~/hackyfeed $

Ferrox is a research-focused Windows stealer written in Rust, designed to harvest sensitive data including browser credentials, cryptocurrency wallet information, and messaging app sessions while employing various evasion techniques to bypass antivirus and endpoint detection systems. Its notable features include polymorphic builds, compile-time encryption of strings, direct syscall execution, anti-analysis measures, and the ability to exfiltrate stolen data via Discord or Telegram within a stealthy execution environment. The tool is intended strictly for educational purposes in understanding modern attack methodologies for enhancing cybersecurity defenses.

The Fake-SystemUpdate-Malware-Simulator is a malware simulation tool designed to illustrate common stealth techniques employed by real-world malware, masquerading as a Windows system update executable. It features keylogging, periodic screenshot capture, and IP-based geolocation tracking, all while maintaining persistence by utilizing Windows Startup locations and registry keys. This project serves purely for educational purposes and to enhance cybersecurity awareness, demonstrating how such malicious software can evade detection.

EmpireCTF is a comprehensive repository of Capture The Flag (CTF) write-ups that chronologically documents solutions and methodologies applied in various CTF competitions from 2018 to 2025. The primary use case of this tool is to serve as a reference for cybersecurity enthusiasts and professionals seeking to enhance their skills in solving CTF challenges. Notable features include categorized write-ups by year and challenge type, facilitating easy navigation and study of different techniques and tools utilized in the CTF landscape.

DRAKBEN is an AI-powered autonomous penetration testing framework that utilizes natural language processing to perform comprehensive security assessments, allowing users to issue commands in plain language. Its notable features include a self-evolving engine for dynamic tool synthesis, a multi-language interface supporting Turkish and English, and advanced memory systems for context-aware decision-making and persistent learning. This framework streamlines the penetration testing process from reconnaissance to reporting with minimal user intervention.

Dracula OS is a specialized Linux distribution based on Kali Linux, tailored for Open Source Intelligence (OSINT) and Cyber Intelligence investigations. It integrates a curated suite of OSINT tools and applications sourced from GitHub, facilitating streamlined deployment through an OVA file. Key features include extensive frameworks for reconnaissance, web intelligence, metadata analysis, and social media investigations, making it a comprehensive platform for cyber intelligence professionals.

The Cyber Intelligence Toolkit is a comprehensive resource designed for investigators and analysts that integrates manuals, playbooks, checklists, and appendices for digital investigations. It focuses on OSINT methodologies, digital forensics, AI content detection, and operational security, enabling users to conduct structured and effective investigations. Notable features include standardized investigation frameworks and practical guidelines, making it adaptable for both field operations and detailed analyses.

CS2BR is a compatibility layer designed to enable the execution of Cobalt Strike (CS) Beacon Object Files (BOFs) in Brute Ratel C4 (BRC4) by translating CS API calls to their BRC4 equivalents. It facilitates the use of existing CS BOFs in the BRC4 environment, though it currently only works at the source code level and does not cover all CS API functionalities. Notable features include a patching process for BOF source code and the option to generate parameters for execution, while users should be aware of limitations regarding certain APIs and the potential for increased code size.

CS-EDR-Enumeration is a Cobalt Strike Aggressor Script designed to enumerate antivirus (AV), endpoint protection platform (EPP), endpoint detection and response (EDR), and telemetry/SIEM products on Windows hosts post-compromise. It features six commands with varying noise levels to suit different operational risk tolerances, and includes a comprehensive signature database for major security vendors, enabling silent enumeration techniques that minimize detection. Notable capabilities include kernel driver enumeration, automatic threat level assessment, and color-coded output for quick identification of security products.

Command CheatSheet is a comprehensive reference tool designed for penetration testing, focusing primarily on the OSCP framework. It offers an extensive collection of over 130 cheatsheets and 70 port references, providing quick access to emergency commands, checklists, and tools for various stages of the pentesting process, including scanning, exploitation, and privilege escalation. The tool emphasizes usability with a structure that promotes quick copy-paste actions for efficient workflow during assessments.

ColdWer is a cybersecurity tool that enables users to freeze endpoint detection and response (EDR) or antivirus (AV) processes by leveraging the WerFaultSecure.exe PPL bypass, allowing for the extraction of LSASS memory on modern Windows systems. Its primary use case is for security assessments and exploit development, featuring a fast execution model, manual process control, and the ability to bypass process protection via in-memory modifications. This tool is particularly useful for maintaining stealth during sensitive operations while extracting potentially credential-related information from LSASS.

CODASM is a Python utility designed to encode arbitrary data into pseudo Assembly instructions and compile it into the .text section of binary files, effectively allowing for the obfuscation of shellcode. Notable features include the ability to specify output formats (ASM, binary, C decoder), control over encoding parameters, and considerable data overhead of 80-120%. This tool is primarily used for educational and security research purposes related to malware analysis and payload delivery methods.

claude-code-pentest automates the penetration testing lifecycle using six specialized skills that range from reconnaissance to exploit chaining and report generation. Its notable features include subdomain enumeration, vulnerability discovery across web applications and APIs, cloud infrastructure analysis, and the capability to compose findings into comprehensive bug bounty reports—all implemented via 43 standalone Python scripts that require no external dependencies. The tool is designed for authorized security testing only and is integrated with Claude Code for user-friendly command execution.

