, facilitating efficient analysis and study of phishing techniques.

Ransomposts is a tool that aggregates and displays ransom notes published by ransomware groups, with updates occurring twice daily from the source at ransomware.live. Its primary use case is to provide cybersecurity professionals and researchers with timely information about ransomware activities and trends. Notable features include automated data fetching and a dedicated publication interface accessible via a web link.

Spydi's ThreatIntel Feed provides aggregated threat intelligence blocklists sourced from various OSINT databases, honeypots, and C2 trackers, offering tiers of confidence for IP and domain blocklists. It features multi-source validation to enhance accuracy, automatic whitelisting of CDN IPs to minimize false positives, and is constructed for compatibility with tools like Pi-hole and AdGuard. The service is designed for rapid global distribution via Cloudflare R2, ensuring low latency access to threat intelligence data.

ThreatFox IOC IPs is a Python-based tool that generates a machine-readable IP blocklist sourced from ThreatFox, a project by Abuse.ch. It provides users with an updated blocklist of malicious IPs every hour, making it suitable for cybersecurity applications like threat intelligence and proactive network defense. Notable features include automatic updates and compatibility with the AIOHTTP library for efficient data handling.

TweetFeed is a dynamic tool that aggregates and provides feeds of Indicators of Compromise (IOCs) shared by the community on Twitter/X, facilitating cybersecurity research and threat intelligence. Notable features include programmatic access with various output formats such as CSV, RSS, MISP, and STIX, along with real-time updates every 15 minutes to ensure the data is current and relevant. This enables users to easily integrate the IOCs into their security workflows and monitoring systems.

The USOM Blocklists repository provides a daily updated collection of malicious URLs and IP addresses compiled by the Turkish Cyber Security Directorate. It serves as a resource for cybersecurity professionals to enhance their threat detection and prevention capabilities, offering various formats of blocklists suitable for different applications, such as ad blockers and network filtering tools. Notable features include multiple download options for blocklists and integration with GitHub Actions for automated updates.

AutoShell is a web scanner tool designed to identify vulnerabilities and potential file upload points on websites. Its primary use case is to exploit such vulnerabilities by uploading files using various evasion techniques, including modifying file extensions, employing steganography, and using polyglot files to bypass security measures. Notable features include automated vulnerability detection, an array of file manipulation techniques to conceal uploaded scripts, and a user-friendly interface for initiating scans.

DogeRat is a premium Android RAT (Remote Access Trojan) designed for comprehensive control over target devices, specifically within an educational context. Key features include real-time screen capture, advanced keylogging, and the ability to manage files and applications remotely, alongside a powerful admin dashboard that supports simultaneous control of multiple devices. The tool also offers undetectability by antivirus software and persistent functionality, ensuring uninterrupted access even after device restarts.

Ghost Shell is a user-friendly Python-based backdoor generator that simplifies the process of creating payloads for Windows, Linux, and Android using msfvenom. It automates the payload creation and Metasploit listener setup for ease of use, featuring one-click operations and a visually appealing interface tailored for beginners in cybersecurity. Notable features include compatibility with services like Ngrok, customization options for IP and port, and a lightweight design aimed at educational purposes only.

Kizagan is a Remote Access Trojan (RAT) and Command and Control (C2) tool developed in Python, designed to create executable files for controlling compromised machines. Key features include advanced functionalities such as file management, real-time screen streaming, capturing screenshots and video from the victim's camera, and an integrated keylogger. The tool is intended for educational use in security research and red teaming, with ongoing development for enhanced capabilities.

Pinkcord is a Python-based remote administration tool that uses Discord bots for command and control (C2) communication, allowing users to manage remote systems in a manner analogous to traditional RATs. Notable features include executing remote shell commands, file transfers, screen capture, and system interaction capabilities, while leveraging Discord's infrastructure for seamless communication. It is important to note that Pinkcord is designed strictly for educational purposes and its misuse can lead to legal repercussions.

RAR-NextgenerationAI-expliot is a robust toolkit designed for conducting scientific investigations into malware development and evasion techniques. It encompasses a variety of functionalities, including executable file creation, RAR file assembly with both documents and payloads, process injection, and advanced AI-driven methods to evade detection by security mechanisms. Additionally, it integrates polymorphic code and persistence techniques to enhance stealth and maintain access, culminating in a comprehensive resource for malware analysis and research.

RunAs-Stealer is a credential harvesting tool designed to exploit Windows systems by implementing three techniques: hooking `CreateProcessWithLogonW`, smart keylogging, and remote debugging. Its primary use case is to stealthily capture user credentials and store them in an alternate data stream of a desktop.ini file for later retrieval. Notable features include continuous operation in the background and the ability to eliminate captured credentials directly via command-line instructions.

slopShell is a PHP webshell designed for educational exploitation purposes, primarily allowing unauthorized file uploads to potentially compromised servers. Notable features include mutual TLS support in future iterations, a more refined dropper to evade detection, and the ability to interface with a personal database of cloud entities. This tool is intended for use in controlled environments and is equipped with capabilities for randomized user agents to minimize detection risks.

SpyAI is an intelligent malware designed to capture screenshots of entire monitors and exfiltrate the data via a secure channel to a Command and Control (C2) server. Utilizing GPT-4 Vision, it analyzes the images frame by frame to construct daily activity reports. Key features include integration with Slack for secure communication and customizable operational parameters for timing and monitoring.

DRILL (Distributable Remote Integrated Lightweight Link) is an advanced Command and Control (C2) framework designed for covert operations across diverse environments. Key features include WebSocket communication for efficient data transfer, single-port operation to evade detection, cloud tunnel compatibility, and comprehensive file transfer options. Additionally, it supports cross-platform payload generation and offers a redesigned user interface for improved usability, alongside robust persistence mechanisms and post-exploitation modules for enhanced control over target systems.

R8HEX is a flexible Android Remote Access Tool (RAT) designed for cybersecurity professionals, students, and researchers to understand malware behaviors without the need for port forwarding. This tool offers extensive features such as SMS management, camera access, microphone recording, and device location tracking, with both free and paid versions providing varying levels of functionality. Its integration with Telegram allows for seamless remote management and control of Android devices during security assessments.

Viridae is a malicious software repository designed for educational purposes, emphasizing malware research and analysis. The tool is implemented in Python 2 and is intended to work across various Linux distributions and Termux on Android, allowing users to study different forms of malware behavior. Notably, it requires a specific set of Python dependencies and offers installation instructions for easy setup.

ZYRA is a Zig-based obfuscator, packer, and loader aimed at safeguarding executable files against static analysis and reverse engineering. Its notable features include performance optimization through Zig, the ability to generate complex control flow to hinder reversing efforts, and runtime decryption for secure execution of payloads. Currently, ZYRA supports Linux, with straightforward installation and usage options for packaging executables.

AndroidHack_BackDoor is a Python and shell script designed to facilitate the integration of a backdoor into Android APK files while leveraging the Android Debug Bridge (ADB) for remote device access. It is primarily intended for educational use and requires a solid understanding of various technical tools such as Metasploit, Apktool, and the Android SDK. Notable features include a simplified process for backdoor insertion and remote accessibility of Android devices.

Exploit is an offensive hacking tool designed to assist cybersecurity professionals and ethical hackers in executing exploits and conducting penetration testing. Its primary use case is to facilitate hacking activities, enabling users to automate various exploitation tasks. Notable features include ease of installation on any Linux distribution and comprehensive support for dependency management through a requirements file.

FSOCIETY RAT V2 is a Discord-based Remote Administration Tool designed for system control and manipulation through a command line interface. Its primary use case includes executing system commands, accessing device features like screenshots and webcam capture, and credential dumping. Notable features encompass new keylogging capabilities, process management, and various trolling options, all while emphasizing ethical use in educational contexts.

PANDORA is a multifaceted cybersecurity tool designed primarily for offensive security tasks, including DDoS attacks, web scanning, and data extraction through various methods like SQL injection and doxing. Notable features encompass a range of hacking utilities such as a deface maker, database dump capabilities, network sniffing, and an auto exploitation tool, making it versatile for both penetration testing and malicious activities. The tool is presented with detailed installation instructions for multiple environments, including Linux and Termux.

reveng_rtkit is a Linux Loadable Kernel Module (LKM) rootkit specifically designed for the 5.11.0-49-generic Linux kernel, primarily used for post-exploitation stealth techniques. Its key features include syscall table address retrieval, function hooking, and the capability to hide itself and other processes from system monitoring tools, making it difficult to detect. Additionally, it implements an IOCTL for interactive control and can bypass known rootkit detection tools like rkhunter.

Yaralyzer is a tool designed for the visual inspection of regex and YARA matches within binary and text files, allowing users to view the actual bytes matched along with their surrounding context. It supports scanning with customizable regex patterns or YARA rules, detecting potential character encodings of matched bytes, and can display results in various formats such as SVG and HTML. Notable features include the ability to force different character encodings on matched regions and export findings in a visually appealing format, facilitating deeper analysis of patterns within data.

