#1Tools for analyzing RAM dumps to find running processes, network connections, and hidden malware.
Kitploit recommended
nccgroup/zipdefragPresented at Recon Montreal 2018
baba01hacker666/cve-2026-23111Linux Kernel nf_tables Use-After-Free (CVE-2026-23111) — LPE PoC
chainmanner/gzdoom-arbitrary-code-execution-via-zscript-pocProof of concept for CVE-2024-54756, a vulnerability I found in GZDoom's ZScript scripting engine.
axlan/fatal_core_dumpA core dump debugging murder mystery.
farazsth98/freebsd-dirent-info-leak-bugsCVE-2020-25578 and CVE-2020-25579: Some FreeBSD info leak bugs I found in 2020.
jazho76/house_of_apple_2Interactive GDB walkthrough of the House of Apple 2 FSOP technique on glibc 2.43, with a reproducible sandbox covering vtable bypass, stack pivoting,…
4d4j/cormem-read-pocThis tool demonstrates CVE-2026-38194, a vulnerability in Teledyne Digital Imaging Sapera Memory Manager (v9.0.0.0 and below). The CORMEM.SYS kernel…
atorninja/cve-2019-2215PoC and analysis of CVE-2019-2215, a use-after-free in Android Binder, with kernel instrumentation and exploit tuning for affected Samsung devices.
dorkerdevil/cve-2020-28018Exploit for Exim Use-After-Free (CVE-2020-28018) achieving remote code execution via memory corruption primitives, including arbitrary read/write and…
szymonh/rndis-coCVE-2022-25375 - Demo exploit of RNDIS USB Gadget
jaf0rk/cve-2026-14382Proof-of-concept exploit for CVE-2026-14382, a high-severity ANGLE vulnerability in Chromium, with 32-bit and AArch64 PoCs achieving program counter…
ramenfast/zenfone9-rootTemporary root (uid 0) on a bootloader-locked ASUS Zenfone 9 via CVE-2025-21479 + a perf-based physical-address leak. GPLv3.
kaandemir993/dropper-gcleaner-c2-infrastructure-kernel-driver-powershell-conhost-payload-analysisReverse engineering analysis of Dropper GCleaner, a malware that uses a resilient C2 infrastructure, kernel driver loading, PowerShell/Conhost…
sijido/cve-2022-22947Python-based memory shell injection tool for CVE-2022-22947, supporting Spring, Netty, and Godzilla memory shells with simple CLI usage.
amberchalia/norm-edrExperimental kernel-mode EDR research project focused on explainable detection of suspicious in-memory execution patterns, producing human-readable…
ic3-512/linux-root-kitEnd-to-end simulation of a Python dependency confusion attack, sudo privilege escalation (CVE-2025-32463), and rootkit-based persistence - with full…
v31l0x1/throttlestoppplPoc for CVE-2025-7771 to modify PPL Protection
0xblackash/cve-2026-43499CVE-2026-43499