Chronix is a self-hosted collaborative workspace designed for penetration testers and red team operators, facilitating the capture of notes, commands, outputs, and operational context during security engagements. Notable features include real-time synchronization, timeline logging with extensive filtering and searching capabilities, and the ability to export notes in Markdown format along with images. Additionally, it supports collaborative note-taking with markdown formatting, auto-save functionality, and a structured export mechanism for reporting workflows.

BST is a developing suite of security tools designed to facilitate various cybersecurity tasks. Its primary use case encompasses streamlining security assessments and enhancing defensive measures, with a focus on providing a comprehensive toolkit for security professionals. Notable features include modular architecture and the potential for integration with various security frameworks.

Blexploit is a comprehensive offensive Bluetooth Low Energy (BLE) security framework designed for red teams and security researchers, facilitating passive scanning, exploitation, and replay attacks with advanced anomaly detection. Its modular architecture includes features such as GATT enumeration, customizable attack simulations, and offline sandbox environments, while automatically generating risk assessments and attack module suggestions based on detected device UUIDs. Key functionalities, including real packet injection and an Isolation Forest-based detection mechanism, make it versatile for both testing and education in Bluetooth security contexts.

BlackBerryC2 is an encrypted remote administration and command-and-control (C2) framework primarily designed for educational and security research purposes within controlled environments. It features a custom TCP-based server that employs application-layer cryptography, including AES-256-GCM encryption and HMAC-SHA256 authentication, facilitating secure client communication, remote command execution, and file transfers. Key capabilities include session management, support for multiple concurrent clients, interactive console operations, and robust flood detection mechanisms.

black-widow is a comprehensive offensive penetration testing tool designed for various forms of information gathering and attack execution. Written in Python and offering both a web GUI and command line interface, it features capabilities such as website crawling, web page parsing, sniffing, and support for multiple asynchronous requests across multiple targets. Its continuously updated open-source framework also includes advanced functionalities for SQL injection and brute force attacks, making it suitable for both professional penetration testers and security enthusiasts.

Black-Hat-Zig is a cybersecurity tool that focuses on implementing various malware techniques using the Zig programming language, catering particularly to security researchers, malware developers, and reverse engineers. Notable features include continuous updates and a community-driven approach, which encourages contributions to expand its functionality and content. This tool serves as a resource for exploring and weaponizing capabilities within the Zig environment.

ARTC2 is an advanced execution framework designed to help security teams efficiently execute attack scenarios across multiple breach points, primarily focusing on Windows OS environments. Its notable features include rapid deployment, modern command and control capabilities utilizing encrypted communications, and dynamic attack formations that enable execution without recompilation. The tool supports extensive logging for evidence collection and analysis, facilitating rapid evaluation of endpoint detection and response (EDR) solutions against MITRE ATT&CK frameworks.

The asm-payloads-loaders tool provides a series of assembly-written payload loaders for x86-64 Linux, utilizing only native syscalls without external dependencies. It features various loading mechanisms, including file-based, HTTP, and DNS payload loading, with options for dynamic memory allocation and checksum verification for integrity checks. This tool is designed to facilitate the development and understanding of payload loading techniques through detailed examples and documentation.

WLX (WordListeXplorer) is a local wordlist intelligence and workflow management tool designed for offensive security professionals and bug bounty hunters, enabling them to efficiently organize, search, and integrate large-scale wordlist collections into their workflows. Notable features include SQLite-powered indexing, fast keyword searches, tag-based filtering, session-aware variable management, and direct integration with offensive tools through shell environment variables, all within a terminal-native interface for streamlined operations.

WebXray is an offensive web scanner developed in Python that facilitates comprehensive security assessments by combining features such as crawling, XSS and SQL injection detection, security header analysis, and WAF detection. Its notable capabilities include reflected XSS detection, support for various output formats, and ease of integration into existing bug bounty workflows or pipelines. Designed primarily for security professionals, it helps identify potential vulnerabilities in web applications during reconnaissance.

WebStrike is an automated web penetration testing framework designed to orchestrate various Kali tools through a structured phase-based pipeline, enhancing the workflow of web pentesting. It links tools together, utilizing outputs from one as inputs for the next while providing deduplication and comprehensive reporting. The framework allows for both manual and automated modes of operation, enabling users to manage the level of intrusion and control over testing processes efficiently.

The LLM Red Teamer's Playbook provides a systematic methodology for assessing and bypassing various defense layers in Large Language Models (LLMs), such as input filters and alignment mechanisms. It emphasizes a diagnostic approach to identify and understand the specific defenses in place before selecting appropriate attack techniques, mapped to the Adversarial AI Threat Modeling Framework (AATMF) v3. This guide is intended for AI red teamers, security engineers, and researchers, enabling them to conduct unauthorized testing responsibly while improving the security of AI systems.

SubSurfer is a high-performance tool designed for subdomain enumeration and web property identification, ideal for red team operations and bug bounty hunting. It features fast asynchronous scanning, customizable port scanning, and web service identification capabilities, with a modular design that allows integration with other tools or use as a Python module. Continuous updates and the ability to tailor scans make it a versatile choice for cybersecurity professionals.