#1Tools for dissecting, understanding, and reverse engineering malicious software behavior.
Kitploit recommended
gojue/ecaptureCapturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64.
corgea/sighthoundTree-sitter based static vulnerability scanner with pattern matching and taint-flow analysis for multi-language source code. Outputs findings as…
threatray/threat-researchIoCs and YARA rules from Threatray's Threat Research
dbrll/ll-34Circuit-level PDP-11/34 emulator
x-3306/project-onyxAdvanced EDR Evasion via AI Telemetry Spoofing & WASM Sandboxing. Project Onyx is a PoC Red Team pipeline designed to demonstrate advanced evasion…
zaproxy/zaproxyOpen-source web application security scanner for automated vulnerability detection, manual penetration testing, and API security testing with a…
misp/mispMISP (core software) - Open Source Threat Intelligence and Sharing Platform
upx/upxUPX - the Ultimate Packer for eXecutables
mwemuorg/mwemuPure Rust x86 hardware emulator and Windows process simulator for malware analysis, shellcode emulation, and payload unpacking. Supports 32/64-bit PE…
veridiff/veridiffDynamic branch-divergence finder for native code -- traces two Frida executions and finds the exact instruction where they diverge.
elastic/protections-artifactsElastic Security detection content for Endpoint
aikidosec/safe-chainProtect against malicious code installed via npm, yarn, pnpm, npx, pnpx, pip, uv and poetry with Aikido Safe Chain. Free to use, no tokens required.
sensepost/objectionFrida-powered runtime mobile exploration toolkit for assessing iOS and Android app security. Bypass SSL pinning, dump keychains, manipulate heap…
ossillate-inc/packjStatic and dynamic analysis tool that audits open-source packages for malicious, vulnerable, and risky attributes, with sandboxed installation to…
shivammittal2403/cve-2026-59827-metabase-cyber-rangeEducational cyber range for CVE-2026-59827 (Metabase H2 unsafe deserialization / CWE-502). Isolated Docker lab — training only, not for attacking…
mayank729/cve-2025-55182-scanner🔍 Scan for CVE-2025-55182 risks in React Server Components with this non-intrusive tool that helps detect critical vulnerabilities in your…
yukonga/ghostlock-appGhostLock One-Tap Execution App (CVE-2026-43499)
danieldev23/frida-ssl-bypassFrida toolkit that bypasses SSL/TLS certificate pinning on Android apps, hooking Java TrustManager, OkHttp, Conscrypt, and native OpenSSL/BoringSSL…
