~/hackyfeed $

Radmin VPN for Linux allows users to run the Radmin VPN client via Wine on Linux systems, enabling VPN network access without the overhead of a Windows virtual machine. The tool employs a custom driver that bridges Wine to a Linux TAP device, overcoming compatibility issues and ensuring a fully functional VPN experience. Notable features include AI-assisted reverse engineering for protocol implementation, AppImage distribution for simplicity, and command-line options for flexible usage scenarios.

`r2unity` is a command-line tool and plugin for radare2 designed to inspect Unity IL2CPP builds by parsing `global-metadata.dat` and correlating it with native binaries for reverse engineering purposes. Key features include support for various metadata wire versions, comprehensive recovery of managed images and method metadata, detection of companion files across multiple platforms, and the ability to generate CycloneDX SBOMs. It also recognizes Unity SerializedFile v22 assets and BGDatabase v6 repositories, enhancing its capability for analyzing Unity game builds.

OpenRemap is a Python library and CLI tool designed for ECU binary identification, diffing, and patching, enabling users to automate workflows or integrate it into applications without reliance on the internet. Its key features include accurate identification of binary files, batch processing for multiple binaries, generation of detailed diff recipes, and secure patching with complete verification. The tool provides a comprehensive, open-source solution for automotive software analysis, eliminating the need for costly commercial software.

malsnitch is a command-line tool designed to assist malware reverse engineering by scanning various artifact formats for embedded secrets within binaries. Its notable features include the ability to detect hardcoded credentials, C2 infrastructure, and crypto keys in binary files, with support for multiple input formats such as raw strings dumps, FLOSS JSON output, and Binary Ninja exports. The tool also offers structured JSON output, automatic deduplication, and the capability to scan memory dumps, making it an efficient resource in identifying obscured sensitive information utilized by malware authors.

Ghost is a robust process injection detection tool developed in Rust, designed to monitor running processes for signs of code injection, memory manipulation, and other malicious activities on Windows, Linux, and macOS. Its notable features include detection of memory anomalies, shellcode patterns, API hooks, and thread hijacking, all while mapping behaviors to the MITRE ATT&CK framework to aid in threat documentation. The tool offers both a command-line interface and an interactive terminal UI, providing real-time scanning results and support for extensible features like YARA rule scanning and neural ML integration.

Deadband is a Linux GUI application designed for configuring gaming input devices such as controllers and mice through their vendor-specific interfaces. It features live input monitoring, extensive customization options for profiles, lighting effects, and button remapping, as well as diagnostic tools to troubleshoot device connectivity issues. Additionally, the tool supports multiple devices with potential for extension to others, offering a user-friendly interface and customizable themes.

Awesome AI Reverse Engineering is a curated collection of tools that integrates AI-driven methodologies into reverse engineering processes, facilitating JavaScript reverse engineering, binary analysis, Android security research, and traffic capture. Key features include the use of the Model Context Protocol (MCP) to enable AI assistants to control professional tools like IDA Pro and Ghidra, as well as a focus on automating workflows with the latest AI techniques for enhanced efficiency and effectiveness in security analysis.

The HackerOne CLI utility is an unofficial command-line client for the HackerOne platform, enabling users to interact with their account through various modules. Notable features include accessing user profiles, reports, program information, and earnings status, all powered by the official HackerOne API for seamless integration. The tool supports multiple operations suitable for both Windows and Unix environments, allowing easy installation and execution.

phishtank-lookup is a web API that leverages the hourly public dump from Phishtank, facilitating queries against a Redis database of valid phishing URLs. Key features include automatic updates every hour, a straightforward installation process, and access to a web interface for API interaction, which enhances phishing detection capabilities by providing quick access to real-time data on known malicious sites.

WiFi Jammer is an advanced educational penetration testing tool designed for WiFi security assessments, utilizing Python for 802.11 frame injection. It facilitates multiple attack types, including deauthentication, disassociation, and various flooding attacks, while offering rich interfaces through CLI, TUI, and GUI across multiple platforms. Notable features include channel hopping automation, PMKID and WPA handshake capture, and an architectural design grounded in SOLID principles.

Kryon is an autonomous, local-first cybersecurity agent designed for comprehensive offensive security tasks including compliance audits, penetration testing, vulnerability hunting, digital forensics, and incident response from a single command. It features a skill-based architecture that dynamically loads over 110 playbooks and employs deterministic pre-hooks for critical detections, ensuring that it provides both a thorough assessment and actionable outputs without reliance on external APIs. Additionally, it supports a wide range of compliance frameworks across multiple sectors, making it adaptable for various organizational needs.

`repro-evidence-kit` is a command-line interface designed for maintainers to effectively review artifact-heavy pull requests and automate release processes by generating comprehensive hash manifests and evidence bundles. Its notable features include the creation of SHA-256 manifests, manifest diffs to identify changes, sandbox output verification against specified allowlists, and the ability to validate and tamper-proof evidence bundles, all while preserving command context for comprehensive review without revealing sensitive data. This tool is particularly beneficial for CI, security research, and data processing contexts, ensuring that artifact reviews are manageable and secure.

pymsi is a pure Python library designed for reading and manipulating Windows Installer (MSI) files, utilizing the rust msi crate and msitools utilities. Its primary use case is to facilitate the extraction, analysis, and modification of MSI file contents, offering features such as command line operations for listing tables, dumping contents, checking file validity, and decoding custom actions. Additionally, it provides a client-side MSI viewer and file extractor accessible through a web interface.

