#1Tools for creating and managing isolated environments (VMs, containers) for security testing and malware analysis.
Kitploit recommended
v4bel/zapscapePoC exploit for CVE-2026-64561, a KVM/x86 shadow MMU use-after-free enabling guest-to-host escape with kernel root code execution on the host.
devzero-security/redstackproA canvas for red team infrastructure and cyber ranges. Compose a topology, export runnable Terraform and Ansible, and deploy it yourself. Your cloud…
penberg/chimeraSandbox untrusted code with safe access to the host.
amlalabs/amla-sandboxWASM sandbox with capability enforcement for AI agent code. Agents can only call explicitly provided tools with defined constraints. Sandboxed…
monad-developers/ultrafuzzEnd-to-end agentic smart contract fuzzing and threat hunting
schumilo/vusbfA QEMU/KVM-based USB fuzzing framework that finds device-driver bugs via reproducible VM execution, multiprocessing, and XML testcase generation.
facebook/mcpguard-dynamicKernel-level eBPF sandbox for securing LLM agent tool calls made through the Model Context Protocol (MCP)
githubsecuritylab/seclab-taskflowsExample AI-agent taskflows and MCP servers for auditing source code, triaging issues, and detecting vulnerabilities across web, Android, and iOS…
ricccrd/ddJIT-based userspace Linux kernel that runs containers natively on Apple Silicon macOS without a VM. Drop-in Docker Engine API replacement with…
malwaretech/appcontainersandboxAn example sandbox using AppContainer (Windows 8+)
deathshotxd/comment2shellZero-click pre-auth WordPress CVE-2026-93485 exploit chain: stored XSS in wpautop() escalates to admin-session plugin upload and a self-deleting…
zeroecco/holosDeclarative KVM/QEMU VM orchestration tool using YAML compose files. Manages multi-VM stacks with cloud-init, SSH, PCI passthrough, and image…
not-matthias/amd_hypervisorRust AMD SVM hypervisor framework with customizable vmexit handlers (MSR, CPUID, RDTSC) and NPT hooking for kernel-level monitoring and research.
kalilinux/build-scripts/kali-dockerKali Linux Docker
0xballpoint/loadLord Of Active Directory - automatic vulnerable active directory on AWS
ethan-andrews/threatintel-aggregatorSelf-hosted threat intelligence platform — feed aggregation, AI triage, MITRE ATT&CK coverage, and Sentinel-integrated detection engineering. Runs…
impalabs/hyperpomAArch64 fuzzer based on the Apple Silicon hypervisor
markakd/container_escapeContainer escape proof-of-concept exploits for CVE-2026-80521 and CVE-2026-52910, with a disposable QEMU/Ubuntu VM harness for safe PoC execution.
