饭醉分子

chisel. A fast TCP/UDP tunnel over HTTP

jadx-gui-ai. jadx-gui反编译工具二次开发，接入AI赋能。

javascript-obfuscator. A powerful obfuscator for JavaScript and Node.js

servo. Servo aims to empower developers with a lightweight, high-performance alternative for embedding web technologies in applications.

camofox-browser. Stealth headless browser for AI agents — bypass Cloudflare, bot detection, and anti-scraping. Drop-in Puppeteer/Playwright replacement.

camofox-browser. Anti-detection browser server for AI agents — REST API wrapping Camoufox engine with OpenClaw plugin support

camoufox-reverse-mcp. 🔧 反检测浏览器 MCP Server | 35 个 JS 逆向工具 + C++ 引擎层 JSVMP 指纹追踪

HeadlessX. The undetected self-hosted browser automation platform. Powered by Camoufox (Firefox) for 0% detection rates. Built for speed, privacy, and scalability.

v_jstools. 模仿着写一个 chrome 插件，用来快速调试前端 js 代码。

ja4. JA4+ is a suite of network fingerprinting standards

ja3. Go package for Ja3 TLS client and server hello fingerprints

MPScan. MPScan 是一款为安全研究人员与开发者设计的 Windows GUI 一体化工具，专用于对微信小程序进行自动化安全审计。

XChrome. 免费开源的指纹浏览器，支持全功能指纹隔离，支持统一控制群控，支持脚本运行和api

debugger-protocol-viewer. Website for viewing the DevTools Protocol as defined in Chromium

chromium-bidi. Implementation of WebDriver BiDi for Chromium

fingerprint-browser. 指纹浏览器（防关联浏览器）资源整理 - Fingerprint Browser (Antidetect Browser) Resources

CloakBrowser. Stealth Chromium that passes every bot detection test. Drop-in Playwright replacement with source-level fingerprint patches. 30/30 tests passed.

untidetect-tools. List of anti-detect and humanizing tools and browsers, including captcha solvers and sms-activation.

botasaurus. The All in One Framework to Build Undefeatable Scrapers

camoufox. 🦊 Anti-detect browser

CthulhuJs. CthulhuJs is a powerful framework for browser fingerprint obfuscation and masquerading. By hooking low-level browser APIs, it allows for customized modification or randomization of various hardware and software fingerprints. It is designed to protect user privacy, bypass anti-bot detections.

project-foxhound. A web browser with dynamic data-flow tracking enabled in the Javascript engine and DOM, based on Mozilla Firefox (https://github.com/mozilla-firefox/firefox). It can be used to identify insecure data flows or data privacy leaks in client-side web applications.

fingerprint-chromium. An open source fingerprint browser based on Ungoogled Chromium. 指纹浏览器 隐私浏览器

ezinject. Modular binary injection framework, successor of libhooker

yabai. A tiling window manager for macOS based on binary space partitioning

injx. ✅ Cross-platform library injection toolkit (Windows DLL / macOS dylib / Linux .so) - CLI & library for Rust and Go

frida. Clone this repo to build Frida

C3. Custom Command and Control (C3). A framework for rapid prototyping of custom C2 channels, while still providing integration with existing offensive toolkits.

Covenant. Covenant is a collaborative .NET C2 framework for red teamers.

openclaw. Your own personal AI assistant. Any OS. Any Platform. The lobster way. 🦞

openafs. Fork of OpenAFS from git.openafs.org for visualization

chrome_installer. Auto-updated Google Chrome offline installers for Windows (Stable/Beta/Dev/Canary, x86/x64/ARM64) with direct links and SHA-256, via GitHub Actions

witr. Why is this running? Trace any process, port, container, or file back to what started it - CLI + TUI.

vphone-aio. 1 script run the vphone

online-markdown. A online markdown converter specially for Wechat Public formatting.

AION. Red Teaming Framework

LSPosed. LSPosed Framework

Off-By-One-Security-Masterclass-TheMalwareGuardian. Materials from the Masterclass I presented on the Off By One Security channel, hosted by Stephen Sims. The sessions covered how to develop and deploy rootkits and included an APT-style emulation demonstrating how such malware can be used operationally.

