#2Tools for observing malware behavior in isolated environments to understand its actions and impact.
Kitploit recommended
jstrosch/subparseModular malware analysis artifact collection and correlation framework
mnrkbys/norimaciLightweight macOS malware analysis sandbox that monitors system activity via OpenBSM or Monitor.app, generating detailed reports and timelines of…
malpedia/malpedia-flossedFLARE floss applied to all unpacked+dumped samples in Malpedia, pre-processed for further use.
st0rn/siglensWindows artifact analysis toolkit that maps AV detections to PE offsets, sections, RVA/VA and strings, with YARA, AMSI, capa and multi-engine…
freeqaz/react2shellRCE exploit toolkit for CVE-2025-55182 and CVE-2025-66478 in React Server Components. Includes multiple exploit variants, detection scripts, a…
s4dhulabs/vimana-frameworkVimana is a modular security framework for auditing Python APIs and Web applications. The plugin-based architecture enables security professionals to…
kishorbal/deep-cAndroid deeplink misconfiguration detector and exploitation tool
matank001/moxyMoxy is an open-source DAST tool designed for modern web application security testing. It provides an easy-to-use interface with agentic capabilities…
danieldev23/frida-ssl-bypassFrida toolkit that bypasses SSL/TLS certificate pinning on Android apps, hooking Java TrustManager, OkHttp, Conscrypt, and native OpenSSL/BoringSSL…
deepbluedynamics/grubcrawlerThe world's fastest agentic crawler. Reclaimed. Reinvented. Ready for war.
go-appsec/toolboxCollaborative application security testing between humans and agents via CLI and MCP
0x4ndy/clifclif is a command-line interface (CLI) application fuzzer, pretty much what wfuzz or ffuf are for web. It was inspired by sudo vulnerability…
duriantaco/ravageEvidence first autonomous web security testing for controlled, authorized targets. With reproducible labs, audit trails, reports, and XBEN…
s4dp4nd4/frida-c2-mcpAgentic C2-style MCP server for Frida instrumentation on rooted Android and jailbroken iOS.
redsection/jspandaclient-side prototype pullution vulnerability scanner
zypherion-technologies/nemesis.NET process monitor that hooks CLR at the native layer, dumps reflective assemblies from memory, and checks AMSI/ETW integrity vs on disk binaries.
googleprojectzero/maccconcToolkit for exploring Linux kernel race conditions using KCOV traces: GUI and terminal viewers for concurrent execution and memory access, plus…
fcavallarin/burp-dom-scannerBurp Suite's extension to scan and crawl Single Page Applications
