duckie

platform. The Open Binary Project full platform including OpenAPK.AI

decomp.me. Collaborative decompilation and reverse engineering website

theharbinger. Sane policies for insane agents

aixcc-afc-atlantis. C

NovaHypervisor. Windows hypervisor for Intel x64: defensive host hypervisor for Windows designed to mitigate kernel-level attacks including BYOVD, compatible with VMware and Hyper-V.

xserver. XLibre Xserver

gopacker. UPX-like packer written in Go

Ekko. Sleep Obfuscation

Terminator. Reproducing Spyboy technique to terminate all EDR/XDR/AVs processes

FOLIAGE. Experiment on reproducing Obfuscate & Sleep

Cronos. PoC for a sleep obfuscation technique leveraging waitable timers to evade memory scanners.

ja4. JA4+ is a suite of network fingerprinting standards

docker2exe. Convert a Docker image to an executable

rmtrd. a kernel mode solution for detecting and prevent malicious threads creation in target process

SpacetimeDB. Development at the speed of light

siftrank. Use LLMs to rank anything

asm-lessons. FFmpeg Assembly Language Lessons

SC-900. Study guide for the SC-900: Microsoft Security, Compliance, and Identity

vulnerable_linux_driver. An intentionally vulnerable linux driver for research purposes/practice in kernel exploit dev

waydroid. Waydroid uses a container-based approach to boot a full Android system on a regular GNU/Linux system like Ubuntu.

The-Art-of-Problem-Solving-in-Software-Engineering_How-to-Make-MySQL-Better. The Art of Problem-Solving in Software Engineering: How to Make MySQL Better

DnsServer. Technitium DNS Server

duck_chat. Reverse engineered DuckDuckGo AI chat API client.

hey. A DuckDuckGo AI chat client

fortios-auth-bypass-check-CVE-2024-55591. Python

pdfdoom. DOOM in a PDF (as ascii art)

cotp. Encrypted, command-line TOTP/HOTP authenticator app with import functionality.

paradedb. One Postgres for your application data, full-text search, vector retrieval, and aggregations. Home of the pg_search extension.

Injector. Command line utility to inject and eject DLLs

Hunt-Sleeping-Beacons. Aims to identify sleeping beacons

markitdown. Python tool for converting files and office documents to Markdown.

RustSoliloquy. A Rust implementation of Internal-Monologue — retrieving NetNTLM hashes without touching LSASS, leveraging SSPI for NTLM negotiation and indirect NTAPIs for core operations.

CVE-2024-48990-PoC. PoC for CVE-2024-48990

Hunting-Queries-Detection-Rules. KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

CVE-2024-47176. Scanner

createdump. Leverage WindowsApp createdump tool to obtain an lsass dump

arancino. Arancino is a dynamic protection framework that defends Intel Pin against anti-instrumentation attacks.

binsider. Analyze ELF binaries like a boss 😼🕵️‍♂️

edr-artifacts. This repository is meant to catalog network and host artifacts associated with various EDR products "shell" and response functionalities.

semantic-grep. grep for words with similar meaning to the query

IHxExec. Process injection alternative

dotfiles. Lua

Red-Team-Infrastructure-Wiki. Wiki to collect Red Team infrastructure hardening resources

tau. Fullstack Workspace for Humans & Machines

tegon. Tegon is an open-source, dev-first alternative to Jira, Linear

dashy. 🚀 A self-hostable personal dashboard built for you. Includes status-checking, widgets, themes, icon packs, a UI editor and tons more!

vector. A high-performance observability data pipeline.

Forums-For-RFI. Data breaches, Leaks, Malwares Forums List <Please Use Vpn/TOR don't click on Link directly bad OPSEC>

diff-pdf. A simple tool for visually comparing two PDF files

docmost. Docmost is an open-source collaborative wiki and documentation software. It is an open-source alternative to Confluence and Notion.

triplit. A full-stack, syncing database that runs on both server and client. Pluggable storage (indexeddb, sqlite, durable objects), syncs over websockets, and works with your favorite framework (React, Solid, Vue, Svelte).

reverser_ai. Provides automated reverse engineering assistance through the use of local large language models (LLMs) on consumer hardware.

eidos. An extensible framework for Personal Data Management.