The SLSA GitHub Generator is a tool designed to generate and verify SLSA Build Level 3 provenance for projects hosted on GitHub, utilizing GitHub Actions to enhance software supply chain security and integrity. Its primary use case is to help developers establish a tamper-proof statement of their software creation process, thereby mitigating risks of supply chain attacks. Notable features include the ability to build custom builders and generators for SLSA compliance and integration with GitHub artifact attestations for verified provenance.

oak-keyring is a privacy-centric, terminal-based password manager that provides an interactive TUI for browsing, managing, and securing credentials. Key features include a customizable password generator, efficient vault management with tagging and soft-delete options, cloud sync capabilities via Google Drive, and robust recovery options. The tool emphasizes a local-first approach, ensuring user data remains private while facilitating convenient keyboard-driven interactions.

MADCAT (Mass Attack Detection Connection Acceptance Tools) is a low-interaction honeypot solution designed for detecting and logging network attacks by simulating common network services. It captures attack patterns and behaviors by recording contact attempts, including IP addresses and timestamps, without providing extensive interaction, and is intended to enhance the monitoring and forecasting of mass attacks on the internet. The tool is currently under development to include a DPI Routing Proxy and Docker Appliance for improved capabilities.

`knockr` is a port-knocking utility written in Go that simplifies the access control mechanism of opening blocked ports through predefined sequences. It supports multiple protocols and offers features such as delay configuration, timeout settings, and the ability to verify port status after knocking, all while allowing users to save frequently used sequences as profiles in a secure configuration file. This tool is cross-platform and can be easily integrated into scripts for automated processes.

Guardon is a browser extension designed to identify Kubernetes security misconfigurations during code reviews on GitHub and GitLab, enabling developers to catch issues before they reach production. It offers instant feedback with actionable, copy-paste ready fixes, requires zero setup, and supports customizable rules and Kyverno policy imports. Notable features include multi-document YAML parsing, smart fix suggestions, and a user-friendly interface that integrates seamlessly into existing workflows.

Clampdown is a cybersecurity tool designed to run AI coding agents within secure, hardened container sandboxes, thereby mitigating risks associated with arbitrary code execution. Its primary use case is confining untrusted processes to ensure limited filesystem access and controlled network egress, utilizing advanced features like custom seccomp profiles, AppArmor confinement, and mandatory read-only root filesystems. By implementing a multi-layered architecture with sidecars and nested containers, Clampdown enables robust isolation and security for AI agents operating in potentially vulnerable environments.

AttackGen is an advanced incident response testing tool designed for cybersecurity professionals, utilizing large language models and the MITRE ATT&CK and ATLAS frameworks to generate customized incident response scenarios. Key features include tailored scenarios based on threat actor groups, organization-specific parameters, a chat-based assistant for scenario updates, and integration with multiple AI APIs for enhanced scenario generation. It also provides user feedback mechanisms and downloadable scenarios in Markdown format, facilitating effective training and assessment of incident response capabilities.

Kaosagnt's Ansible Everyday provides a collection of customizable Ansible playbooks designed for daily server management tasks, streamlining automation for systems administrators. The tool features interactive playbooks for various operations, such as managing access control lists, package updates on RHEL and Debian-based systems, and setting up system tools like the nano editor. It also includes scripts for easy execution of these tasks, requiring minimal setup while accommodating a range of operating systems.

Atomdrift Scan is a machine learning-based malware scanner designed for detecting 0-day attacks in the software supply chain. Its primary use case revolves around scanning files, URLs, and processes with support for over 100 file formats and more than 100,000 detection rules, delivering an 82% detection rate. Notable features include advanced static analysis with reinforcement learning for frequent rule updates, automated binary reverse engineering, and flexible integration into existing workflows.

Azazel is a lightweight eBPF-based runtime security tracer specifically designed for malware analysis sandboxes. It operates within isolated Docker containers to capture detailed telemetry data, such as syscalls, file interactions, and network activities, producing a JSON output that allows integration with various data processing tools. Notable features include zero runtime dependencies, compile-once run-everywhere capability, and built-in heuristics for automatic alerts on suspicious behaviors.

Bad Piggies Editor is a cross-platform tool for editing levels and saves in the game "Bad Piggies," developed in Rust. It allows users to manipulate various file formats, including `.bytes` and `.yaml`, while offering features such as a six-pass wgpu renderer for enhanced graphical representation and a CLI for file conversion and encryption. The application employs a shared backend architecture for both native and web environments, utilizing Web Workers for optimized processing and rendering tasks.

The Sthenos Embedded Toolkit is a comprehensive solution for building static debugging and analysis tools tailored for embedded systems across over 50 architectures. Notable features include support for both musl and glibc toolchains, a range of available tools such as strace and tcpdump, and the capability to compile specific tools for designated architectures using a Docker-based build environment. This toolkit enables streamlined development and troubleshooting for embedded systems, ensuring reliable performance in diverse operating environments.