Digispark-Attiny85-Physical-Red-Teaming-USB-Implant-TheMalwareGuardian. Learn how to create Rubber Ducky-style USB implants with the Digispark Attiny85. Step-by-step setup, payload development and troubleshooting.

watchTowr-vs-SmarterMail-CVE-2025-52691.

CVE-2026-21858. n8n Ni8mare - Unauthenticated Arbitrary File Read to RCE Chain (CVSS 10.0)

the-one-wsl-bof. One WSL BOF to rule them all

RpcMotion-CICADA8-Research. Execute commands, in/exfiltrate files using your custom RPC Server

WellAlly-health. Ally-Health is an intelligent healthcare assistant that combines Claude AI technology with medical expertise. Through natural language interaction, it helps users record symptoms, manage medications, track medical records, and access professional multidisciplinary consultation analysis—making health management smarter and more accessible

golang-1.25-go-trzsz.

The-Path-That-Leads-to-Your-First-CVE-TheMalwareGuardian. A talk about finding your own path to vulnerability research and your first CVE.

choco-trzsz. choco package source

trzsz.github.io-trzsz. trzsz is a simple file transfer tools, similar to lrzsz ( rz / sz ), and compatible with tmux.

reverse-engineering-assistant. MCP server for reverse engineering tasks in Ghidra 👩‍💻

edbgserver. An eBPF-powered debugger server for linux and android.

news-aggregator-skill. 这是一个为您定制的全网新闻聚合skill,支持多个信息源，支持深度获取，能够阅读文章正文并提供有理有据的深度解读。

Mythic-OSEP-CheatSheet. Mythic C2 CheatSheet for OSEP

everything-claude-code. Complete Claude Code configuration collection - agents, skills, hooks, commands, rules, MCPs. Battle-tested configs from an Anthropic hackathon winner.

skills-updater. Manage, update, and discover Claude Code skills. 管理、更新和发现 Claude Code 技能。

CrystalPalace-Ex. Java

homunculus. A Claude Code plugin that watches how you work, learns your patterns, and evolves itself to help you better.

wooyun-legacy. wooyun-legacy skill for claude code

trzsz-go-trzsz. trzsz-go is the go version of trzsz, makes all terminals that support local shell to support trzsz ( trz / tsz ).

AgenticRed. An automated pipeline that leverages LLM's meta-learning capability to iteratively design and refine red-teaming systems without human intervention.

tsshd-trzsz. tsshd: the trzsz-ssh(tssh) udp server that supports connection migration for roaming, keeping ssh sesseion alive even if the network is disconnected for a long time.

moltbot-1click-rce. Clawdbot/Moltbot/OpenClaw One-click RCE PoC 🦞 (CVE-2026-25253)

binja-gcj. Binary Ninja plugin for GNU Compiler for Java

claude-workflow. 纯AI时代的开源项目

trzsz-ssh-trzsz. trzsz-ssh ( tssh ) is an ssh client designed as a drop-in replacement for the openssh client. It aims to provide complete compatibility with openssh, mirroring all its features, while also offering additional useful features. Such as login prompt, batch login, remember password, automated interaction, trzsz, zmodem(rz/sz), udp mode like mosh, etc.

genact-ex. 🌀 A nonsense activity generator

OpenClawInstaller. ClawdBot 一键部署工具

LyticEnzyme. Reverse-engineering SubstrateVM

litebox. A security-focused library OS supporting kernel- and user-mode execution

supacode. native macOS codings agent orchestrator

CTFd-AI-Buddy.

CupcakeC2. 这是一款现代、高性能的跨平台 C2 架构系统。采用 Rust 编写受控端，Go 编写服务端，以及 Vue 3 极致轻量化 UI。深度融合 MCP 协议，开启 AI 自动化攻防新篇章。

AutoRedTeam-Orchestrator. AI-Driven Automated Red Team Orchestration Framework | AI驱动的自动化红队编排框架 | 101 MCP Tools | 2000+ Payloads | Full ATT&CK Coverage | MCTS Attack Planner | Knowledge Graph | Cross-platform

picolm. Run a 1-billion parameter LLM on a $10 board with 256MB RAM

LongMemory. Long Memory My Own Way

founders-kit. A curated collection of essential resources, tools, and playbooks to help founders build, launch, and scale startups successfully.

claude-web-tunnel. 觉得happy不好用，只能自己动手的产物

pentest-book.

openclaw-manager.

heliosim. Real-time N-body gravitational system simulator built with C++ and OpenGL

SynthAPT. Generate malware with AI

CodeMap. 自建的CodeMap小工具，为了节约一些tokens

Claude-Clean. 避免某些奇妙妙问题的工具

exploitation.