Diamorphine is a Linux kernel module rootkit designed for various Linux kernel versions from 2.6 to 6.x across x86/x86_64 and ARM64 architectures. Its notable features include the ability to conceal processes and directories, as well as granting root privileges to specified users through specific signal commands. This tool enables undetected manipulation of the system, making it particularly useful for advanced stealth operations in cybersecurity contexts.

emp3r0r is an advanced, zero-trust post-exploitation framework and command & control (C2) system designed for secure operations on both Linux and Windows environments. Its notable features include autonomous gossip mesh networking, fileless memory execution of Starlark-scripted agents, and robust cryptographic identity pinning, ensuring high levels of stealth, operational control, and security against impersonation attacks. The framework facilitates seamless integration and execution without relying on host-based interpreters, making it highly suitable for high-security scenarios.

Malware-Analysis is a comprehensive toolkit designed for learning and practicing malware analysis techniques, including reverse engineering, dynamic/static analysis, and sandboxing. The repository offers scripts, tools, and sample malware that facilitate hands-on experience in malware detection, classification, and analysis workflows. Noteworthy features include a curated collection of resources for anonymization, honeypots, and open-source threat intelligence, making it a valuable asset for cybersecurity professionals and researchers.

PROTECT-KIT appears to be an unmaintained cybersecurity tool with no functional capabilities, as indicated by the warning of being "USELESS Code." Due to its lack of maintenance and features, it is not suitable for any practical use case in the cybersecurity domain.

PyHTools is a comprehensive collection of Python-based hacking tools designed for network security assessments, including functionalities such as network scanning, ARP spoofing, DNS spoofing, and credential harvesting. It features a user interface for accessibility while allowing command-line usage for advanced users, with an emphasis on ethical use, as all malicious components are stored in a separate repository. The toolkit facilitates a wide range of cybersecurity practices, from reconnaissance to exploitation, but users are warned against any illegal applications.

The Dark Mark is a command and control (C2) framework designed for efficient management of cybersecurity operations, enabling real-time command execution and secure client communication. It supports scalability, facilitates monitoring of client activities, and is user-friendly for both small and large-scale deployments. Key features include an intuitive command set for module management and easy setup, making it a versatile tool for cybersecurity professionals and researchers.

Black-Hat-Zig is a cybersecurity tool that focuses on implementing various malware techniques using the Zig programming language, catering particularly to security researchers, malware developers, and reverse engineers. Notable features include continuous updates and a community-driven approach, which encourages contributions to expand its functionality and content. This tool serves as a resource for exploring and weaponizing capabilities within the Zig environment.

The Fake-SystemUpdate-Malware-Simulator is a malware simulation tool designed to illustrate common stealth techniques employed by real-world malware, masquerading as a Windows system update executable. It features keylogging, periodic screenshot capture, and IP-based geolocation tracking, all while maintaining persistence by utilizing Windows Startup locations and registry keys. This project serves purely for educational purposes and to enhance cybersecurity awareness, demonstrating how such malicious software can evade detection.

Ferrox is a research-focused Windows stealer written in Rust, designed to harvest sensitive data including browser credentials, cryptocurrency wallet information, and messaging app sessions while employing various evasion techniques to bypass antivirus and endpoint detection systems. Its notable features include polymorphic builds, compile-time encryption of strings, direct syscall execution, anti-analysis measures, and the ability to exfiltrate stolen data via Discord or Telegram within a stealthy execution environment. The tool is intended strictly for educational purposes in understanding modern attack methodologies for enhancing cybersecurity defenses.

File Scraper is a tool designed for extracting sensitive information from files using custom regular expressions, and it generates an interactive HTML report based on the findings. Its primary use case is in security assessments and data validation, where users can employ their regex expertise to customize the search patterns for various types of sensitive data, such as authentication tokens and credentials. Notable features include the ability to style the generated reports and collect specific data formats like Base64 and PEM, enhancing the tool's versatility for educational and practical cybersecurity applications.

IconJector is a Windows Explorer DLL injection tool that uses the change icon dialog to trick users into loading a malicious DLL into the explorer process. The tool allows for both user-driven DLL loading disguised as an icon and programmatic DLL injection into the explorer, leveraging the properties of DLLs and their optional DllMain functions to execute arbitrary code within the explorer's memory. Key features include the ability to create an icon representation of a DLL and various injection techniques, providing significant potential for exploitation.

Injectum is a modern, type-safe Rust library designed for process injection tailored for Red Teams and Offensive Security operations. Its primary use case is to provide a structured framework for executing various injection strategies while managing memory safety and minimizing artifacts to evade detection by Endpoint Detection and Response (EDR) systems. Notable features include a modular architecture that allows dynamic swapping of injection techniques, a fluent Builder API for compile-time error detection, and robust payload management to enhance operational security.

KittyLoader is an advanced evasive loader developed in C and Assembly, primarily designed for educational purposes in the realm of defensive cybersecurity. Its capabilities include early execution hijacking, module hiding through unlinking from various lists, and a range of sophisticated anti-analysis techniques like multilayer scoring and jittered operational delays to evade detection. Additionally, it employs encryption for embedded payloads using high-entropy randomness, allowing for stealthy API resolution and library loading, which significantly enhances its evasion tactics against static and dynamic analyses.

SecuSploitX is an advanced, modular, open-source penetration testing and cybersecurity toolkit designed for offensive security operations. It features a comprehensive suite of tools including web and network security modules, AI-driven automation for tasks like phishing simulations, and both GUI and CLI interfaces for user flexibility across multiple platforms. Notable capabilities include automated vulnerability scanning, advanced brute force tactics, and extensive documentation, making it suitable for both educational and professional use.

Stealth Keylogger is a discreet Windows keylogger that utilizes low-level keyboard hooks to capture all keystrokes across the system, including special characters and unicode, while tracking the active window. Its notable features include a thread-safe buffer, immediate data flush upon right-click or enter, mechanisms for evading detection such as indirect syscalls and API hashing, and configurable logging to a file or transmission to a command and control server. The tool is designed for educational and authorized security research purposes.

SuperLibrary is an educational repository designed to provide access to a collection of books and courses aimed at individuals who may face financial constraints in obtaining these learning resources. It emphasizes ethical usage, urging users to support authors and publishers whenever possible, while also featuring a disclaimer regarding copyright and legal responsibilities. Notable features include categorized content such as books and courses, fostering self-education in various subjects.

SyscallInjector is a stealthy DLL injector designed to execute direct syscalls on Windows, effectively bypassing endpoint detection and antivirus hooks. Its notable features include dynamic resolution of System Service Numbers, manual PE mapping, and the use of RWX memory allocation to circumvent commonly hooked functions. Additionally, it incorporates a mechanism to wipe shellcode after execution to further evade detection.

TibaneC2 is a modular Command & Control (C2) framework designed for offensive security research and red teaming, featuring a C/C++ core server, a PHP-based web panel, and a CLI console. Its notable characteristics include cross-platform implants, multi-language stagers, and scripting tools for enhanced automation and emulation, facilitating extensive customization without altering core functionality. The framework is intended strictly for educational and authorized testing purposes.

The "Awesome Black Hat Arsenal" repository is a curated collection of advanced cybersecurity tools presented at Black Hat Arsenal events, aimed at practitioners in red teaming, blue teaming, application security, and OSINT. It organizes tools by geographical location, year, and category, providing detailed descriptions, authorship, and GitHub links for each tool, facilitating easy access to cutting-edge security utilities. This resource serves as an invaluable reference for security professionals seeking to enhance their toolkit with the latest innovations in the field.

DFMI (Don't Fool My Installer) is a toolkit designed for fileless code execution and covert payload delivery via Windows Installer (.msi) files, exploiting the CustomAction mechanism to execute arbitrary payloads silently during installation. Notable features include the ability to inject backdoors into both signed and unsigned MSI packages without altering their signatures, support for cross-platform payload generation, and functionalities for SSL encryption and IPv6. This tool is intended for authorized red team engagements and penetration testing only.

Impacket-IoCs is a reference repository providing indicators of compromise (IoCs) for detecting activities driven by the Impacket toolkit, aimed at both blue and red team professionals. It features 73 detailed IoCs categorized by protocols such as Kerberos, SMB, NTLM, and LDAP, focusing on deeper, protocol-level signals rather than surface-level artifacts. The project serves to enhance the operational security of offensive tools and improve defensive strategies by offering practical detection methodologies for smaller teams without access to commercial solutions.

Malware APK is a testing and exploitation tool designed for security engineers and bug hunters to create malicious Proof of Concept (PoC) applications for vulnerability testing in Android environments. Notable features include a variety of testing modules for intent injection, task hijacking, and accessibility monitoring, without requiring device rooting. It also supports advanced options like caching intercepted intents and compiling native code for arbitrary code execution, making it a comprehensive utility for penetration testing.

The Malware Analysis repository serves as a comprehensive resource for the technical dissection of various malware strains, aimed at security professionals and researchers. It features in-depth analysis articles on notable malware such as AsyncRAT and SamSam Ransomware, as well as a collection of tools like Flare-VM, which is a pre-configured Windows-based virtual machine tailored for reverse engineering and malware analysis.

Red-Team-Rust is an educational repository that provides a comprehensive collection of notes and resources focused on using the Rust programming language for offensive security. It covers fundamental Rust concepts, programming patterns, and specific applications in red teaming and malware development, emphasizing the advantages of Rust's memory safety and evasion properties. Aimed at security researchers and developers, the project facilitates a thorough understanding of Rust for creating robust red team tools.