Dumpert. LSASS memory dumper using direct system calls and API unhooking.

InsightEngineering. Hardcore Debugging

dyninst. DyninstAPI: Tools for binary instrumentation, analysis, and modification.

HackSysExtremeVulnerableDriver. HackSys Extreme Vulnerable Driver (HEVD) - Windows & Linux

C2-Tracker. Live Feed of C2 servers, tools, and botnets

worklenz. All in one project management tool for efficient teams

quickemu. Quickly create and run optimised Windows, macOS and Linux virtual machines

quary. Open-source BI for engineers

textbee. open-source sms-gateway. turn any android phone into an sms gateway

llum. A fast, light, open chat UI with full tool use support across many models

nsh. The Noisy Sockets CLI

pcap-did-what. Analyze pcaps with Zeek and a Grafana Dashboard

pwntools. CTF framework and exploit development library

opensecurity. opensecurity: open-source security and compliance. See and secure your cloud, containers, code, networks, deployments, devices. Define your rules, get precise checks, fix gaps fast. Streamlined audits. No fluff.

univer. Univer is a full-stack framework for creating and editing spreadsheets / word processor / presentation on both web and server.

typesense. Open Source alternative to Algolia + Pinecone and an Easier-to-Use alternative to ElasticSearch ⚡ 🔍 ✨ Fast, typo tolerant, in-memory fuzzy Search Engine for building delightful search experiences

anime.gf. Local & Open Source Alternative to CharacterAI

nimfilt. A collection of modules and scripts to help with analyzing Nim binaries

tabby. Self-hosted AI coding assistant

lunatik. Lunatik is a framework for scripting the Linux kernel with Lua.

go-mtpfs. Mount MTP devices over FUSE

meilisearch. A lightning-fast search engine API bringing AI-powered hybrid search to your sites and applications.

desbordante-core. Desbordante is a high-performance data profiler that is capable of discovering many different patterns in data using various algorithms. It also allows to run data cleaning scenarios using these algorithms. Desbordante has a console version and an easy-to-use web application.

firecracker. Secure and fast microVMs for serverless computing.

old-ada-mode. This is a fork of the old version of ada-mode.el that was distributed with Emacs.

opencti. Open Cyber Threat Intelligence Platform

lago. Open Source Metering and Usage Based Billing API ⭐️ Consumption tracking, Subscription management, Pricing iterations, Payment orchestration & Revenue analytics

neko-rooms. Selfhosted collaborative browser - room management for n.eko

vercel. Develop. Preview. Ship.

OpenFactVerification. Loki: Open-source solution designed to automate the process of verifying factuality

emba. EMBA - The firmware security analyzer

wireproxy. Wireguard client that exposes itself as a socks5 proxy

duplex. Full duplex modern RPC

localtunnel. Expose localhost servers to the Internet

xz-backdoor-documentation. Documentation about the xz backdoor created by #xz-backdoor-reversing

portr. Expose local http, tcp or websocket connections to the public internet

heyform. Open-Source Form Builder

xzbot. notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094)

hollows_hunter. Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

revng-c. C++

hunting-rules. Suricata rules for network anomaly detection

tracecat. Open-source security automation platform for teams and AI agents

wirequery. WireQuery is the first full-stack session replay and API call exploration tool. Using WireQuery, you get a holistic overview of how an issue came into existence.

lapdev. Seamless dev environments for Kubernetes

bcc. BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more

memories. Fast, modern and advanced photo management suite. Runs as a Nextcloud app.

RETools. My reversing tools. Some custom, some not.

kubekit. kubernetes rootkit

neko. A self hosted virtual browser that runs in docker and uses WebRTC.