WebKit-UAF-ANGLE-OOB-Analysis. Analysis of CVE-2025-43529 (WebKit UAF) + CVE-2025-14174 (ANGLE OOB) exploit chain - iOS Safari

v8-ndays. Some V8 n-day exploits that I've written

HackTui. TUI SIEM in Elixir on BEAM

ida-mcp-rs. Headless IDA Pro MCP Server

mymonitor. world monitor is too heavy

awesome-llvm-security. awesome llvm security [Welcome to PR]

awesome-game-security. awesome game security [Welcome to PR]

llvm-msvc-ex. Forked LLVM focused on MSVC Compatibility. This version is designed for windows users

rss_reader. tui工作环境看看rss

rust_tauri_evtx_analyze.

windows_usb_device_manager. 一个用于枚举、禁用、启用和重置 USB 设备的简单 Windows 工具（通过设备实例 ID 操作）。A simple Windows tool to enumerate, disable, enable, and reset USB devices by their Device Instance ID.

libev. libev源码分析学习文档

libeio. libeio源码分析学习文档

libdnet. libdnet源码分析学习文档

libsigar. libsigar-1.6.7 源码分析

ClickHouse. ClickHouse® is a real-time analytics database management system

libdnet. libdnet provides a simplified, portable interface to several low-level networking routines.

sigar. System Information Gatherer And Reporter

String-Analyzer. String extraction for CTI and malware analysis: URLs, IPs, registry keys, APIs, encoded data, and analyst-ready prompts.

libuv. Cross-platform asynchronous I/O

pentagi. Fully autonomous AI Agents system capable of performing complex penetration testing tasks

CobaltStrikeBeaconCppSource. Out-of-the-box CobaltStrike Beacon source code use C++

firefox-ios. Firefox for iOS

firefox. The official repository of Mozilla's Firefox web browser.

Havoc. The Havoc Framework

merlin. Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.

sliver. Adversary Emulation Framework

macOS-Security. macOS Security Resources

seccomp-notify-injection. Linux Process Injection via Seccomp Notifier

SecLists. SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

gitweekly. 收集各种有趣的github项目

reverse-shells. A collection of reverse shell commands and payloads

PoolParty. A set of fully-undetectable process injection techniques abusing Windows Thread Pools

WebShell. Webshell && Backdoor Collection

nikto. Nikto web server scanner

QBDI. A Dynamic Binary Instrumentation framework based on LLVM.

slim. Slim(toolkit): Don't change anything in your container image and minify it by up to 30x (and for compiled languages even more) making it secure too! (free and open source)

unix-privesc-check. Automatically exported from code.google.com/p/unix-privesc-check

linux-exploit-suggester-2. Next-Generation Linux Kernel Exploit Suggester

linux-exploit-suggester. Linux privilege escalation auditing tool

LinEnum. Scripted Local Linux Enumeration & Privilege Escalation Checks

pwncat. Fancy reverse and bind shell handler

gitjacker. 🔪 :octocat: Leak git repositories from misconfigured websites

RustScan. 🤖 The Modern Port Scanner 🤖

WhatWeb. Next generation web scanner

Findomain. The fastest and complete solution for domain recognition. Supports screenshoting, port scan, HTTP check, data import from other tools, subdomain monitoring, alerts via Discord, Slack and Telegram, multiple API Keys for sources and much more.

subfinder. Fast passive subdomain enumeration tool.

samples. Windows 10 IoT Core Samples

oletools. oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.