RVBBIT Arsenal is a dual-purpose cybersecurity tool designed for educational purposes in Linux rootkit warfare, encompassing both offensive and defensive capabilities. It includes Project RVBBIT, a kernel rootkit integrated with a miner and a network worm for attack simulations, and RvbbitSafe, a defensive framework that detects and eliminates RVBBIT threats. This repository serves as a comprehensive resource for understanding both the techniques of rootkit deployment and the corresponding countermeasures.

i-Detector is an educational tool designed for simulating Instagram login and two-factor authentication (2FA) mechanisms, aimed at ethical hacking and cybersecurity training. It includes a simple fake login page that collects user credentials via a data management script, which runs on various platforms including Windows, Linux, and Android. The tool is intended for practical learning experiences in social engineering techniques and is continuously updated with features in its main project repository.

TeleStrike is a red team utility for simulating penetration tests and conducting security audits on Telegram accounts, designed solely for authorized assessments and educational purposes. Its notable features include two-factor authentication enumeration, session hijacking simulations, automated social engineering flows, and customizable modules for various attack vectors. The toolkit serves to evaluate the resilience of Telegram's authentication mechanisms against real-world attack scenarios.

WindowsShell-Injector is a shellcode execution framework designed for security research and penetration testing on Windows systems. It features encrypted payloads, anti-debugging mechanisms, and an intuitive Qt-based GUI, allowing for seamless loading and execution of shellcode. Notable capabilities include asynchronous execution via separate threads, dynamic memory protection, and runtime API resolution to enhance evasion of static analysis tools.

x64dbg is an open-source binary debugger designed specifically for Windows, facilitating malware analysis and reverse engineering of executables without source code access. Key features include a comprehensive plugin system for extensibility, support for both 32-bit and 64-bit debugging, and a user-friendly interface that offers various tools such as memory mapping and graph visualization to enhance the debugging process.

XMT (eXtensible Malware Toolkit) is a versatile command and control (C2) framework written in Golang, designed for malware analysis and control functions, including data exfiltration. It features advanced process control for Windows, efficient networking resources, and compatibility with older Windows systems, while maintaining a minimal file size of approximately 5MB. Additionally, XMT supports various utility functionalities and aims for continuous enhancements, making it suitable for researchers and security professionals exploring cybersecurity threats.

ADMmutate is a polymorphic shellcode mutation engine designed to evade Network Intrusion Detection Systems (NIDS) by generating unique but functionally equivalent code fragments that resist signature-based detection. Its notable features include XOR-based polymorphic encoding, sliding key mechanisms, and multiple code paths, enhancing its ability to obfuscate shellcode in various architectures such as IA32, SPARC, and MIPS. The tool specifically targets signature analysis weaknesses in NIDS, employing advanced techniques to adapt and randomize its output dynamically.

Antivirus Engines is a comprehensive exploration of antivirus engine technologies, focusing on their development to combat the evolving cyber threat landscape. It provides in-depth technical insights into various detection methodologies, including signature-based, heuristic, and behavioral approaches, complemented by algorithmic implementations of notable techniques such as the Aho-Corasick algorithm and Bloom filters. The resource serves as both a reference for advanced malware analysis and a practical guide for implementing cutting-edge antivirus technologies.

DEDSEC_CLICKFIX2 is a Linux-based social engineering tool that employs the ClickFix attack to deploy malware through a deceptive software activation interface. It features customizable malicious payload links, a realistic URL masking system, and integrated tunneling for remote access, while also attempting to disable security measures to ensure stealthy execution of its payload. The tool is designed for penetration testing and educational purposes, leveraging user trust to facilitate the delivery of malicious software effectively.

pyFUD is a cross-platform, fully undetectable (FUD) remote access tool (RAT) designed for multi-client handling, allowing persistent shell access and additional functionality such as file upload and download capabilities. The tool supports both Windows and Linux, with features including auto-reconnect and client executable conversion using PyInstaller, aimed primarily at educational use. Users are cautioned against uploading payloads to VirusTotal to maintain its effectiveness.

PDB2JSON is an Azure Functions-based application designed for secure authentication of running memory in Windows systems through its extensive SHA256 hash database. The tool provides a JSON-based interface for remote interactions with a Code+PDB analysis server, enabling functionalities like symbol resolution and hash verification without uploading binary data. Its notable features include a just-in-time hashing methodology for integrity protection and automation support for memory dump analysis through various scripting examples.

ForceAdmin is a malicious tool designed to create an infinite loop of User Account Control (UAC) prompts, compelling users to grant administrative privileges by overwhelming them with requests. It provides various script templates in formats such as batch, PowerShell, AutoHotkey, AutoIt, HTA, and VBScript, facilitating execution via PowerShell and bypassing antivirus protections. Notable features include no dependencies, dual architecture support for x86 and x64 systems, and a fileless execution method.

RE_Mal_Exploit_Tutorials serves as a comprehensive resource hub focused on reverse engineering, malware analysis, and exploit development. It aggregates various tutorials, guides, and tools, facilitating knowledge acquisition for security professionals and enthusiasts interested in understanding and mitigating software vulnerabilities. Noteworthy features include curated links to both beginner and advanced learning materials across multiple platforms, encompassing both theoretical and practical aspects of cybersecurity topics.

This repository provides a proof-of-concept for a Windows local privilege escalation exploit that combines a User Account Control (UAC) bypass with token duplication to elevate a process to SYSTEM-level privileges. It serves primarily for educational purposes, demonstrating key concepts of Windows security, such as token mechanics and process elevation, while employing techniques like registry manipulation and access token duplication to illustrate vulnerabilities in privilege management. Notably, the tool employs specific Windows APIs for process creation and token handling, highlighting potential attack vectors in a controlled environment.

AiGPT is an automated exploitation framework designed for rapidly discovering and compromising vulnerable WordPress sites, leveraging a multi-vector engine to exploit thirteen unauthenticated CVEs. Key features include intelligent plugin fingerprinting, the ability to create unauthorized WordPress admin accounts, direct access through SQL injection, and a multi-threaded scanning capability for efficiency across networks. This tool is intended for authorized penetration testing and security research purposes.

AKILT is an open-source botnet framework designed for security enthusiasts and malware analysts to facilitate the study of botnet operations. Written in Go, it supports both client and server functionalities with advanced features such as screen capture, remote command execution, DDOS attacks, and a keylogger, while aiming to remain undetectable. The tool provides a valuable resource for understanding the implementation and behavior of botnets in a controlled environment.

PwnLand is an open-source resource designed for security researchers and CTF participants, focusing on binary exploitation techniques. It provides an extensive collection of practical examples, tutorials, and research materials on various vulnerabilities, including buffer overflows, format string vulnerabilities, heap exploitation, and kernel exploits. Notable features include structured directories for different exploitation methods, debugging guides, and challenges for hands-on practice.

GEF (GDB Enhanced Features) is a powerful tool designed to enhance the functionality of GDB (GNU Debugger) for exploit development and reverse engineering across multiple architectures such as x86/64, ARM, and MIPS. Notable features include architecture agnosticism, a single installation script, full Python 3 support, and a variety of commands that optimize the debugging experience while facilitating dynamic analysis. The tool is designed to reduce cognitive load on developers by offering a more intuitive interface and extensive community contributions.

The "Malware" repository offers a collection of malware samples and resources for cybersecurity professionals. Its primary use case is to facilitate testing and analysis of malware, including the ability to download various samples using proxy tools like proxychains. Notable features include the inclusion of the EICAR test file for antivirus testing and the ability to aggregate IP addresses from logs for streamlined malware acquisition.

OnlyShell is a Go-based reverse shell handler designed for penetration testers and security researchers, enabling the management of multiple reverse shell connections concurrently. Key features include automatic shell type detection, background shell management, command broadcasting across active shells, and the option for encrypted communications with TLS support. The tool offers an intuitive command-line interface and allows for real-time interaction and status monitoring of all connected sessions.

WordPress Malware is a collection of malware samples sourced from compromised WordPress websites, organized by the date they were discovered. The repository includes custom PHP functions commonly used for malicious actions, such as file modification and execution of PHP code. This tool serves as a resource for developing malware detection solutions and is utilized by associated cPanel plugins for scanning and mitigating malware threats.

Zenith-Basic-RAT is a remote access tool (RAT) that operates through Discord, facilitating a range of post-exploitation actions with over 20 modules including system information retrieval, file management, and user monitoring. It is designed for educational purposes and features customizable executable names and session management to enhance stealth and functionality. Notable capabilities include password extraction, screen blocking, and the ability to execute commands remotely on the victim's machine.

Cryptolocker is an open-source encryption tool developed in Visual C++ that employs a robust 256-bit AES encryption algorithm to secure files, rendering them unreadable without a password. Its primary use case involves encrypting files across system drives while providing features such as a multi-threaded encryption process for efficiency, lockdown functionality to restrict system access, and a web admin interface for management. This tool is intended solely for educational purposes and emphasizes user responsibility regarding legal usage.

The Cyber Threat Intelligence tool provides comprehensive analysis of ongoing activities and research by advanced persistent threat (APT) actors, leveraging broad monitoring of exploit markets, social media, and vulnerability discussions. Its key features include geopolitical analysis, a wide array of indicators such as IOCs and TTPs, and predictive capabilities powered by an AI-based system to forecast potential attacks. This enables organizations to proactively prepare for and mitigate cybersecurity threats.

