kaandemir993/vidar-stealer-chrome-injection-malicious-js-targeting-google-reddit-sessions-analysisReverse engineering Vidar Stealer: From obfuscated memory strings to Chrome process injection, malicious JS execution, and active session hijacking…
gmh5225/memory-relocallocC proof-of-concept that locates code caves in the .reloc section of mapped DLLs to allocate and execute small shellcode, replacing typical memory…
haitam-lazaar/libextractor-ole2-rcePoC for a Critical stack-based buffer overflow in GNU libextractor ≤ 1.14. A malicious .doc file triggers an unbounded VLA allocation causing…
gmh5225/evilkasperskyWindows kernel driver experiment based on KasperskyHook that uses direct syscalls for interprocess memory copying, with support for unloading the…
daffainfo/vol-rsVolatility 3 ported to Rust. Same output, much faster.
withsecurelabs/volatility-pluginsVolatility plugins for memory forensics, including detection of Gargoyle memory scanning evasion techniques.
withsecurelabs/dotnet-gargoyleA spiritual .NET equivalent to the Gargoyle memory scanning evasion technique
withsecurelabs/radare2-scriptsCollection of radare2 scripts for malware analysis: carve binaries from memory dumps, patch PE headers, and decode hashed function imports in…
withsecurelabs/memory-carving-scriptsScripts for extracting useful information from infected memory dumps
volatilityfoundation/communityCommunity-maintained Volatility plugin collection for memory forensics, extending memory dump analysis with modules for malware and process…
hasherezade/libpeconvCustom PE loading and manipulation library for manual mapping, IAT hooking, memory dumping, and rebuilding imports for malware analysis and reverse…
withsecurelabs/ticktockEnumerates Windows timer-queue timers to detect Ekko sleep obfuscation, aiding memory forensics and malware analysis in identifying evasive…
crowdstrike/supermemA python script developed to process Windows memory images based on triage type.
nccgroup/windowsfirewallhookdriverenumerationTools to enumerate Windows Firewall Hook Drivers on Windows 2000, XP and 2003
bedazzlinghex/memory-analysisContains tools to perform malware and forensic analysis in Memory
nonameerror/mongobleed---cve-2025-14847-poc-This repo contains my python script version of CVE-2025-14847 (MongoBleed)
landw-hub/cve-2025-50422Proof-of-concept for CVE-2025-50422: demonstrates heap memory disclosure in Poppler's pdftocairo, allowing local attackers to recover clear-text PDF…
jajangjaman/cve-2021-41160FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a malicious server…