BrowserBox. 💚🇺🇸🗽Secure remote browsing anywhere, any way you like it.

puter. 🌐 The Internet Computer! Free, Open-Source, and Self-Hostable.

EDR-Telemetry. This project aims to compare and evaluate the telemetry of various EDR products.

iocextract. Defanged Indicator of Compromise (IOC) Extractor.

ohmyform. ✏️ Free open source alternative to TypeForm, TellForm, or Google Forms ⛺

mitmproxy. An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.

storm. Simple and powerful toolkit for BoltDB

coraza-traefik. Go

coraza-caddy. OWASP Coraza middleware for Caddy. It provides Web Application Firewall capabilities

coraza. OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

reor. Private & local AI personal knowledge management app for high entropy people.

thunder. An open-source cross-platform Lemmy & PieFed client for iOS and Android

ZealOS. The Zeal Operating System is a modernized fork of the 64-bit Temple Operating System, TempleOS.

NetExec. The Network Execution Tool

goph. 🤘 The native golang ssh client to execute your commands over ssh connection. 🚀🚀

email. Robust and flexible email library for Go

awesome-startup. :sunglasses: All the required resources to build your own startup

hashmap.c. Hash map implementation in C.

twenty. The open alternative to Salesforce, designed for AI.

PowerParse. PowerShell PE Parser

Jatayu-SearchEngine. Jatayu is an open source federated search engine that respects your privacy and takes no personal data from your machine. The search engine is implemented using golang and elastic search. The search engine further employs a custom written crawler that crawlers all the links present on the given webpage/website, that can later be used to search through.

tailadmin-free-tailwind-dashboard-template. Free and Open-source Tailwind CSS Dashboard Admin Template that comes with all essential dashboard UI components, pages and elements

vti-dorks. Awesome VirusTotal Intelligence Search Queries

RedEye. RedEye is a visual analytic tool supporting Red & Blue Team operations

school-of-sre. At LinkedIn, we are using this curriculum for onboarding our entry-level talents into the SRE role.

awesome-soc-analyst. Useful resources for SOC Analyst and SOC Analyst candidates.

Bochs. Bochs - Cross Platform x86 Emulator Project

phnt. Native API header files for the System Informer project.

sc. Common libraries and data structures for C.

security-research. This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.

terraform-provider-esxi. Terraform-provider-esxi plugin

at-ps. Adversary Tactics - PowerShell Training

binsec. BINSEC binary-level open-source platform

universal-android-debloater. Cross-platform GUI written in Rust using ADB to debloat non-rooted android devices. Improve your privacy, the security and battery life of your device.

malwoverview. Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.

HackSpaceCon_Malware_Analysis_Course. Free training course offered at Hack Space Con 2023

elevationstation. elevate to SYSTEM any way we can! Metasploit and PSEXEC getsystem alternative

Run-in-Sandbox. Run PS1, VBS, CMD, EXE, MSI, Intunewin, MSIX, or extract ISO, ZIP in Windows Sandbox very quickly just from a right-click

signatures. Community Detection Signature Build and Distribution Pipeline for YARA, Suricata, Snort and Sigma

RendezvousRAT. Self-healing RAT utilizing libp2p

HeadlessBrowsers. A list of (almost) all headless web browsers in existence

HackBrowserData. Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).

Quick-Analysis. Quick analysis focusing on most important of a Malware or a Threat

WinPwn. Windows Pwnable Study

PyInstaLive. Python script to download Instagram livestreams.