Darknet-mcp-server is a comprehensive tool designed for aggregating dark web and threat intelligence specifically for AI agents. It consolidates data from multiple sources, including HIBP, ThreatFox, ransomware tracking, and blockchain intelligence, into a unified server that allows for on-demand access to a wide array of threat data. Notable features include support for .onion access, malware analysis capabilities, and an array of tools and data sources to streamline dark web intelligence gathering and analysis.

Erebos-Zero is a personal arsenal for malware development featuring sophisticated techniques for evasion and injection. It includes a variety of exploitation methods such as shellcode injection, DLL injection, and process manipulation, along with advanced anti-forensics and evasion techniques tailored for bypassing endpoint detection and response systems. This tool is primarily intended for research and educational purposes, focusing on the creation and deployment of stealthy malicious payloads.

Hell's Hollow is a rootkit technique specifically designed for Windows 11 that enables effective SSDT hooking by exploiting an undocumented Alternate Syscall handler mechanism. This tool allows users to manipulate system calls at the kernel level, enabling alteration of return values and system call arguments while bypassing existing defense mechanisms like HVCI. Notable features include its compatibility with Rust for driver development and the ability to hook and modify any specified system service number (SSN), making it a versatile tool for advanced kernel manipulation techniques.

The "PoC in GitHub" repository offers proof-of-concept (PoC) exploits for multiple Common Vulnerabilities and Exposures (CVEs) identified in various software components, highlighting potential local and remote privilege escalation vulnerabilities. Each listed CVE includes a brief description of the vulnerability's nature, links to associated exploits, and demonstrates the ease of exploitation without requiring user interaction. This repository serves as a resource for security researchers and developers to understand vulnerabilities and test their systems against known exploits.

Red Devils Rat Premium is an advanced remote administration tool (RAT) designed for comprehensive device management and surveillance. Its primary use case is to facilitate remote access and control over Android devices, offering features such as call and SMS monitoring, live screen streaming, location tracking, and remote control functionalities. Notable features include an admin panel for easy management, an APK crypter for secure app distribution, and the ability to execute commands remotely, providing a robust solution for unauthorized monitoring.

Async Rust RAT is an open-source Remote Administration Tool (RAT) designed for Windows, developed in Rust primarily for legitimate system administration, research, and educational purposes. Notable features include system information retrieval, remote desktop capabilities, webcam capture, file management, and various control functionalities such as shutdown and restart, along with a client builder for customization. The tool emphasizes responsible use, necessitating explicit permission for system management tasks.

Cheshire is a Go plugin for the Adaptix C2 service that enables pre-flight payload quality assurance by integrating with the LitterBox analysis framework. It allows operators to upload binaries, conduct static and dynamic analysis, and receive detailed EDR alerts directly from the Adaptix UI without additional navigation. Notable features include real-time progress streaming during analysis, extensive reporting on security findings, and a configurable interface for seamless user interaction.

GhostLNK is an advanced Windows LNK generator designed for red team operations and security research, focusing on reducing detection through sophisticated evasion techniques. It features capabilities such as multi-stage payload execution, stealth icon smuggling, various execution modes (including memory execution), and anti-sandbox checks, all aimed at creating more covert attack vectors. The tool is intended for authorized security testing only and emphasizes flexibility in payload generation while minimizing forensic traces.

GhostLock is a research tool designed to demonstrate the potential for ransomware-equivalent availability impacts on SMB shares by utilizing file-level and directory-level locking techniques without writing or encrypting data. It enables low-privileged Windows domain users to effectively lock files or entire directories, rendering them operationally invisible while maintaining read access at known paths, thus bypassing traditional security measures with no detectable writes or anomalies. Notable features include a 32-thread parallel scanner for file locking and a single handle directory lock method, making it a significant concern for SMB-based environments.

Goodboy Framework is a comprehensive 15-stage course designed for developing and analyzing Windows malware, leveraging the Rust programming language. It equips users with practical knowledge from both offensive and defensive cybersecurity perspectives, encompassing techniques such as API hashing, process injection, and anti-debugging, while providing empirical data on evasion effectiveness against multiple antivirus engines. The framework emphasizes hands-on learning, featuring real-world detection mechanisms and adversarial thinking strategies, ensuring all content is validated through rigorous testing.

hARMless is an ELF Packer/Loader designed for ARM64 and x86-64 Linux binaries, utilizing multi-layer encryption techniques for secure execution. Its primary use case is to facilitate stealthy operation by preventing the original binary from being written to disk and employing runtime in-memory execution, alongside features such as code obfuscation, CRC32 integrity checks, and polymorphic loading to enhance anti-analysis measures.

HVNC is a standalone client-server tool designed to create a hidden virtual desktop on the operator's side, allowing remote control over a target machine akin to the HVNC module of the TinyNuke banking trojan. Notable features include customizable process launching via a command menu, browser launchers for multiple web browsers, and a hidden client console. It serves primarily for educational and research purposes regarding remote access techniques.

Payload Obfuscator is an advanced browser-based tool designed for Red Team operations, enabling users to obfuscate payloads in multiple programming languages, including PowerShell, Python, Bash, C#, and Go. Key features include a fully client-side operation with no data transmission, the ability to combine up to eight modular obfuscation layers for enhanced evasion tactics, and context-aware parsing for maintaining code syntax integrity. The tool prioritizes security, providing real-time analysis for detection probability and ensuring it remains completely free and open-source.

PH4NTØM ROOTKIT is a Windows usermode rootkit designed for educational research, featuring techniques for stealth, privilege escalation, and command-and-control (C2) infrastructure. Notable features include token stealing and named pipe impersonation for privilege escalation, inline hooking for process and file hiding, and a comprehensive C2 setup allowing for real-time keylogging and remote execution commands. It emphasizes defensive learning while providing extensive evasion mechanisms against analysis and detection.

PingRAT is a command and control (C2) tool that utilizes ICMP payloads to stealthily transmit C2 traffic through firewalls, making it largely undetectable by most antivirus and endpoint detection and response solutions. It is implemented in Go and offers features such as server-client architecture for communication, allowing for flexible network interface configuration. This tool is primarily aimed at facilitating covert operations in environments with strict traffic monitoring.

Takopii is a production-grade banker malware architecture designed for Android, featuring four APK specimens that encapsulate techniques from 17 real-world malware families. Its primary use case is to facilitate the study of malware detection and defense strategies, offering Kotlin source code alongside comprehensive YARA and Sigma detection rules. Notably, all specimens demonstrate zero detection across 66 VirusTotal engines, showcasing advanced evasion capabilities within a structured kill chain framework.

wmiexec2 is an enhanced and obfuscated version of the original `wmiexec`, designed for red team operations by facilitating stealthy remote command execution on Windows systems. Key features include support for various shell types, automated red team modules, local and remote file transfers, and capabilities for bypassing antivirus detection. The tool also includes additional functionalities like system information gathering, active token enumeration, and VM detection, making it a comprehensive suite for Windows penetration testing and cyber operations.

Zero-loader is a polymorphic x64 shellcode loader designed to evade detection by generating unique binaries with every build, thus ensuring no static signatures are shared across compilations. Its primary use case is for authorized security testing and research, featuring advanced evasion techniques such as indirect syscalls, patchless AMSI/ETW bypass, module stomping, and anti-emulation measures. By employing methods like XOR encryption and synthetic function tables, the tool maintains a low profile during execution, effectively avoiding modern detection systems.

Donut-CustomHost is a sophisticated tool designed to generate and execute shellcode while maintaining stealth against modern endpoint detection and response (EDR) solutions. Key features include a custom CLR host that intercepts assembly loading directly from memory, advanced memory tracking evasion techniques, and architecture-aware event tracing for Windows (ETW) bypassing, all of which are aimed at minimizing detection during execution. Additionally, the tool has optimized the shellcode size, ensuring efficient memory use and a reduced footprint.

KHAØS LOADER is a multi-stage Windows x64 loader that utilizes AES-256-CBC to decrypt and inject donut shellcode into a `rundll32.exe` process spawned under `explorer.exe`, employing advanced evasion techniques such as indirect syscalls with call stack spoofing. Notable features include early-bird APC injection, unhooking capabilities, and robust sandbox evasion mechanisms, which ensure stealthy operation against various security measures. This tool is designed for authorized use only and integrates multiple sophisticated methods to remain undetected during execution.

Lain C2 is a command-and-control framework designed to facilitate secure communication between compromised hosts and operators across multiple platforms including Windows, Linux, macOS, and Android. It supports various communication protocols such as HTTP/1, 2, and 3, and integrates third-party libraries for enhanced functionality, making it a versatile tool for conducting remote management and operations. Notable features include cross-platform compatibility and efficient handling of system metrics and processes.

Maldev is a comprehensive Go library designed for malware engineering, providing tools for syscall manipulation, evasion techniques, code injection, credential harvesting, and persistence mechanisms. Its capabilities include a variety of syscall calling methods, extensive evasion techniques against detection mechanisms, and robust injection methods, all integrated through a unified syscall caller for enhanced stealth and flexibility. The library is aimed at authorized security research, red teaming, and penetration testing, ensuring a modular approach to malware development with an emphasis on cross-compilation without CGO dependencies.