Mythic. A collaborative, multi-platform, red teaming framework

phantomjs. Scriptable Headless Browser

debug. A tiny JavaScript debugging utility modelled after Node.js core's debugging technique. Works in Node.js and web browsers

WeChatOpenDevTools-Python. WeChatOpenDevTool 微信小程序强制开启开发者工具

generative-ai-for-beginners. 21 Lessons, Get Started Building with Generative AI

Awesome-Advanced-Windows-Exploitation-References. List of Awesome Advanced Windows Exploitation References

MediaCrawler. 小红书笔记 | 评论爬虫、抖音视频 | 评论爬虫、快手视频 | 评论爬虫、B 站视频 ｜ 评论爬虫、微博帖子 ｜ 评论爬虫、百度贴吧帖子 ｜ 百度贴吧评论回复爬虫 | 知乎问答文章｜评论爬虫

kunai. Threat-hunting tool for Linux

Kernel-Trace. 一个基于uprobe，能同时hook大量用户地址空间函数的kpm内核模块

darken-anticheat. Kernel anti-cheat for protecting software.

function-collections. A collection of PoCs to do common things in unconventional ways

CreateProcessAsPPL. This is the loader that supports running a program with Protected Process Light (PPL) protection functionality.

VMDragonSlayer. Automated multi-engine framework for unpacking, analyzing, and devirtualizing binaries protected by commercial and custom Virtual Machine based protectors. Combines Dynamic Taint Tracking, Symbolic Execution, Pattern & Semantic Classification, and Machine Learning–driven prioritization to dramatically reduce manual reverse engineering time.

ios-resources. Useful resources for iOS hacking

awesome-tunneling. List of ngrok, Cloudflare Tunnel, Tailscale, and ZeroTier alternatives and other tunneling software and services. Focus on self-hosting.

STrace. A DTrace on Windows Reimplementation

rs-reverse. 瑞数vmp纯算法逆向，补环境框架sdenv的灵感来源

sdenv. 补环境框架sdenv，完美过瑞数vmp理论通杀，配合瑞数vmp纯算法逆向项目（rs-reverse）更好学习原理

UltraBr3aks. sharing NEW strong AI jailbreaks of multiple vendors (LLMs)

curlconverter. Transpile curl commands into Python, JavaScript and 27 other languages

weread-exporter. 将微信读书中的书籍导出成epub、pdf、mobi等格式

feapder. 🚀🚀🚀feapder is an easy to use, powerful crawler framework | feapder是一款上手简单，功能强大的Python爬虫框架。内置AirSpider、Spider、TaskSpider、BatchSpider四种爬虫解决不同场景的需求。且支持断点续爬、监控报警、浏览器渲染、海量数据去重等功能。更有功能强大的爬虫管理系统feaplat为其提供方便的部署及调度

Charles-Crack. Removed according to DMCA.

browserslist. 🦔 Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-preset-env

iometa. arm64 IOKit class dumper

pyv8env. 纯python补环境框架

Browser-Env. Web crawlers use the real browser environment. 模拟真实浏览器环境执行, 修改js脚本, 免去补环境问题, 用得好可以通杀JS加密

NodeSandbox. Node补环境框架

boda_jsEnv. js补环境框架

Hook_JS. 个人向自写JS Hook脚本

fingerprintjs. The most advanced free and open-source browser fingerprinting library

Anti-WebSpider. Web 端反爬技术方案

JG-Cursor-cracker. 极光互联蛙无限Cursor登录器破解器

awesomeFrida. frida代码汇总

cy_jsvmp. 实现jsvmp技术加密代码，基本实现ES5语法被翻译成VMP，ES6语法的一部分也被实现The basic implementation ES5 syntax is translated into VMP, and part of the ES6 syntax is also implemented

js-env. 基于isolated-vm魔改虚拟机实现的js环境框架，封装了一套非js标准的代理和native函数创建的方法。

JsRpc. 远程调用(rpc)浏览器方法，免去抠代码补环境

use-inject. injection-js hooks in react

js-cookie-monitor-debugger-hook. js cookie逆向利器：js cookie变动监控可视化工具 & js cookie hook打条件断点

js-script-hook. Script Hook

JS_reverse. 小红书、抖音等逆向demo

js-reverse. JS逆向研究

SliderCracker. 滑块验证码纯 js 破解 [极验2] [美团] [安居客] [京东] [易盾] [云片] [数美] [携程] [搜狐] [虎牙] [爱奇艺]

