#2Tools for observing malware behavior in isolated environments to understand its actions and impact.
Kitploit recommended
nccgroup/mnemosyneA Generic Windows Memory Scraping Tool
redcanaryco/ebpfmonTerminal UI for real-time monitoring and inspection of eBPF programs and maps using bpftool, enabling live debugging and analysis of kernel-level…
jp/hermes-proxyHermes Proxy - HTTP Traffic Analyzer
theshinigami/mafridaA Magisk module that simplifies running the Frida server on Android, with easy management commands to download specific versions, enable or disable…
vichhka-git/universal-flutter-ssl-pinningAutomated SSL pinning bypass for any Flutter & Shorebird version — PyGhidra static analysis auto-discovers BoringSSL and generates ready-to-run Frida…
crissyfield/super-trouperMCP server exposing Frida instrumentation as tools for coding agents to connect to devices, inspect processes, manage sessions, and load JavaScript…
nccgroup/psrPointer Sequence Reverser - enable you to see how Windows C++ application is accessing a particular data member or object.
trailofbits/manticoreuiThe Manticore User Interface with plugins for Binary Ninja and Ghidra
0x534a/dynmxSignature-based detection of malware features based on Windows API call sequences. It's like YARA for sandbox API traces!
awrped/splinterRuntime JVM analysis toolkit for inspecting classes, methods, fields, constant pool, and bytecode
checkpointsw/nodejs-tracerRuntime tracer for Node.js malware analysis that hooks core modules, logs calls, spoofs anti-analysis checks, and captures file writes and HTTP…
b9ph0met/px-vmReverse engineering toolkit for PerimeterX's bytecode VM, featuring a CFG-based disassembler, 5-layer decryption pipeline, opcode table…
capsulerun/vpodLightweight, secure Linux sandboxes for untrusted processes. Runs in the browser and on the server.
hackinglz/maps_scannerMAPS cloud scanner and response parser for Microsoft Defender research.
angelorc/vmsanFirecracker made simple. Spin up secure microVMs in milliseconds, from install to interactive shell in one command.
catern/rsyscallProcess-independent interface to Linux system calls
mathaix/openclawmachinesManage OpenClaw in your team (Enterprise) by providing it compute infrastructure, tool integration, Authentication and security primitives
blacksnufkin/cheshireAdaptix C2 service plugin that drives LitterBox payload analysis from the operator UI.
