#1Tools for creating and managing isolated environments (VMs, containers) for security testing and malware analysis.
Kitploit recommended
abraxas/opnsense-lockout-factory-ipOPNsense 26.7.6 - High - Remote - Privilege leftover - factory lockout IP
abraxas/opnsense-uidfield-system-uid0OPNsense 26.7.6 - High - Remote - Privilege leftover - UidField uid 0
abraxas/spark-connect-copy-localApache Spark 4.2.0 - High - Remote - File write - Connect session SET copyFromLocalToFs.allowDestLocal
abraxas/spark-connect-archive-fragmentApache Spark 4.2.0 - High - Remote - File write - Connect archives hash-fragment dest
didierstevens/didierstevenssuiteCollection of Python scripts for malware analysis, file format parsing, hashing, and forensic triage, including PDF, OLE, and XOR analysis utilities.
aarif450/zapscapeGuest-to-host KVM/x86 escape exploiting CVE-2026-64561, delivering a full PoC chain and analysis for security researchers.
kstenerud/yoloaiYour agent is a security risk, so treat it like one. yoloAI does AI agent sandboxing right.
bmax121/apatchThe patching of Android kernel and Android system
capsulerun/capsuleSecure runtime to sandbox AI agent tasks. Run untrusted code in isolated WebAssembly environments.
abraxas/proftpd-sftp-copy-file-writeProFTPD 1.3.9d - High - Remote - Privilege leftover / File write - SFTP copy-file skips dest WRITE
abraxas/moodle-grades-feedback-idorMoodle 5.2.3 - High - Remote - IDOR - core_grades_get_feedback skips separate-groups checks
abraxas/drupal-oembed-ssrfDrupal 11.4.8 - High - Remote - SSRF - oEmbed discovery GETs an unscoped second-hop URL
abraxas/proftpd-site-copy-dest-followProFTPD 1.3.9d - High - Remote - Privilege leftover / File write - SITE COPY dest follows symlink
abraxas/joomla-media-overrideJoomla 6.1.3 - High - Remote - Overwrite - media manager overwrite leftover
abraxas/drupal-ckeditor-fileisimageDrupal 11.4.8 - High - Remote - Upload - CKEditor 5 image upload still skips FileIsImage
abraxas/cakephp-trusted-proxiesCakePHP 5.4.2 - High - Remote - Proxy - trustedProxies honors X-Forwarded-* from any REMOTE_ADDR
abraxas/cakephp-smtp-crlfCakePHP 5.4.2 - High - Remote - Header injection - SmtpTransport lone LF leftover of GHSA-2qh5
abraxas/prometheus-bearer-redirectPrometheus v3.15.0 - High - Remote - Credential leak - remote_write google_iam/azuread forwards Bearer on cross-host 3xx
