#1Tools for analyzing and securing firmware, microcontrollers, and low-level hardware components.
Kitploit recommended
qkaiser/broadcom-wpsTools to fingerprint WiFi Access Points running the Broadcom SDK and a list of known affected devices.
yasindce1998/barzakhRing -4 to Ring 0: offense-defense firmware research platform. We build the bootkits, then we catch them. Closed-loop. Zero trust in silicon.
cplusplus17/deco-filepush-disclosureDisclosure and PoC for a root file read/write flaw in the TP-Link Deco XE75 Pro V3 debug channel (tmpsvr opcodes 0xC456/0xF0), with CVSS analysis and…
c8dhjp4tyv-bit/jbl-wave-buds2-firmware-researchReverse-engineering notes and Python tooling for JBL Wave Buds 2 (BES1306) firmware: OTA container format, flash layout, BLE/GATT protocol, and…
newbe3e/pwn2own-automotive-2026-alpine-ilx-f511-0-click-rce-exploit-writeupThis is a write up of the exploit I developed for the Pwn2Own Automotive 2026 competition.
abraxas/sonic-gnmi-noauthDocuments and reproduces a fail-open authentication flaw in SONiC gNMI where an empty UserAuth map allows unauthenticated gNMI Set and gNOI writes,…
greatscottgadgets/facedancerImplement your own USB device in Python, supported by a hardware peripheral such as Cynthion or GreatFET
emenstanougat/esp32-bluejammerESP32 and nRF24 based 2.4GHz jammer that disrupts Bluetooth, BLE, WiFi, and RC channels via noise and packet flooding for controlled security testing.
jihoonjang98/hqc-x86-simdOptimized HQC post-quantum KEM implementations for AVX2 and AVX-512 with GFNI, plus a unified benchmarking and NIST KAT suite for x86 IoT gateways.
wolfssl/wolfsshSmall, portable embeddable SSHv2 client and server library in C with SCP, SFTP, port forwarding, and post-quantum key exchange for embedded and IoT…
bignerd95/chimay-redWorking POC of Mikrotik exploit from Vault 7 CIA Leaks
qmonnet/rbpfRust virtual machine and JIT compiler for eBPF programs
vulncheck-oss/cisco-ios-xe-implant-scannerGo-based scanner that detects implanted Cisco IOS XE systems by sending crafted HTTP requests to identify compromised devices and vulnerable versions.
j-baines/even-you-brutusDictionary Brute Force of the Mikrotik RouterOS 6.x Web Interface
microsoft/routeros-scannerTool to scan for RouterOS (Mikrotik) forensic artifacts and vulnerabilities.
therealsaumil/static-arm-binsStatically compiled ARM binaries for debugging and runtime analysis
superkhung/luadec-tplinkModified luadec version to decompile TP-Link Archer C7 LUA firmware.
wheregoes/byd-dolphin-hackingReverse engineering the BYD Dolphin head unit — CAN bus, AVAS, NFC keys, OTA, and more. DiLink 3 / Android 10.