EPI. Threadless Process Injection through entry point hijacking

AdGuardian-Term. 🛡️ Terminal-based, real-time traffic monitoring and statistics for your AdGuard Home instance

json.h. 🗄️ single header json parser for C and C++

GhidRust. GhidRust: Rust decompiler plugin for Ghidra

haproxy_ddos_protector. DDoS protection system PoC for HaProxy

Active-Directory-Pentest-Notes. 个人域渗透学习笔记

pesieve-go. Golang bindings for PE-sieve

Confusables. Simple library for matching a string to another string that is same but has letters that only *look* the same as original string

sniffnet. Comfortably monitor your Internet traffic 🕵️‍♂️

progress. Linux tool to show progress for cp, mv, dd, ... (formerly known as cv)

awesome-edr-bypass. Awesome EDR Bypass Resources For Ethical Hacking

clfs-docs. Unofficial Common Log File System (CLFS) Documentation

CVE-2022-21894. baton drop (CVE-2022-21894): Secure Boot Security Feature Bypass Vulnerability

awesome-ebpf. A curated list of awesome projects related to eBPF.

LOLBITS. ** DISCONTINUED ** C2 framework that uses Background Intelligent Transfer Service (BITS) as communication protocol and Direct Syscalls + Dinvoke for EDR user-mode hooking evasion.

Nidhogg. Windows rootkit for Intel x64 with 25+ features, demonstrating rootkit techniques compatible with all Windows 10 and Windows 11 versions.

MemProcFS. MemProcFS

strelka. Real-time, container-based file scanning at enterprise scale

acheron. indirect syscalls for AV/EDR evasion in Go assembly

Malware-Analysis.

PowerShell-Obfuscation-Bible. A collection of techniques, examples and a little bit of theory for manually obfuscating PowerShell scripts to achieve AV evasion, compiled for educational purposes. The contents of this repository are the result of personal research, including reading materials online and conducting trial-and-error attempts in labs and pentests.

vbulletin-exploits. Exploits targeting vBulletin.

EDRs. C

awesome-game-security. awesome game security [Welcome to PR]

leptos. Build fast web applications with Rust.

c.php. C to Python compiler in PHP

wanderer. An open-source process injection enumeration tool written in C#

format-corpus. An openly-licensed corpus of small example files, covering a wide range of formats and creation tools.

sok-dbi-security. Library to hide DBI artifacts when using Intel Pin. Code from the ASIA CCS 2019 paper "SoK: Using Dynamic Binary Instrumentation for Security (And How You May Get Caught Red Handed)"

diagrams. :art: Diagram as Code for prototyping cloud system architectures

awesome-privacy. Awesome Privacy - A curated list of services and alternatives that respect your privacy because PRIVACY MATTERS.

wails. Create beautiful applications using Go

EfiGuard. Disable PatchGuard and Driver Signature Enforcement at boot time

awesome-threat-detection. ✨ A curated list of awesome threat detection and hunting resources 🕵️‍♂️

macOS-Simple-KVM. Tools to set up a quick macOS VM in QEMU, accelerated by KVM.

osx-re-101. A collection of resources for OSX/iOS reverse engineering.

pty. PTY interface for Go

tiny_tracer. A Pin Tool for tracing API calls etc

witty. Web-based interactive terminal emulator that allows users to easily record, share, and replay console sessions.

webterm. web terminal based on xterm.js in rust

gotty. Share your terminal as a web application

cloudshell. Xterm.js with a Go backend meant for use in containers

OffensiveRust. Rust Weaponization for Red Team Engagements.

bluepill. BluePill: Neutralizing Anti-Analysis Behavior in Malware Dissection (Black Hat Europe 2019, IEEE TIFS 2020)

sshwifty. Web SSH & Telnet (WebSSH & WebTelnet client) 🔮

Rust. All Algorithms implemented in Rust

drltrace. Drltrace is a library calls tracer for Windows and Linux applications.

msticpy. Microsoft Threat Intelligence Security Tools

PINdemonium. A pintool in order to unpack malware

Prompt-Engineering-Guide. 🐙 Guides, papers, lessons, notebooks and resources for prompt engineering, context engineering, RAG, and AI Agents.

pe-sieve. Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

Hover. A collection of CSS3 powered hover effects to be applied to links, buttons, logos, SVG, featured images and so on. Easily apply to your own elements, modify or just use for inspiration. Available in CSS, Sass, and LESS.

Hachi. This tool maps a file's behavior on MITRE ATT&CK matrix.