Crack-JS-Spider. JS破解逆向，破解JS反爬虫加密参数，已破解极验滑块w（2022.2.19），QQ音乐sign（2022.2.13），拼多多anti_content，boss直聘zp_token，知乎x-zse-96，酷狗kg_mid/dfid，唯品会mars_cid，中国裁判文书网（2020-06-30更新），淘宝密码，天安保险登录，b站登录，房天下登录，WPS登录，微博登录，有道翻译，网易登录，微信公众号登录，空中网登录，今目标登录，学生信息管理系统登录，共赢金融登录，重庆科技资源共享平台登录，网易云音乐下载，一键解析视频链接，财联社登录。

spider_draft. 各种网站的登陆破解，仅供交流学习，包括：126邮箱,17173,189邮箱,360登录中心,37玩,39健康,51游戏,58同城,bilibili,YY直播,一加手机,中国移动,九游,今日头条,企查查,优酷视频,信息公示系统,凤凰网,去哪儿,启信宝,和讯网,咪咕视频登录,唯品会,喜马拉雅,国美,大众点评,大麦网,天眼查,好豆菜谱,宜贷网,小米商城,开源中国,微博,恒信易贷,房天下,搜房帮,搜狐,搜狐视频,搜狗翻译,斗鱼,新华电子邮局,易车网,有赞网,淘宝,爱企查,爱应用,猫眼,珍爱网,百家号,空中网,筑龙学社,粉笔网,纵横小说网,网易,美团,老k游戏,联通营业厅,聚惠商城,芒果TV,虎牙,豆瓣,途牛,逗游网,金牛理财,问卷星,阿里云,风行网,飞卢小说网,魅族、、、

js-hook. 解析 JavaScript 的 AST，添加自定义的钩子

spider-js-reverse. 精选不同站点的JS逆向实例，内含详细讲解，并辅以知识点概括、加密算法、难度对比与链接跳转。涵盖补环境、扣JS、webpack与瑞数等诸多难点

jQuery-hook. 用于快速定位使用jQuery绑定到DOM元素上的事件的代码的真实位置，辅助逆向分析。

SpiderAPI. SpiderApi - 虫术 - 爬虫逆向常用 API

ast-hook-for-js-RE. 浏览器内存漫游解决方案（探索中...）

Brute-Ratel-C4.

nmmp. dex-vm used to protect the android classes.dex file

pyautogui. A cross-platform GUI automation Python module for human beings. Used to programmatically control the mouse & keyboard.

nano. 🔥🔥🔥 Android SO file compression framework designed to reduce the size of shared object (SO) files within APK or AAB files

wxmp. 微信公众号文章 Markdown 编辑器，使用 markdown 语法创建一篇简介美观大方的微信公众号图文。

impacket. Impacket is a collection of Python classes for working with network protocols.

WDACTools. A PowerShell module to facilitate building, configuring, deploying, and auditing Windows Defender Application Control (WDAC) policies

XcodeGen. A Swift command line tool for generating your Xcode project

gsocket. Connect like there is no firewall. Securely.

evtx. A Fast (and safe) parser for the Windows XML Event Log (EVTX) format

Hells-Hollow. Hells Hollow Windows 11 Rootkit technique to Hook the SSDT via Alt Syscalls

crawlee. Crawlee—A web scraping and browser automation library for Node.js to build reliable crawlers. In JavaScript and TypeScript. Extract data for AI, LLMs, RAG, or GPTs. Download HTML, PDF, JPG, PNG, and other files from websites. Works with Puppeteer, Playwright, Cheerio, JSDOM, and raw HTTP. Both headful and headless mode. With proxy rotation.

FakeSIP. Disguise your UDP traffic as SIP protocol to evade DPI detection, using Netfilter Queue (NFQUEUE).

firecrawl. The API to search, scrape, and interact with the web at scale. 🔥

examples-of-web-crawlers. 一些非常有趣的python爬虫例子,对新手比较友好,主要爬取淘宝、天猫、微信、微信读书、豆瓣、QQ等网站。(Some interesting examples of python crawlers that are friendly to beginners. )

portia. Visual scraping for Scrapy

airflow. Apache Airflow - A platform to programmatically author, schedule, and monitor workflows

puppeteer. JavaScript API for Chrome and Firefox