The Red-Team-Exercises repository serves as a compilation of educational posts focusing on various red team tactics and techniques. This resource is primarily designed for cybersecurity professionals seeking to enhance their skills in areas such as shellcode execution, evasion techniques, and phishing campaigns. Notable features include detailed descriptions of each exercise, covering advanced topics like AMSI bypass, process injection, and Active Directory enumeration.

C-Full-Offensive-Course is a bilingual educational resource designed to guide users through a comprehensive C programming curriculum focused on offensive security practices across Windows, Linux, and macOS platforms. The course comprises 216 progressive units with hands-on coding exercises, alongside a centralized codebase to facilitate learning. It emphasizes ethical usage by instructing users to conduct security labs only within authorized and isolated environments.

CloudGuard Security is a browser-based demonstration tool that exploits the File System Access API to simulate file encryption and delivery attacks without requiring software installation. It operates in two modes: the 'lock' mode, which encrypts files using AES-256-GCM and displays a countdown alert, and the 'drop' mode, which silently writes a specified payload to the user's file system. The tool emphasizes social engineering techniques for permission granting, making it a practical resource for red-team exercises.

mkPIVM is a polymorphic, position-independent shellcode virtualizer designed for Windows x86 and x64, which enables the obfuscation of raw shellcode by converting it into a virtual machine that interprets encrypted instructions. Its primary use case is enhancing the stealth of shellcode to evade signature-based detection, leveraging features such as customizable cipher families, opcode permutations, and detailed control over the virtual machine's configuration. The tool supports various operational modes, including full lifting, packing, and hybrid approaches, making it versatile for evasion techniques in offensive cybersecurity applications.

NocturneLdr is a research-oriented Windows x64 shellcode loader designed to produce clean, fully backed call stacks that evade detection by modern EDR solutions and forensic analysis tools. By injecting code into a legitimate module's `.text` section and utilizing genuine unwind metadata, it maintains call stack integrity while eliminating C runtime dependencies. Notable features include compile-time API hash resolution to obscure function names and IAT camouflage with benign imports, enhancing stealth against static analysis.

OffsetInspect is a PowerShell toolkit designed for byte-offset inspection, source correlation, binary comparison, and defensive detection-boundary analysis. It enables analysts to identify specific content at given byte offsets and the surrounding context, while also facilitating detection workflows inspired by ThreatCheck and offering a suite of red-team analysis and triage capabilities. Notable features include efficient file handling, contextual mapping, multi-region detection, and an in-memory approach to avoid interference with endpoint protection mechanisms.

PolyEngine is an evasive PE packer designed for research purposes, particularly in CTF challenges and low-level Windows security education. It employs advanced techniques such as in-memory execution, obfuscation, and various evasion options (like process name spoofing and API- hammering) to bypass EDR and AV detection mechanisms. This tool is intended for authorized security testing and educational use only, with comprehensive features for embedding payloads and managing execution context.

XeraLdr is an advanced Windows loader engineered for executing payloads stealthily while evading modern Endpoint Detection and Response (EDR) systems, specifically tested against Microsoft Defender for Endpoint with no alerts triggered. Key features include techniques such as module stomping, IAT camouflage, and advanced anti-analysis measures, which significantly enhance its stealth capabilities and reduce detection risks. This tool is designed primarily for educational and research purposes, enabling users to understand sophisticated evasion tactics used in malware payload delivery.

The ETW-Bypass-Rust tool provides a method for bypassing the Event Tracing for Windows (ETW) framework, primarily aimed at evading Endpoint Detection and Response (EDR) systems. It modifies the `NtTraceEvent` function in `ntdll.dll` to prevent logging of actions that may trigger security alerts, utilizing dynamic function address resolution. This tool serves as an educational resource for cybersecurity professionals to understand and develop defensive strategies against potential detection mechanisms.

Hydrangea-C2 Payloads is a command and control (C2) payload generator designed for creating and managing agents within a client-server communication framework. Its primary use case lies in facilitating the control of remote agents for task execution, file manipulation, and process management, with capabilities for advanced operations like DLL injection and keylogging. Notable features include a versatile command interface for both Windows and Linux systems, as well as support for various agent commands encapsulated in a structured communication protocol.

Rust-Hells-Gate is a proof-of-concept tool designed for evading Endpoint Detection and Response (EDR) systems through the use of direct syscalls in Rust. It specifically implements the Hell's Gate technique, allowing users to bypass EDR hooks by accessing the Process Environment Block (PEB) to resolve function pointers from ntdll.dll, thereby minimizing detection by common security measures. Notable features include its lightweight implementation approach and the potential for extension into a fully functional malware loader.

Sexettintool is a multifaceted cybersecurity tool designed for educational and ethical hacking purposes, enabling users to execute various automated exploits and security assessments. Key features include exploit scanning with Searchsploit, firewall detection via wafw00f, brute force automation with ncrack, and vulnerability analysis using nikto and lynis, among others. The tool is structured to enhance cybersecurity awareness while retaining a focus on responsible usage, with comprehensive support for Linux users and potential Docker deployment.

ShotDroid v2 is a penetration testing tool designed for Android devices that features file retrieval from device storage, an integrated keylogger with reverse shell capabilities, and the ability to capture images from the device's front camera. Notable functionalities include the option to conceal apps in the file manager, customization of directories and HTML templates for webcam captures, and a focus on educational use within legal boundaries.

Maliketh is a multi-user, customizable command and control (C2) framework designed to be flexible for operators. It features cross-platform support through its initial C++ and Golang implants, allowing for behavior modification based on server configurations, file operations, command execution, and self-destruct capabilities, among others. Notable functionalities include basic anti-debugging measures and a range of file management operations, making it suitable for diverse operational scenarios.

Ixve/Red-Team-Tools is a comprehensive collection of cracked red teaming tools designed for penetration testing and security assessments, including C2 frameworks, exploitation toolkits, and web application security tools. Users are strongly advised to run these tools in a virtual machine environment due to potential malware risks. Notable features include a wide variety of tools for both Windows and Linux platforms, along with recommended online sandboxing solutions for safe testing.

WiFi Password Stealer is a cybersecurity tool designed to extract WiFi credentials from target computers using keystroke injection techniques via a USB device, specifically leveraging a Raspberry Pi Pico configured as a Rubber Ducky. The tool facilitates information exfiltration through customized payloads, allowing stolen data to be sent over email or stored on a USB drive. It demonstrates advanced attack vectors, including both Rubber Ducky and Bash Bunny methods, while emphasizing the importance of physical access to the target system.

EgnakeRAT is an advanced remote administration tool (RAT) designed for authorized penetration testing and red team operations on Android devices. It features a fully asynchronous command and control (C2) server utilizing AES-256-CBC encryption for secure communications, along with a real-time web dashboard for device management and various tactical modules such as remote shell access and keylogging. Its use of a length-prefixed JSON protocol and automatic reconnection handling enhances its performance and user experience, making it a robust solution for security researchers.

The "Awesome Hacking with AI" repository is a comprehensive resource that explores the integration of Artificial Intelligence in offensive security practices, such as penetration testing and red teaming. It features a curated collection of AI-driven tools, methodologies, and case studies while emphasizing ethical considerations in their application. Notable features include a learning roadmap, prompt libraries for various tasks (e.g., payload generation and OSINT profiling), and advanced tactics like AI-powered malware development and botnet exploitation.

Kumo is an OSINT and security reconnaissance framework that enables the analysis of a target domain via a single command, leveraging 26 parallel modules to deliver comprehensive results in real-time. Key features include extensive checks on DNS records, email security, open ports, leaked credentials, and malware associations, as well as a user-friendly web interface and fast scanning options. This tool is ideal for security professionals conducting thorough assessments of domain-related vulnerabilities and exposures without the need for API keys.

Alien is a modular webshell client designed for cybersecurity research and education, providing a flexible post-exploitation framework that integrates with various web technologies through reusable modules. Key features include arbitrary code execution, a file manager, database interaction, SOCKS5 proxying, HTTP traffic obfuscation, and the ability to pivot through webshells for enhanced communication security. The architecture enables advanced capabilities while keeping the core webshell lightweight, making it suitable for authorized penetration testing scenarios.

The R3LI4NT/articulos repository serves as a comprehensive resource for cybersecurity and hacking-related articles, focusing on topics such as vulnerability exploitation, security techniques, and network auditing. Notable features include detailed guides on various pentesting methodologies, firewall configurations for GNU/Linux, and resources on social engineering attacks, providing practical insights and tools for both novice and experienced security professionals. Users can access the content through an integrated blog link for easier navigation and learning.

Digital Forensics Tools is a comprehensive repository that curates essential utilities for digital investigations, including tools for disk forensics, memory analysis, malware detection, and network monitoring. Key features include disk imaging, file recovery, and memory acquisition tools, alongside advanced utilities like Volatility for memory analysis and Autopsy for user-friendly disk examination. This toolkit serves as a valuable resource for cybersecurity professionals conducting forensic investigations and data recovery tasks.

The cvemapping tool aggregates CVE exploit data from GitHub, allowing users to clone repositories or export CVE information in JSON format for web use. It features options for pagination and year-specific searches, making it versatile for both developers and security researchers aiming to analyze or present CVE-related data efficiently. Notable features include the ability to authenticate using a GitHub token and the straightforward export functionality for integration with web applications.

