rematch

|Read The Docs| |Gitter Chat| |Build Status| |Codacy Badge| |idaplugin PyPI| |server PyPI| rematch REmatch, yet another binary comparison tool. Rematch is still a work in progress and is not as feature-rich as we'd like it to be. Basic functionality is available at this point and more advanced...

AMSI.fail

AMSI.fail Originally C Azure Function Later ported to JS with an HTTP trigger that generates obfuscated PowerShell snippets that break or disable AMSI for the current process. The snippets are randomly selected from a small pool of techniques/variations before being obfuscated. Every snippet is...

xnuspy

xnuspy Output from the kernel log after compiling and running example/open1hook.c xnuspy is a pongoOS module that installs a new system call, xnuspyctl, which allows you to hook kernel functions from userspace. It supports iOS 13.x, iOS 14.x, and iOS 15.x on checkra1n 0.12.2 and up. 4K devices ar...

harbian-audit

harbian-audit Hardening Introduction Hardened Debian GNU/Linux and CentOS 8 distro auditing. The main test environment is in debian GNU/Linux 9/10/11/12/13 and CentOS 8 and ubuntu 22, and other versions are not fully tested. There are no implementations of desktop related items in this release. T...

Jatayu

JATAYU Stealthy Stand Alone PHP Web Shell FEATURES Http Header Based Authentication. 100% Undetectable. Exec Function Changer. Nothing Fancy USAGE...

kaiju

CERT Kaiju Binary Analysis Framework for GHIDRA CERT Kaiju is a collection of binary analysis tools for Ghidra. This is a Ghidra/Java implementation of some features of the CERT Pharos Binary Analysis Framework, particularly the function hashing and malware analysis tools, but is expected to grow...

sn0int

sn0int sn0int pronounced /snoɪnt/ is a semi-automatic OSINT framework and package manager. It's used by IT security professionals, bug bounty hunters, law enforcement agencies and in security awareness trainings to gather intelligence about a given target or about yourself. sn0int is enumerating...

openrasp

OpenRASP Introduction Unlike perimeter control solutions like WAF, OpenRASP directly integrates its protection engine into the application server by instrumentation. It can monitor various events including database queries, file operations and network requests etc. When an attack happens, WAF...

python-haystack

python-haystack memory forensics |travis| |coverage| |landscape| |pypi| |docs| Quick Start: Quick usage guide in the docs/ folder. Haystack-reverse CLI in the docs/ folder. More documentation Introduction: python-haystack is an heap analysis framework, focused on searching and reversing of C...

replica

REPLICA TAME THE DRAGON ✨Features ⚡ Disassemble missed instructions - Define code that Ghidra's auto analysis missed ⚡ Detect and fix missed functions - Define functions that Ghidra's auto analysis missed ⚡ Fix 'undefinedN' datatypes - Enhance Disassembly and Decompilation by fixing 'undefinedN'...

powerob

Powerob An on-the-fly Powershell script obfuscator meant for red team engagements. Built out of necessity. This only obfuscates functions and removes found in PowerShell scripts. Roadmap includes bfuscating variables. Pull requests and collaborative welcomed. About This was built out of the need ...

spring-spel-0day-poc

spring-spel-0day-poc spring-cloud/spring-cloud-function RCE EXP POC https://github.com/spring-cloud/spring-cloud-function header root@kitploit: spring.cloud.function.routing-expression:Tjava.lang.Runtime.getRuntime.exec"open -a calculator.app" build root@kitploit: wget...

HookDump

HookDump EDR function hook dumping Please refer to the Zeroperil blog post for more information https://zeroperil.co.uk/hookdump/ Building source In order to build this you will need Visual Studio 2019 community edition is fine and CMake. The batch file Configure.bat will create two build...

SAFE

SAFE : Self Attentive Function Embedding Paper This software is the outcome of our accademic research. See our arXiv paper: arxiv If you use this code, please cite our accademic paper as: root@kitploit: @inproceedingsmassarelli2018safe, title=SAFE: Self-Attentive Function Embeddings for Binary...

kaiju

CERT Kaiju: GHIDRA용 바이너리 분석 프레임워크 CERT Kaiju는 Ghidra용 바이너리 분석 도구 모음입니다. 이는 CERT Pharos 바이너리 분석 프레임워크의 일부 기능, 특히 함수 해싱 및 악성코드 분석 도구를 Ghidra/Java로 구현한 것입니다. 하지만 시간이 지나면서 새로운 도구와 기능이 추가될 것으로 예상됩니다. 이 구현은 새로운 노력이기 때문에 아직 ROSE 기반의 원래 C++ 구현과 완전한 기능적 동등성을 갖추지 못했습니다. 그러나 Java 및 Ghidra로의 전환은 원래 프레임워크에서는...

dynmx

dynmx Prototype dynmx spoken dynamics is a signature-based detection approach for behavioural malware features based on Windows API call sequences. In a simplified way, you can think of dynmx as a sort of YARA for API call traces so called function logs originating from malware sandboxes. Hence,...

CVE-2022-34265

CVE-2022-34265 脆弱性の概要 この脆弱性は、Djangoで日付データに使用される関数TruncとExtractの引数において、SQLを実行する際の不適切な文字列処理に起因します。Truncのkind引数、またはExtractのlookupname引数にリクエストパラメータがそのまま指定されることで、任意のSQL文が実行されるリスクがあります。この脆弱性を悪用すると、第三者がデータベースにコマンドを送信して、許可されていないデータにアクセスしたり、データベースを削除したりする可能性があります。...

rust_syscalls

RUSTSYSCALLS ランタイムSSN解決を備えたWindows向けの、シングルスタブによる直接・間接syscall。 特徴: すべてのsyscallを1行で実行可能 コンパイル時に関数名をハッシュ化 直接または間接syscall x8664、WOW64、x86ネイティブ対応 カスタムSSN取得メソッドの実装を可能にする設計詳細はこのREADMEの末尾を参照 使い方: 1. gitリポジトリ / ローカルパスを依存関係としてライブラリに追加します: rustsyscalls = git = "https://github.com/janoglezcampos/rustsyscalls...

tiny_tracer

tinytracer 추적을 위한 Pin 도구: API 호출, 선택된 함수의 입력 및 출력 포함 정의된 지역 함수 및 정적으로 링크된 라이브러리의 함수 선택된 명령어: RDTSC, CPUID, INT 인라인 시스템 콜, 선택된 시스템 콜의 매개변수 포함 추적 모듈의 섹션 간 전환 패킹된 모듈의 OEP를 찾는 데 도움 정의된 코드 조각에서 실행된 명령어 알려진 안티 디버그 및 안티 VM 기술 중 일부를 회피합니다. .tag 형식의 보고서를 생성합니다 다른 분석 도구에 로드 가능: root@kitploit: RVA;traced...

NimShellcodeFluctuation

NimShellcodeFluctuation 原始仓库的 Nim 移植版：https://github.com/mgeeky/ShellcodeFluctuation 所有注释都按原样从原始仓库复制粘贴而来，因为它们确实帮助我理解了这项技术。关于该技术本身的更多信息，我强烈建议阅读原始仓库的 README！ 安装依赖： root@kitploit: nimble install winim ptrmath 我完全清楚，这种内存加密技术在 OpSec 方面并不是最好的。它只会精确加密那些为其定义的内存区域。因此，例如对于 C2 植入体，所有新执行的模块内存地址在 Sleep...