#1Tools for creating and managing isolated environments (VMs, containers) for security testing and malware analysis.
Kitploit recommended
mandiant/commando-vmCustomizable Windows-based virtual machine distribution pre-packaged with offensive security tools for penetration testing and red teaming operations.
trustsig-eu/wasm2c-tableflipwasm2c sandbox escape. An untrusted WebAssembly module breaks out of the generated C sandbox and executes an arbitrary shell command on the host.
momo5502/sogen🪅 Windows & Linux userspace emulator
patriksimek/vm2Isolated JavaScript sandbox for Node.js that runs untrusted code with restricted access to built-in modules and host resources via Proxy-based…
rapid7/metasploitable3Metasploitable3 is a VM that is built from the ground up with a large amount of security vulnerabilities.
usbarmory/tamagoFramework for compiling and executing Go applications on bare metal processors, enabling secure firmware development with reduced attack surface…
dylan-chainguard/cve-2026-22732-pocProof-of-concept demonstrating CVE-2026-22732, a Spring Security flaw where setIntHeader("Content-Length") drops all security headers, with…
qemu/qemuOfficial QEMU mirror. Please see https://www.qemu.org/contribute/ for how to submit changes to QEMU. Pull Requests are disabled. Please only use…
beelzebub-labs/beelzebubA secure low code deception runtime framework, leveraging AI for System Virtualization.
nestybox/sysboxAn open-source, next-generation "runc" that empowers rootless containers to run workloads such as Systemd, Docker, Kubernetes, just like VMs.
leaningtech/webvmClient-side Linux virtual machine running in the browser via WebAssembly, with Tailscale networking, Dockerfile-based custom images, and CTF…
bara-almustafa/cve-2026-34990-pocCVE-2026-34990 — CUPS <= 2.4.16 Local Privilege Escalation
atiilla/cve-2026-2441_pocProof-of-concept exploit for CVE-2026-2441, demonstrating the vulnerability and providing a working exploit for security testing and validation.
capsulerun/vpodLightweight, secure Linux sandboxes for untrusted processes. Runs in the browser and on the server.
jingkaihe/matchlockEphemeral microVM sandbox for AI agents with network allowlisting, secret injection via MITM proxy, and VM-level isolation. Boots in under a second,…
grepular/foxcageRun Firefox in a rootless Podman container with dropped capabilities, isolated networking, and ephemeral storage to contain sandbox escapes and…
spensercai/copy_failRust exploit PoC for Linux kernel LPE CVE-2026-31431 (AF_ALG page-cache write) plus eBPF runtime defense blocking AF_ALG socket creation via LSM or…
