#1Tools for analyzing RAM dumps to find running processes, network connections, and hidden malware.
Kitploit recommended
ikow/php2shell-pocCVE-2026-109618/109619 PHP session.upload_progress Exploit Research — POC & Analysis
akatorich/kernelflirtWindows kernel-level debugger with OllyDbg/IDA-style UI, software and hardware breakpoints, PDB symbols, decompiler, and 17 plugins for reverse…
9bie/php2shell-bypass-aslr-expPure-HTTP exploit achieving RCE on PHP 8.4.26 + Apache mod_php via session upload_progress heap leak, dangling pointer reuse, and ASLR bypass to call…
ccp-p/ghostlock-cve-2026-43499-4.19-k40Android kernel LPE PoC for CVE-2026-43499, an rtmutex use-after-free in 4.19 Qualcomm kernels, adapted for Redmi K40 with LD_PRELOAD root payload.
winsiderss/systeminformerReal-time Windows system monitor with advanced process, network, and disk analysis, stack trace debugging, malware detection, and service management.…
x64dbg/x64dbgAn open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.
radareorg/radare2UNIX-like reverse engineering framework and command-line toolset
hasamba/dfir-companionDFIR forensics companion server + capture extension
zenyxx-xd/rootmyvivo-exploitGhostLock (CVE-2026-43499) exploit fork for RootMyVivo Neo — iQOO Neo 11 (PD2520, SM8750, 6.6.89). For authorized research on own devices only.
werwolv/imhex🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
pdb333/cortexA Windows runtime analysis toolkit combining memory scanning, debugging, automation, and AI-friendly APIs.
theflink/deepsleepA variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC
jazho76/house_of_apple_2Interactive GDB walkthrough of the House of Apple 2 FSOP technique on glibc 2.43, with a reproducible sandbox covering vtable bypass, stack pivoting,…
nationalsecurityagency/ghidraGhidra is a software reverse engineering (SRE) framework
bert-janp/incident-response-powershellPowerShell-based incident response toolkit that collects 25+ forensic artifacts (processes, network connections, registry, browser history) and…
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
