#1Tools for dissecting, understanding, and reverse engineering malicious software behavior.
Kitploit recommended
elastic/labs-releasesElastic Security Labs releases
nathan-luevano/silicaExhaustive differential validation of all 4.3B AArch64 instruction encodings.
owasp/owasp-java-encoderThe OWASP Java Encoder is a Java 1.5+ simple-to-use drop-in high-performance encoder class with no dependencies and little baggage. This project will…
rizinorg/cutterFree and Open Source Reverse Engineering Platform powered by rizin
xiaoqimikko/netty-resolver-dns-checkOffline static checker that inspects packaged Java jars for vulnerable netty-resolver-dns versions and detects whether Spring WebClient actually uses…
voidsecsoftwares/voidsyscallCross-platform syscall-powered implant & C2 — direct syscalls (Win), raw syscalls (Linux), HTTPS/DNS/ICMP channels. No winapi layer.
hunt-benito/the-callback-that-outlived-the-page-cve-2026-78997-uc-browser-android-universal-xssPoC for CVE-2026-78997, a Universal XSS in UC Browser for Android. Includes a crafted URL builder, a callback-dispatch oracle, and Frida hooks to…
themalwareguardian/uefi-security-research-howyar-sysreturn-netcopyPost CVE-2024-7344 analysis of Howyar SysReturn NetCopy - reverse engineering notes, vulnerable binaries, vendor correspondence, and proof-of-concept…
themalwareguardian/cve-2026-79298Research repository documenting CVE-2026-79298, an incomplete UEFI Secure Boot bypass remediation in Howyar SysReturn's IA-32 boot path, with reverse…
kerlenton/mcpsnoopWireshark for MCP. A transparent proxy that shows every real tool call between your AI client and your MCP servers, live in your terminal.
eskatos/creadur-rat-gradleApache RAT (Release Audit Tool) Gradle Plugin
squeeze440/obsidian-note-toolbar-pocPoC — frontmatter-driven arbitrary JavaScript execution in Note Toolbar for Obsidian (GHSA-q8cw-3m8c-5pf2, CVE-2026-87002, CVSS 7.0).
fkie-cad/fact_coreFirmware Analysis and Comparison Tool
iss4cf0ng/openpetyaA Proof-of-Concept bootkit and UEFI boot application inspired by Petya ransomware, written in Assembly, C, and C++
vighnesh91/omnisec-hexBrowser-local security monorepo with six modules for mobile APK/IPA triage, client-side DAST fuzzing, OSINT directories, offline AI threat scoring,…
cookiengineer/exocompSelf-hosted multi-agent environment for Go with LLM-powered pentesting agents (exploiter, reverser, threathunter, webscanner) that automate…
fencesandbox/fenceLightweight, container-free sandbox for running commands with network and filesystem restrictions
mentebinaria/retoolkitPre-configured bundle of reverse engineering and malware analysis tools for x86/x64 Windows systems, with desktop integration and plugin-ready…
