peach

Peach Fuzz - Vulnerability Scanning Framework This tool aims to look through files in a given directory to detect any unsafe, vulnerable, or dangerous function calls. It is designed to be extensible and easy to understand; you can "plug-and-play" modules that specify criteria on which types of...

pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

LazyHook

Overview LazyHook is a stealthy API hooking framework that bypasses Host Intrusion Prevention Systems HIPS through call stack spoofing. By leveraging CPU-level hardware breakpoints and Vectored Exception Handling, it executes arbitrary code as if it originated from trusted, Microsoft-signed...

ThreadStackSpoofer

Thread Stack Spoofing / Call Stack Spoofing PoC A PoC implementation for an advanced in-memory evasion technique that spoofs Thread Call Stack. This technique allows to bypass thread-based memory examination rules and better hide shellcodes while in-process memory. Intro This is an example...

exrop

Exrop Automatic ROP chain generator for x86-64 binaries, powered by Triton symbolic execution. Features Set registers to constants or other registers rdi=0x41414141, rdi=rax Write to memory constant and register-based addresses/values Write strings/bytes to memory Function calls with mixed...

node9-proxy

🛡️ node9 Access control for AI agents Your AI agents can reach Slack, GitHub, email, and your database. node9 decides what they may do with each one. Credential jail · secrets and PII · destructive git, SQL and shell held for review · MCP tool pinning · network egress allowlist · loop breaker · on...

sage

Sage Safety for Agents — Agent Detection & Response for AI coding assistants Sage is a lightweight security layer that protects AI agents from executing dangerous actions. It intercepts tool calls — shell commands, URL fetches, file writes — and checks them against multiple threat detection layer...

chimera

Chimera Sandbox untrusted code with safe access to the host. Chimera is a userspace sandbox for code you don't fully trust — a natural fit for coding agents that run arbitrary, generated commands on a machine they share with you. It confines what a process can do to the host while still letting i...

MemoryShellHunter

MemoryShellHunter Java Agent memory horse scanner combined with Call Graph modus About MemoryShellHunter is a memory shell Scanner/Killer tool that combines dynamic Building Call Graph. It supports Agent and Attach modes for detection, addressing the issue that conventional memory shell detection...

moukthar

Moukthar Remote adminitration tool for android Demo Features Permissions bypass android 12 below Keylogger Notifications listener SMS listener Phone call recording Image capturing and screenshots Video recording Persistence Read & write contacts List installed applications Download & upload files...

dexfinder

dexfinder English | 中文 | Website Website : junelegency.github.io/dexfinder Cross-platform APK/DEX method & field reference finder with call chain tracing, ProGuard/R8 deobfuscation, and Android hidden API detection. Inspired by Android's veridex tool, reimplemented in Go with enhanced capabilitie...

nah

expensive mistakes stop here a guard that blocks catastrophic agent actions nahguard.ai • what it blocks • how it compares • how it decides • install • extend • threat model claude code · codex · cursor · pi · + 11 more nah is a guard that sits in your coding agent's hook path and reads tool call...

scopeblind-gateway

protect-mcp Local policy enforcement and signed decision receipts for AI agent tool calls. Developer page · Quickstart · Agent setup · Policy packs · Sample record · Integrations · Documentation · Contribute Put the gateway between an MCP client and its tool server, or use its hooks in a coding...

retdec

Warning The RetDec project is currently in a limited maintenance mode due to a lack of resources: Pull Requests are welcomed. They are reviewed with priority, if possible without delays. Issues are reacted on with delays up to one quarter. Issues are not actively solved unless they relate to a...

eden

Eden Eden loader is a PoC UDRL for Cobalt Strike built with Crystal Palace that combines Raphael Mudge's page streaming technique with a modular call gate currently a PIC version of the Sleepmask-VS Draugr callgate BOF. The goal of Eden loader is to: Demonstrate the power of using Crystal Palace ...

MakerChecker

🛡️ MakerChecker The open-source security layer for AI agents. Deny-by-default enforcement, human approvals, and a cryptographically signed audit trail — so your agent runs only what it's granted and provably can't approve its own work. Website · Live Demo · mc scan · Docs Your agents keep running...

Langchain-Chatchat <= 0.3.1.3 - Unauthenticated RCE

Langchain-Chatchat = 0.3.1.3 contains a command injection caused by unauthenticated access to the /tools/call API endpoint invoking the shell tool, letting remote attackers execute arbitrary OS commands as root, exploit requires no authentication. id: CVE-2026-75128 info: name: Langchain-Chatchat...

SilentMoonwalk

SilentMoonwalk PoC Implementation of a fully dynamic call stack spoofer TL;DR SilentMoonwalk is a PoC implementation of a fully dynamic call stack spoofer, implementing a technique to remove the original caller from the call stack, using ROP to desynchronize unwinding from control flow. Authors...

moneta

/ \ / | / \ / \ / \ / / \ \ / Y | \ /| | / | //| | / | / / / / / Moneta v1.0 | Forrest Orr | 2020 REQUIRED -m |region|referenced|ioc -p |PID OPTIONAL -v detail|debug|surface -d --option from-base|statistics --filter unsigned-module|clr-prvx|clr-heap|metadata-modules --address --region-size -m...

BrokenFlow

BrokenFlow A simple PoC to invoke an encrypted shellcode by using an hidden call. Introduction This code uses a simple trick to hide the instruction that effectively will jump to our shellcode. This should make the static analysis or emulation more challenging. As always, if this concept was...