Information Security Tasks is a collaborative repository that serves as a comprehensive resource for cybersecurity professionals, offering real-world infosec notes and methodologies. It features extensive directories covering offensive and defensive security topics such as penetration testing, incident response, and vulnerability analysis, alongside daily auto-updates of news and tools. Notable elements include an organized structure for various cybersecurity domains, community submission options for resources, and insights into emerging threats like AI and cloud security.

ADB WebKit is a browser-based tool designed for managing Android devices via ADB (Android Debug Bridge) with an intuitive user interface. Its primary use case includes functionalities like application management (installing, uninstalling, granting permissions), shell access, screen capture, and device control commands, making it a comprehensive solution for developers and testers. Notable features include support for live application management, real-time screen interactions, and various device control options, all accessible through a USB connection or IP address.

C2 Tracker is a community-driven IOC feed that aggregates IP addresses related to known malware, botnets, and command-and-control (C2) infrastructures by leveraging searches from platforms like Shodan. Its primary use case is to facilitate threat intelligence by providing a regularly updated feed that can be ingested by various SIEM and EDR systems, enhancing detection and investigation capabilities. Notable features include version-controlled historical data, weekly updates, and compatibility with tools like OpenCTI and FortinetSIEM for streamlined integration and alerting.

DDisasm is a high-performance disassembler that accurately translates binaries from ELF and PE formats into a reassemblable assembly code representation using the GTIRB intermediate format. Utilizing the Datalog declarative logic programming language, it derives code locations, symbolization, and function boundaries, supporting multiple instruction set architectures including x86, ARM, and MIPS. Notable features include Docker support for easy setup and integration with GTIRB for further binary analysis and manipulation.

The DEFCON 31 Syscalls Workshop repository provides educational materials focusing on direct and indirect syscalls within Windows operating systems, particularly aimed at enhancing understanding of Win32 and Native APIs for Red Team activities. It includes theoretical content, practical exercises, and proof of concepts (POCs) to facilitate learning about syscall mechanisms and their implications in EDR evasion. Notable features include an emphasis on manual techniques over complex automation, offering foundational insights into call stacks and shellcode execution dynamics.

DllShimmer is a tool designed to facilitate DLL hijacking by allowing users to backdoor any function in a DLL without disrupting the normal operation of the host program. It generates proxy DLLs through a boilerplate C++ file and a corresponding .def file, ensuring that all exported functions maintain their original names and ordinal numbers, thus avoiding detection. Key features include support for both dynamic and static linking, the option to prevent multiple executions of the backdoor, and comprehensive debug logging capabilities.

flare-emu is an advanced emulation tool that integrates with binary analysis frameworks such as IDA Pro or Radare2, leveraging the Unicorn emulation framework to facilitate flexible and efficient code analysis. It offers multiple interfaces for emulating instruction ranges, iterating through function paths, and handling complex emulation scenarios, making it suitable for deep analysis of executable binaries across various architectures including x86, ARM, and their 64-bit counterparts. Notably, it provides functionalities for user-defined hooks, direct memory manipulation, and dynamic code discovery, enhancing the analyst’s ability to probe and understand obfuscated or complex binaries.

HaboMalHunter is an automated malware analysis tool specifically designed for Linux ELF files, facilitating both static and dynamic analysis to aid security analysts. It efficiently extracts crucial features such as process behavior, file I/O, and network interactions, generating comprehensive reports on malicious activities. Notable features include detailed static analysis of file dependencies and strings, as well as dynamic tracking of execution timestamps, API calls, and syscall sequences.

Heroinn is a cross-platform command-and-control (C2) and post-exploitation framework developed in Rust, designed primarily for research and educational purposes. Notable features include a graphical user interface (GUI), an interactive PTY shell, system information collection, file management with support for large files and resuming broken transfers, and compatibility with multiple operating systems including Windows, Linux, BSD, and macOS, leveraging various communication protocols such as TCP, HTTP, and reliable UDP.

The Learning Reverse Engineering repository provides a collection of programs aimed at enhancing skills in reverse engineering and malware analysis. It organizes content by specific concepts related to reverse engineering, delivers both source code and compiled binaries, and includes links to supplementary online courses and video playlists. Notable features include guidance on using various tools like Ghidra and IDA Pro, as well as instructions for compiling the source code with Microsoft’s C/C++ compiler.

Legendary OSINT is a comprehensive curated repository of open-source intelligence (OSINT) tools and resources designed to aid users in various investigative scenarios. It encompasses a diverse range of categories, including social media searches, geospatial analysis, malware investigation, and dark web monitoring, facilitating enhanced data collection and analysis for cybersecurity professionals and researchers. Notable features include categorized documentation, contributions from multiple sources, and a focus on responsible usage of third-party tools.

lisa.py is a Model-Context Protocol (MCP) integration for LLDB, enabling AI assistants like Claude to interact with debugging sessions through a structured interface. It consists of a server component to handle communication and a plugin for LLDB that exposes debugging functionalities via JSON-RPC, allowing users to execute commands verbally and enhance the debugging experience with natural language processing. Notable features include the capability to create targets, manage breakpoints, control process execution, and evaluate expressions directly from the AI assistant.

makin is a malware assessment tool designed to simplify the process of identifying anti-debugging techniques employed by malicious samples. It injects a DLL into the target process to monitor specific API calls, providing insights into debugger detection methods, and can generate IDA Pro scripts for setting breakpoints at the identified APIs. Notable features include the ability to hook various functions from ntdll.dll and kernelbase.dll , effectively revealing complex anti-debugging strategies.

o365recon is a PowerShell script designed for retrieving information from Office 365 and Azure AD using valid credentials. Its primary use case is to facilitate information gathering for security assessments, with a notable feature allowing optional Azure querying through a simple command-line interface. The tool requires the installation of MSOnline and AzureAD modules and includes support for multi-factor authentication.

onedrive_user_enum is a tool designed for enumerating valid OneDrive users by leveraging the HTTP response codes from file share URLs. Its primary use case is passive user enumeration, which avoids direct login attempts, making it less detectable by the target organization. Notable features include options for remote logging to MySQL, local SQLite database support, user list truncation, and mechanisms for de-duplication and user list management.

Operative Framework is a digital investigation tool designed for interacting with multiple targets, executing a variety of modules, and managing links with these targets. Its notable features include the ability to export reports in PDF format, support for crafting custom modules, and a RESTful API for integration, all underpinned by a redesigned architecture in Rust for enhanced performance and functionality.

PHP Antimalware Scanner is a PHP-based tool designed to scan projects for malicious code embedded within PHP files. Its primary use case is to detect potential malware through an interactive console interface or in a reporting mode that generates results in HTML or text. Notable features include customizable scanning options for file paths, action prompts upon detection of malware, and compatibility with various PHP configurations.

Quark Engine is a comprehensive tool designed for malware family analysis and vulnerability assessment, particularly in the context of Android malware. Its primary use case involves identifying and reporting on various malware behaviors and signatures, enabling security researchers to assess risks and improve defenses. Notable features include detailed analysis reports, a rule-based scoring system for malware, and compatibility with Python 3.10, making it accessible for developers and cybersecurity professionals.

Spoofy is a Python-based tool designed to evaluate the spoofability of domains by analyzing their SPF and DMARC records. It features authoritative lookups with a known DNS fallback, accurate bulk processing, and a customizable spoof logic derived from real-world testing, enabling users to conduct comprehensive assessments of domain security configurations. Additionally, Spoofy offers DKIM selector enumeration via API as an optional feature, making it a valuable resource for cybersecurity assessments.

The Tata Sky/Play IPTV Script generator is a tool that creates an m3u playlist containing direct streamable files, specifically designed for users with a Tata Sky subscription. It offers both an easy-to-use app and a command-line script for generating the playlist, with features like automatic login credential storage and expiration notifications for the generated playlist. This tool is primarily aimed at facilitating seamless access to subscribed channels through compatible IPTV applications.

Un{i}packer is a platform-independent tool designed for the automatic unpacking of Windows Portable Executable (PE) files that have been packed using various runtime packers, thereby facilitating malware analysis. Utilizing the Unicorn Engine for emulation, it effectively handles multiple well-known packers, including ASPack and UPX, and allows for manual input of addresses for less common packers. This tool is particularly beneficial for analysts seeking to bypass challenges posed by malware obfuscation and streamline the unpacking process without requiring a Windows environment.

WebKiller V2 is a Python-based tool designed for information gathering and CMS detection in web applications. Its primary use case is to aid cybersecurity professionals in identifying vulnerabilities and obtaining crucial data about target websites. Notable features include a user-friendly command-line interface, compatibility with multiple operating systems, and comprehensive installation instructions.

ffffffff0x 团队维护的安全知识框架,内容包括不仅限于 web安全、工控安全、取证、应急、蓝队设施部署、后渗透、Linux安全、各类靶机writup

Everything for pentest. | 用于渗透测试的 payload 和 bypass 字典.

ADB-Toolkit V2 for easy ADB tricks with many perks in all one. ENJOY!

