Tools

ejfkdev/jscd

Reverse bytenode .jsc (V8 code cache) to JavaScript — static, pure Rust, no patched V8/Node. Node 8→26 / V8 5.8–14.6; 25k .jsc tested, 0 fail.

iamavu/zairo

Scans code diffs with context to build an impact graph and uses LLMs to find vulnerabilities, supporting multi-repo scans and CI gating with SARIF…

worksbutnottested/lightkeeper

Maps execution-coverage data onto Ghidra disassembly to highlight visited code paths and accelerate reverse-engineering workflows.

cloudflare/security-audit-skill

A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings

binsec/xyntia

Xyntia, the black-box deobfuscator

vladko312/sstimap

Automatic SSTI detection tool with interactive interface

r00tkitsmm/pishi

Pishi is a code coverage tool like kcov for macOS.

smackers/smack

Modular software verification toolchain that translates LLVM IR into Boogie intermediate verification language for bounded and experimental unbounded…

0xbigshaq/apatchy

Fuzzing Framework for Modules in Apache HTTPD Server

aftermathlabs/vmp2

Unpack and deobfuscate VMProtect 2 protected binaries with an emulation-based VM explorer, handler profiler, and experimental LLVM recompiler for…

shoucheng3/x-stream__xstream_cve-2021-21345_1-4-15

Java XML serialization library with a focus on CVE-2021-21345 exploit analysis and deserialization vulnerability testing for web applications.

hupe1980/cve-2021-3129

Laravel debug mode - Remote Code Execution (RCE)

byt3bl33d3r/offensivedlr

Toolbox containing research notes & PoC code for weaponizing .NET's DLR

tomnomnom/gf

A wrapper around grep, to help you grep for things

we5ter/flerken

A Solution For Cross-Platform Obfuscated Commands Detection presented on CIS2019 China. 动静态Bash/CMD/PowerShell命令混淆检测框架 - CIS 2019大会

jpiechowka/jenkins-cve-2016-0792

Exploit for Jenkins serialization vulnerability - CVE-2016-0792