IPA
seekbytes/ipaGUI analyzer for deep-diving into PDF files. Detect malicious payloads, understand object relationships, and extract key information for threat…
binary-analysisdefensive-toolsdigital-forensics+6
seekbytes/ipaGUI analyzer for deep-diving into PDF files. Detect malicious payloads, understand object relationships, and extract key information for threat…
andrewmichaelsmith/bluepotJava-based Bluetooth honeypot that captures and stores malware from BlueBugging and BlueSnarfing attacks, with a GUI for monitoring and log analysis.
synacktiv/metamorphA command-line utility for Windows written in C that creates and configures persistent Event Tracing for Windows (ETW) AutoLogger sessions.
lasq88/socgholish_finderScans websites for SocGholish JavaScript injections, deobfuscates malicious payloads, and reports shadowing domain URLs used in malvertising…
stamparm/maltrailReal-time malicious traffic detection system using public blacklists, static malware trails, and heuristic analysis to identify threats across DNS,…
cowrie/cowrieCowrie SSH/Telnet Honeypot https://docs.cowrie.org/
gianlucaborello/libprocesshiderLD_PRELOAD shared library that hides a Linux process from tools like ps and lsof by intercepting readdir and proc filesystem calls.
xephora/threat-remediation-scriptsThis repository contains a list of new remediation scripts.
0xnslabs/canarytokenscannerDetects CanaryTokens in Office docs and PDFs (docx, xlsx, pptx, pdf) without triggering alerts
capesandbox/capesoloStandalone Windows VM malware sandbox running capemon, with GUI triage viewer, YARA signatures, IOC extraction, network analysis, and…
karim852/kage-dfir-toolkitWindows host DFIR triage console that chains artefact collection, Sigma-correlated timelines, YARA scans, socket and account inspection, indicator…
kaandemir993/purerat-msbuild.exe--c2-extraction--net-evasion-analysisReverse engineering analysis of PureRAT RAT abusing msbuild.exe, extracting C2 infrastructure, .NET evasion APIs, file system manipulation, and…
ctrlaltint3l/intelligenceCentralized repository for malware samples, threat intelligence, IOCs, and security tooling logs to support threat research and incident response…
gosecure/pyrdpRDP monster-in-the-middle (mitm) and library for Python with the ability to watch connections live or after the fact
canuk40/xpfarmAutomated bug bounty & recon framework — wraps Subfinder, Naabu, Httpx, Nuclei, Nmap, CVEMap, Gowitness, Katana & more behind a unified web UI
syscallx-18113/apkx-hunterC-based Android static analysis framework for decompilation, secret detection, endpoint discovery, permission analysis, and native library scanning…
stevenblack/hosts🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.
hslatman/awesome-threat-intelligenceCurated directory of threat intelligence sources, feeds, frameworks, tools, and research for SOC/CTI teams—covering IOCs, STIX/TAXII formats, and…