A security scanner for your LLM agentic workflows

Albanian Hacking Tool!! Tools to help you with ethical hacking, Social media hack, phone info, Gmail attack, phone number attack, user discovery, Anonymous-sms, Webcam Hack • Powerful DDOS attack tool!! Operating System Requirements works on any of the following operating systems: • Android • Linux • Unix

A Virtual Machine For Assessing Android applications, Reverse Engineering and Malware Analysis

A Simple android remote administration tool using sockets. It uses java on the client side and python on the server side

AndroRAT | Remote Administrator Tool for Android OS Hacking

734+ structured cybersecurity skills for AI agents · MITRE ATT&CK mapped · agentskills.io open standard · Works with Claude Code, GitHub Copilot, OpenAI Codex CLI, Cursor, Gemini CLI & 20+ platforms · Penetration testing, DFIR, threat intel, cloud security & more · Apache 2.0

Android Anti-Emulator

A bunch of Windows anti-debugging tricks for x86 and x64.

Script to create templates to use with VirtualBox to make vm detection harder

API Security Project aims to present unique attack & defense methods in API Security field

APKHunt is a comprehensive static code analysis tool for Android apps that is based on the OWASP MASVS framework. Although APKHunt is intended primarily for mobile app developers and security testers, it can be used by anyone to identify and address potential security vulnerabilities in their code.

Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android

一款适用于以HW行动/红队/渗透测试团队为场景的移动端(Android、iOS、WEB、H5、静态网站)信息收集扫描工具，可以帮助渗透测试工程师、攻击队成员、红队成员快速收集到移动端或者静态WEB站点中关键的资产信息并提供基本的信息输出,如：Title、Domain、CDN、指纹信息、状态信息等。

Interesting APT Report Collection And Some Special IOCs

Automated pentest reporting with custom templates, project tracking, customer dashboard and client management tools. Streamline your security workflows effortlessly!

A library for creating, reading and editing PE files and .NET modules.

AutoPentestX – Automated Pentesting & Vulnerability Reporting Tool

A curated list of awesome Android Reverse Engineering training, resources, and tools.

Curated list of links, references, books videos, tutorials (Free or Paid), Exploit, CTFs, Hacking Practices etc. which are related to AWS Security

A curated list of tools officially presented at Black Hat events

A curated list of awesome resources related to executable packing

Awesome hacking is an awesome collection of hacking tools.

A collection of hacking / penetration testing resources to make you better!

Defund the Police.

A curated list of awesome OSCP resources

OSINT tools for Information gathering, Cybersecurity, Reverse searching, bugbounty, trust and safety, red team oprations and more.

RAT And C&C Resources. 250+ Open Source Projects, 1200+ RAT/C&C blog/video.

Red Team Cheatsheet in constant expansion.

🔍 A collection of interesting, funny, and depressing search queries to plug into shodan.io 👩‍💻

A curated list of awesome social engineering resources.

📚 A Curated List of Awesome Telegram OSINT Tools, Sites & Resources

⚡️An awesome list of the best Termux hacking tools

A curated list of awesome YARA rules, tools, and people.

:baby: BabySploit Beginner Pentesting Toolkit/Framework Written in Python :snake:

Binary code static analyser, with IDA integration. Performs value and taint analysis, type reconstruction, use-after-free and double-free detection

Applied offensive security with Rust - https://kerkour.com/black-hat-rust

Tools and Techniques for Blue Team / Incident Response

Generate smart and powerful wordlists

Course content, lab setup instructions and documentation of our very popular Breaking and Pwning Apps and Servers on AWS and Azure hands on training!

A Burp Suite extension that integrates OpenAI's GPT to perform an additional passive scan for discovering highly bespoke vulnerabilities and enables running traffic-based analysis of any type.

An advanced tool for email reconnaissance

Malware Configuration And Payload Extraction

Vagrant VirtualBox environment for conducting an internal network penetration test

CatSniffer is an original multiprotocol and multiband board for sniffing, communicating, and attacking IoT (Internet of Things) devices using the latest radio IoT protocols. It is a highly portable USB stick that integrates TI CC1352, Semtech SX1262, and an RP2040 for V3 or a Microchip SAMD21E17 for V2

Community edition nuclei templates, a simple tool that allows you to organize all the Nuclei templates offered by the community in one place

An open-source tool for auditing your software supply chain stack for security compliance based on a new CIS Software Supply Chain benchmark.

A default credential scanner.

:fire: CHAOS is a free and open-source Remote Administration Tool that allow generate binaries to control remote operating systems.

Chimera is a PowerShell obfuscation script designed to bypass AMSI and commercial antivirus solutions.

CloakifyFactory - Data Exfiltration & Infiltration In Plain Sight; Convert any filetype into list of everyday strings, using Text-Based Steganography; Evade DLP/MLS Devices, Defeat Data Whitelisting Controls, Social Engineering of Analysts, Evade AV Detection

Multi-cloud OSINT tool. Enumerate public resources in AWS, Azure, and Google Cloud.

Leaked pentesting manuals given to Conti ransomware crooks

Covenant is a collaborative .NET C2 framework for red teamers.

Course Repository for University of Cincinnati Malware Analysis Class (CS[567]038)

Interactive CTF Exploration Tool

CVE-2023-38831 winrar exploit generator

Universal local privilege escalation Proof-of-Concept exploit for CVE-2024-1086, working on most Linux kernels between v5.14 and v6.6, including Debian, Ubuntu, and KernelCTF. The success rate is 99.4% in KernelCTF images.

Deep Learning models for network traffic classification

Real-time phishing & scam domain blocklist — 99,000+ curated threats, 828K+ community, free API, multiple formats

Curated List of Best DevOps Tools

[Official] Android reverse engineering tool focused on dynamic instrumentation automation leveraging Frida. It disassembles dex, analyzes it statically, generates hooks, discovers reflected methods, stores intercepted data and does new things from it. Its aim is to be an all-in-one Android reverse engineering platform.

DNSGen is a powerful and flexible DNS name permutation tool designed for security researchers and penetration testers. It generates intelligent domain name variations to assist in subdomain discovery and security assessments.

A multifunctional Telegram based Android RAT without port forwarding.

A browser extension that allows you to monitor, intercept, and debug JavaScript sinks based on customizable configurations.

DRAKVUF Black-box Binary Analysis

去中心化远程控制工具（Decentralized Remote Administration Tool），通过ENS实现了配置文件分发的去中心化，通过Telegram实现了服务端的去中心化

"Security Incidents In A Box!" A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue- & Red Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.

An easy-to-use library for emulating memory dumps. Useful for malware analysis (config extraction, unpacking) and dynamic analysis in general (sandboxing).

iOS/macOS/Linux Remote Administration Tool

An Intelligent wordlist generator based on user profiling, permutations, and statistics. (Named after the same tool in Mr.Robot series S01E01)

An email spoofing testing tool that aims to bypass SPF/DKIM/DMARC and forge DKIM signatures.🍻

Practical Ethical Hacking Labs 🗡🛡

An evil RAT (Remote Administration Tool) for macOS / OS X.

A security research site.

FAME Automates Malware Evaluation

🕵️ OSINT Tools for gathering information and actions forensics 🕵️

Loading Remote AES Encrypted PE in memory , Decrypted it and run it

Free Auto GPT with NO paids API is a repository that offers a simple version of Auto GPT, an autonomous AI agent capable of performing tasks independently. Unlike other versions, our implementation does not rely on any paid OpenAI API, making it accessible to anyone.

Tips and Tutorials for Bug Bounty and also Penetration Tests.

the fastest and most powerful android decompiler(native tool working without Java VM) for the APK, DEX, ODEX, OAT, JAR, AAR, and CLASS file. which supports malicious behavior detection, privacy leaking detection, vulnerability detection, path solving, packer identification, variable tracking, deobfuscation, python&java scripts, device memory extraction, data decryption, and encryption, etc.

Ghost Framework is an Android post-exploitation framework that exploits the Android Debug Bridge to remotely access an Android device.

Deploy stealthy reverse shells using advanced process hollowing with GhostStrike – a C++ tool for ethical hacking and Red Team operations.

🐙 Track down GitHub users.

🔪 :octocat: Leak git repositories from misconfigured websites

A Linux Ransomware

Security Apps for Android

A detailed plan to achieve proficiency in hacking and penetration testing, with pathways including obtaining a degree in cybersecurity or earning relevant certifications.

All in One Hacking Tool for Linux & Android (Termux). Make your linux environment into a Hacking Machine. Hackers are welcome in our blog

A curated list of tutorials/resources for hacking online games.

Hacking resources and cheat sheets. References, tools, scripts, tutorials, and other resources that help offensive and defensive security professionals.

A curated list of penetration testing and ethical hacking tools, organized by category. This compilation includes tools from Kali Linux and other notable sources.

Process Herpaderping proof of concept, tool, and technical deep dive. Process Herpaderping bypasses security products by obscuring the intentions of a process.

🇺🇦 Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

30 different honeypots in one package! (dhcp, dns, elastic, ftp, http proxy, https proxy, http, https, imap, ipp, irc, ldap, memcache, mssql, mysql, ntp, oracle, pjl, pop3, postgres, rdp, redis, sip, smb, smtp, snmp, socks5, ssh, telnet, vnc)

HostHunter a recon tool for discovering hostnames using OSINT techniques.

