Tools

trailofbits/polytracker

An LLVM-based instrumentation tool for universal taint tracking, dataflow analysis, and tracing.

momalab/icsfuzz

Instrumented fuzzer for PLC-based ICS control applications, targeting Codesys runtime on Wago controllers to uncover memory corruption and…

angorafuzzer/angora

Coverage-guided fuzzer that uses taint tracking and scalar optimization to solve path constraints without symbolic execution, improving branch…

tomnomnom/gf

A wrapper around grep, to help you grep for things

google/honggfuzz

Security oriented software fuzzer. Supports evolutionary, feedback-driven fuzzing based on code coverage (SW and HW based)

rust-fuzz/cargo-fuzz

Cargo subcommand for coverage-guided Rust fuzzing with libFuzzer: create and run fuzz targets, minimize failures and corpora, and report coverage.

melmathari/dockercve-2024-835

Docker-based exploit for CVE-2024-835 vulnerability with automated deployment via docker-compose for penetration testing and security assessment.

1rhino2/fnprint

match functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.

open-flaw/cve-2026-56848

Exploit PoC for CVE-2026-56848, a Node.js HTTP/2 heap-use-after-free that allows remote unauthenticated DoS. Includes raw-socket trigger, ASan build…

huzjie/aegisagent

Runtime security gateway for AI agents: cryptographically attests tool calls, enforces policies, sandboxes execution, and logs tamper-evident audit…

chichou/vscode-frida

VSCode extension for Frida-based mobile reverse engineering: runtime class/module inspection, Java/ObjC/native hook generation, autocomplete, and…

worksbutnottested/lightkeeper

Maps execution-coverage data onto Ghidra disassembly to highlight visited code paths and accelerate reverse-engineering workflows.

zxgio/ghidra_stack_strings

A script to detect stack-strings by using emulation (leveraging Unicorn)

binsec/xyntia

Black-box deobfuscator synthesizing semantics of obfuscated binary code via program synthesis, execution sampling, grammar search, and inference…

dvyukov/centipede

Distributed coverage-guided fuzzing engine compatible with libFuzzer targets; scales to thousands of concurrent jobs, uses sanitizers and corpus…

0x3c3e/slides

CodeQL + DTrace = Memory Disclosure Vulnerabilities in XNU

zer0condition/reversekit

Injected x64 runtime analysis toolkit that hooks syscalls/APIs, monitors threads, heaps, imports and URLs, and bypasses common debugger checks.

google/buzzer

eBPF fuzzer toolchain for generating random eBPF programs and validating kernel verifier/runtime behavior. Supports coverage-guided fuzzing and…