malwinx

Malwinx A normal flask web app to learn win32api with code snippets and references. Prerequisite You need to download the following package before starting it pip install flask pip install pefile pip install requests Usage $ python flaskapp.py Live Demo https://www.youtube.com/watch?v=z7snPXRG3M...

Woeful

Woeful A high performance Wisp server that has packet analysis. Features Wisp V1 Support Pcap network capture Blacklisting & Whitelisting ports and domains Is it fast? It's faster then WispServerCpp. The other benchmarks are more nuanced. Dependencies Big thanks to all of these projects:...

CMF-Watch-Pro-2-BLE-Protocol

CMF Watch Pro 2 — BLE Protocol reverse-engineered Unofficial. This document describes the Bluetooth Low Energy BLE protocol of the CMF Watch Pro 2 CMF by Nothing, reconstructed by reverse engineering for an alternative companion app. It is not affiliated with or endorsed by Nothing/CMF. Use at yo...

PortexAnalyzerGUI

PortexAnalyzerGUI Graphical interface for PortEx, a Portable Executable and Malware Analysis Library Download Releases page Features Header information from: MSDOS Header, Rich Header, COFF File Header, Optional Header, Section Table, .NET Metadata PE Structures: Import Section, Resource Section,...

buttinsky

Buttinsky Open Source Botnet Monitoring Description Botnet monitoring is a crucial part in threat analysis and often neglected due to the lack of proper open source tools. Our tool will provide an open source framework for automated botnet monitoring. The modular design will allow full...

bunitu_tests

bunitutests Scripts for communication with Bunitu Trojan C&Cs Use at your own risk! Authors: : hasherezade Malwarebytes : Sergei Frankoff Sentrant Files: cnc1test.py - registers your host as a proxy bot in the Bunitu botnet communicate with C&C1 cnc2test.py - checks if the given host is a Bunitu...

XnlReveal

About - v4.5 This is a Chrome/Firefox Extension that can do the following: For hosts that are in scope: Show an alert for any query parameters that are reflected and identify "sus" parameters. Optionally check if the characters '," and are reflected without being encoded. Write details of reflect...

malduck

🦆 Malduck Installation ⚙️ | Docs 📚 Malduck is your ducky companion in malware analysis journeys. It is mostly based on Roach project, which derives many concepts from mlib library created by Maciej Kotowicz. The purpose of fork was to make Roach independent from Cuckoo Sandbox project, but still...

ZeroLogon-Exploitation-Check

Script to automate Checks for potential exploitation of CVE-2020-1472 aka ZeroLogon in the domain. This is a very "quick and dirty" script that automates some of the leading artifects in determining an actual exploitation of CVE-2020-1472, compiled from multiple blogs. Ideally, the 2nd check for...

cosa-nostra

Cosa Nostra Cosa Nostra is an open source software clustering toolkit with a focus on malware analysis. It can create phylogenetic trees of binary malware samples that are structurally similar. It was initially released during SyScan360 Shanghai 2016. I basically maintain it since 2016 for my one...

Network_Assessment

Network Assessment With Wireshark or TCPdump, you can determine whether there is harmful activity on your network traffic that you have recorded on the network you monitor. This Python script analyzes network traffic in a given .pcap file and attempts to detect the following suspicious network...

LogonTracer

Concept LogonTracer v2 is a tool to investigate malicious logon by visualizing and analyzing Windows Active Directory event logs. This tool associates a host name or an IP address and account name found in logon-related events and displays it as a graph. This way, it is possible to see in which...

browser-xpi-malware-scanner

XPI Analyzer — Firefox Extension Security Scanner A command-line tool that analyzes Firefox extension files .xpi for signs of malware, obfuscation, hidden payloads, steganography, and other techniques used to sneak malicious code past extension review teams. What It Does extension-scanner.py tear...

awesome-list

Awesome Cybersecurity List My personal collection of awesome blog posts, write-ups, and papers focusing on cybersecurity. For a deeper dive into cybersecurity-related tools, check out the dedicated Cybersecurity Tools list. Outline 2026 2025 2024 2023 2022 2021 2020 2019 2018 2017 2016 2014 2011...

Vba2Graph

Vba2Graph A tool for security researchers, who waste their time analyzing malicious Office macros. Generates a VBA call graph, with potential malicious keywords highlighted. Allows for quick analysis of malicous macros, and easy understanding of the execution flow. @MalwareCantFly Features Keywor...

CodeAnalysis

TCA, Tencent Cloud Code Analysis code-named: CodeDog English | 简体中文 TCA Official Official website: https://tca.tencent.com Official introduction: https://cloud.tencent.com/product/tcap TCA CNB PagesBetter Internet Speed Domestic: https://cnb.cool/tencent/cloud/tca/code-analysis Domestic:...

BinAbsInspector

What is BinAbsInspector? BinAbsInspector Binary Abstract Inspector is a static analyzer for automated reverse engineering and scanning vulnerabilities in binaries, which is a long-term research project incubated at Keenlab. It is based on abstract interpretation with the support from Ghidra. It...

phantap

PhanTap Phantom Tap PhanTap is an ‘invisible’ network tap aimed at red teams. With limited physical access to a target building, this tap can be installed inline between a network device and the corporate network. PhanTap is silent in the network and does not affect the victim’s traffic, even in...

androwarn

Androwarn Yet another static code analyzer for malicious Android applications Description Androwarn is a tool whose main aim is to detect and warn the user about potential malicious behaviours developped by an Android application. The detection is performed with the static analysis of the...

custom-bytecode-analyzer

custom-bytecode-analyzer Java bytecode analyzer customizable via JSON rules. It is a command-line tool that receives a path containing one or more Jar or War files, analyzes them using the provided rules and generates HTML reports with the results. Usage usage: java -jar cba-cli.jar OPTIONS -a...