IDA Pro plugin with a rich set of features: decryption, deobfuscation, patching, lib code recognition and various pseudocode transformations

Self contained htaccess shells and attacks

State-of-the-art native debugging tools

An integration for IDA and VS Code which connects both to easily execute and debug IDAPython scripts.

iMonitor（冰镜 - 终端行为分析系统）

Template-Driven AV/EDR Evasion Framework

Handbook of information collection for penetration testing and src

InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.

Most usable tools for iOS penetration testing

GUI analyzer for deep-diving into PDF files. Detect malicious payloads, understand object relationships, and extract key information for threat analysis.

80+ Gadgets(30 More than ysoserial). JNDI-Injection-Exploit-Plus is a tool for generating workable JNDI links and provide background services by starting RMI server,LDAP server and HTTP server.

Keylogger is 100% invisible keylogger not only for users, but also undetectable by antivirus software. keylogger Monitors all keystokes, Mouse clicks. It has a seperate process which continues capture system screenshot and send to ftp server in given time.

无状态子域名爆破工具

library for importing functions from dlls in a hidden, reverse engineer unfriendly way

A collection of special paths linked to common sensitive APIs, devops internals, frameworks conf, known misconfigurations, juicy APIs ..etc. It could be used as a part of web content discovery, to scan passively for high-quality endpoints and quick-wins.

OSINT Tool: Generate username lists for companies on LinkedIn

A secure sandbox environment for malware developers and red teamers to test payloads against detection mechanisms before deployment. Integrates with LLM agents via MCP for enhanced analysis capabilities.

LunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: https://github.com/marketplace/lunatrace-by-lunasec/

Find existing email addresses by nickname using API/SMTP checking methods without user notification. Please, don't hesitate to improve cat's job! 🐱🔎 📬

Dynamic unpacker based on PE-sieve

Builds malware analysis Windows VMs so that you don't have to.

Malcom - Malware Communications Analyzer

Materials for Windows Malware Analysis training (volume 1)

🚀🚀 This is a 🎇🔥 REAL WORLD🔥 🎇 Malware Collection I have Compiled & analysed by researchers🔥 to understand more about Malware threats😈, analysis and mitigation🧐.

A collection of malware samples and relevant dissection information, most probably referenced from http://blog.inquest.net

A collection of malware samples caught by several honeypots i manage

Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.

Matkap - hunt down malicious Telegram bots

MISP (core software) - Open Source Threat Intelligence and Sharing Platform

The Mobile App Pentest cheat sheet was created to provide concise collection of high value information on specific mobile application penetration testing topics.

Infection Monkey - An open-source adversary emulation platform

An extremely effective subdomain enumeration wordlist of 3,000,000 lines, crafted by harvesting SSL certs from the entire IPv4 space.

NetCat for Windows

Nishang - Offensive PowerShell for red team, penetration testing and offensive security.

Nosey Parker is a command-line tool that finds secrets and sensitive information in textual data and Git history.

Username enumeration and password spraying tool aimed at Microsoft O365.

Open source pre-operation C2 server based on python and powershell

oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.

A collection of one-liners for bug bounty hunting.

OneForAll是一款功能强大的子域收集工具

Open Source research tool to search, browse, analyze and explore large document collections by Semantic Search Engine and Open Source Text Mining & Text Analytics platform (Integrates ETL for document processing, OCR for images & PDF, named entity recognition for persons, organizations & locations, metadata management by thesaurus & ontologies, search user interface & search apps for fulltext search, faceted search & knowledge graph)

The openSquat is an open-source tool for detecting domain look-alikes by searching for newly registered domains that might be impersonating legit domains and brands.

OSCP Preparation Guide | Courses, Tricks, Tutorials, Exercises, Machines

Osintgram is a OSINT tool on Instagram. It offers an interactive shell to perform analysis on Instagram account of any users by its nickname

ParadoxiaRat : Native Windows Remote access Tool.

Passhunt is a simple tool for searching of default credentials for network devices, web applications and more. Search through 523 vendors and their 2084 default passwords.

Passphrase wordlist and hashcat rules for offline cracking of long, complex passwords

Portable Executable reversing tool with a friendly GUI

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

A collection of more than 170+ tools, scripts, cheatsheets and other loots that I've developed over years for Red Teaming/Pentesting/IT Security audits purposes.

A collection of custom security tools for quick needs.

⚔️Windows11 Penetration Suite Toolkit 🔰 The First Windows Penetration Testing Environment on Mac M Chips

Ruby on Rails Phishing Framework

Image Payload Creating/Injecting tools

Plasma is an interactive disassembler for x86/ARM/MIPS. It can generates indented pseudo-code with colored syntax.

This repository is a collection of powershell functions every hacker should know

Python based backdoor that uses Gmail to exfiltrate data through attachment. This RAT will help during red team engagements to backdoor any Windows machines. It tracks the user activity using screen capture and sends it to an attacker as an e-mail attachment.

Curated List of Privacy Respecting Services and Software

A Majora's Mask 3D patch that restores some mechanics from the original game to get the best of both worlds

Monitor linux processes without root permissions

pwncat - netcat on steroids with Firewall, IDS/IPS evasion, bind and reverse shell, self-injecting shell and port forwarding magic - and its fully scriptable with Python (PSE)

Exploit Development and Reverse Engineering with GDB & LLDB Made Easy

pentest framework

All-in-One malware analysis tool.

Ransomwares Collection. Don't Run Them on Your Device.

A resource containing all the tools each ransomware gangs uses

The PE file analysis toolkit

The Touhou PC-98 Restoration Project

A security tool for multithreaded information gathering and service enumeration whilst building directory structures to store results, along with writing out recommendations for further testing.

High Octane Triage Analysis

A Python library to utilize AWS API Gateway's large IP pool as a proxy to generate pseudo-infinite IPs for web scraping and brute forcing.

Reverse Engineer's Toolkit

A reverse engineering of Linear's sync engine. Endorsed by Linear CTO.

Statically-linked ssh server with reverse shell functionality for CTFs and such

ReversingLabs YARA Rules

A powerful and open-source toolkit for hackers and security automation - 安全行业从业者自研开源扫描器合辑

🍉一款基于Python-Django的多功能Web安全渗透测试工具，包含漏洞扫描，端口扫描，指纹识别，目录扫描，旁站扫描，域名扫描等功能。

Sandboxed Execution Environment

A post exploitation framework designed to operate covertly on heavily monitored environments

An IIS short filename enumeration tool

Android virtual machine and deobfuscator

SIPVicious OSS is a VoIP security testing toolset. It helps security teams, QA and developers test SIP-based VoIP systems and applications. This toolset is useful in simulating VoIP hacking attacks against PBX systems especially through identification, scanning, extension enumeration and password cracking.

Dangerously fast DNS/network/port scanner

Low bandwidth DoS tool. Slowloris rewrite in Python.

Hide secrets with invisible characters in plain text securely using passwords 🧙🏻‍♂️⭐

Sublert is a security and reconnaissance tool which leverages certificate transparency to automatically monitor new subdomains deployed by specific organizations and issued TLS/SSL certificate.

Sudomy is a subdomain enumeration tool to collect subdomains and analyzing domains performing automated reconnaissance (recon) for bug hunting / pentesting

A cross-platform note-taking & target-tracking app for penetration testers.

Enumerate and disable common sources of telemetry used by AV/EDR.

Next generation RedTeam heuristic intranet scanning | 下一代RedTeam启发式内网扫描

Reads from existing public and private cloud providers (reverse Terraform) and generates your infrastructure as code on Terraform configuration

Terraform module to set up your AWS account with the secure baseline configuration based on CIS Amazon Web Services Foundations and AWS Foundational Security Best Practices.

A repository of LIVE malwares for your own joy and pleasure. theZoo is a project created to make the possibility of malware analysis open and available to the public.

A scalable file analysis and data generation platform that allows users to easily orchestrate arbitrary docker/vm/shell tools at scale.

The Offensive Manual Web Application Penetration Testing Framework.

A Pin Tool for tracing API calls etc

The essential toolkit for reversing, malware analysis, and cracking

a list of 350+ Free TryHackMe rooms to start learning cybersecurity with THM

Curated Intelligence is working with analysts from around the world to provide useful information to organisations in Ukraine looking for additional free threat intelligence. Slava Ukraini. Glory to Ukraine.

For educational purposes only, exhaustive samples of 500+ classic/modern trojan builders including screenshots.

Dynamic unpacker and import fixer for Themida/WinLicense 2.x and 3.x.

Username tools for penetration testing

venom - C2 shellcode generator/compiler/handler

Venom - A Multi-hop Proxy for Penetration Testers

A VBA parser and emulation engine to analyze malicious macros.

lightweight, dependency-free bash script for security, performance auditing and infrastructure monitoring of Linux servers.

Security Orchestration, Automation and Response (SOAR) Platform. 安全编排与自动化响应平台，无需编写代码的安全自动化，使用 SOAR 可以让团队工作更加高效

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

A OWASP Based Checklist With 500+ Test Cases

Web Fuzzing Box - Web 模糊测试字典与一些Payloads

An automation tool that enumerates subdomains then filters out xss, sqli, open redirect, lfi, ssrf and rce parameters and then scans for vulnerabilities.

Fetch information about a public Google document.

Android Penetration Tool [ RAT for Android ]

yarGen is a generator for YARA rules