ipsw

ipsw iOS/macOS Research Swiss Army Knife ipsw is a command-line toolkit for Apple firmware research and reverse engineering. Download and unpack IPSWs and OTAs, inspect Mach-O binaries and dyld shared caches, analyze kernelcaches, and work with connected iOS devices. Agent skill · Install · CLI...

secretflow

简体中文｜English SecretFlow is a unified framework for privacy-preserving data intelligence and machine learning. To achieve this goal, it provides: An abstract device layer consists of plain devices and secret devices which encapsulate various cryptographic protocols. A device flow layer modeling...

antispy

AntiSpy English | 简体中文 A powerful anti rootkit toolkit AntiSpy is a free but powerful anti virus and rootkits toolkit. It offers you the ability with the highest privileges that can detect,analyze and restore various kernel modifications and hooks. With its assistance,you can easily spot and...

dalfox

Dalfox is a powerful open-source tool that focuses on automation, making it ideal for quickly scanning for XSS flaws and analyzing parameters. Its advanced testing engine and niche features are designed to streamline the process of detecting and verifying vulnerabilities. Key features Subcommands...

ofrak

OFRAK OFRAK Open Firmware Reverse Analysis Konsole is a binary analysis and modification platform. OFRAK combines the ability to: Identify and Unpack many binary formats Analyze unpacked binaries with field-tested reverse engineering tools Modify and Repack binaries with powerful patching...

ghidra-evm

Ghidra EVM Module In the last few years, attacks on deployed smart contracts in the Ethereum blockchain have ended up in a significant amount of stolen funds due to programming mistakes. Since smart contracts, once compiled and deployed, are complex to modify and update different practitioners ha...

termshark

Termshark A terminal user-interface for tshark, inspired by Wireshark. V2.4 is out now with packet search and profiles for colors and columns! See theChangeLog. If you're debugging on a remote machine with a large pcap and no desire to scp it back to your desktop, termshark can help! Features Rea...

crlfi-scanner

CRLFISCANNER CRLFISCANNER is a professional Node.js CLI tool for detecting CRLF Injection vulnerabilities by sending payload-based HTTP requests, analyzing response headers, and optionally reporting findings to an API/Telegram bot. 🎯 What is CRLFISCANNER? CRLFISCANNER is a bug bounty automation C...

GOXLR-malware-family

This repo initially was my analysis and report for malware found at goxlr.net. Recently I uncovered they ALSO ran several other malware domains with varying malware variants, so far all stealers, and they are all a clone of "goxlr". So I am now reverse engineering every sample I can find from all...

xpfarm

XPFarm An open-source vulnerability scanner that wraps well-known open-source security tools behind a single web UI. Index Section| Description ---|--- Why| Motivation and philosophy behind XPFarm Wrapped Tools| The 10 open-source tools orchestrated by XPFarm Architecture Map| Full system...

kin

A new foundation for code. Kin is a graph-native code repository for AI agents and the people who build with them. It stores source, recorded code relationships, and versioned history as repository state. The graph is the repository model, not a search index maintained beside another repository...

sslscan

sslscan2 sslscan version 2 has now been released. This includes a major rewrite of the backend scanning code, which means that it is no longer reliant on the version of OpenSSL for many checks. This means that it is possible to support legacy protocols SSLv2 and SSLv3, as well as supporting TLSv1...

hacksguard

Hacksguard 0.2 - Blazing Fast TUI Malware Analysis Tool 🛡️ Hacksguard is a blazingly fast, multi-threaded Terminal UI TUI static analysis tool designed for SOC analysts, threat hunters, and reverse engineers. Built entirely in Rust, it provides an intuitive dashboard for quick triage and deep...

px-vm

PerimeterX Auditor VM Analysis Summary This repository documents the reverse engineering of PerimeterX's auditor.js, a bytecode virtual machine used as a secondary fingerprinting layer in PX's bot detection pipeline. This analysis covers: Bytecode extraction and 5-layer decryption pipeline Opcode...

hedgehog-tools

hedgehog-tools Repo of smaller scripts for malware analysis, deobfuscation and configuration extraction. See README.md files within the folders for more details. Overview of generic tools Folder| Script| Depends| Static| Purpose ---|---|---|---|--- ECMAScript helpers| extractcalledfunctions.js|...

oneiromancer

oneiromancer "A large fraction of the flaws in software development are due to programmers not fully understanding all the possible states their code may execute in." -- John Carmack "Can it run Doom?" -- https://canitrundoom.org/ Oneiromancer is a reverse engineering assistant that uses a locall...

ppfuzz

ppfuzz Prototype Pollution Fuzzer A fast tool to scan client-side prototype pollution vulnerability written in Rust. 🦀 Installation Binary Source Dependencies Demonstration Usage Basic Options Usage Supporting Materials Contributing Attribution Acknowledments License Installation Binary Simply,...

rips-scanner

RIPS A static source code analyser for vulnerabilities in PHP scripts Requirements web server: Apache or Nginx recommended PHP: latest version recommended browser: Firefox recommended Installation 1. Download the latest release 2. Extract the files to your local web server's document root 3. Make...

clr

CLR C hecker of L ifetimes and other R efinement types for Zig Video: https://www.youtube.com/watch?v=mf0WzTOe-40 Sponsorship: https://buymeacoffee.com/dnautics discuss on hn: https://news.ycombinator.com/item?id=42923829 discuss on lobste.rs: https://lobste.rs/s/9sitsj/clrcheckerforlifetimesothe...

malware-jail

malware-jail Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js malware-jail is written for Node's 'vm' sandbox. Currently implements WScript Windows Scripting Host context env/wscript.js, at least the part frequently used by malware...