exrop

Exrop Automatic ROP chain generator for x86-64 binaries, powered by Triton symbolic execution. Features Set registers to constants or other registers rdi=0x41414141, rdi=rax Write to memory constant and register-based addresses/values Write strings/bytes to memory Function calls with mixed...

DFIR_Resources_REvil_Kaseya

Resources for DFIR Professionals Responding to the REvil Ransomware Kaseya Supply Chain Attack Yesterday Sophos and Huntress Labs identified that Kaseya, a remote management provider popular with MSPs, was compromised to deploy a supply chain ransomware attack. A large number of organisations wer...

Gpt-Agreement-Payment

简体中文 | English Gpt-Agreement-Payment End-to-end replay tool for ChatGPT Plus / Team subscription agreements: reverse-engineered from packet capture the entire chain Stripe Checkout → PayPal / GoPay / QRIS → ChatGPT manual-approval → Codex OAuth + PKCE and implemented as a runnable client. Include...

CyberStrikeAI

CyberStrikeAI 中文 | English The system of action for AI-native cybersecurity—where intent becomes governed execution, evidence becomes operational memory, and every operation improves the next. CyberStrikeAI connects planning, execution, human oversight, evidence, and replay in one auditable...

depsguard

depsguard root@kitploit: | | | | / |/ \ ' / |/ | | | |/ | '/ | | | | / | \ \ | | || | | | | | | | ,|| ./|/, |,|,|| ,| || |/ Guard your dependencies against supply chain attacks. Single static binary, zero Rust crate dependencies. By arnica Table of contents...

capslock

Capslock is a capability analysis CLI for Go packages that informs users of which privileged operations a given package can access. This works by classifying the capabilities of Go packages by following transitive calls to privileged standard library operations. The recent increase in supply chai...

ProtectMyTooling

Don't Detect Tools - Detect Techniques Rationale behind releasing this software was outlined in an acompanying blog post: ProtectMyTooling - Don't detect tools, detect techniques Intro Script that wraps around multitude of packers, protectors, obfuscators, shellcode loaders, encoders, generators ...

dependency-track

OWASP Dependency-Track Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials SBO...

manuka

Manuka Description Manuka is an Open-source intelligence OSINT honeypot that monitors reconnaissance attempts by threat actors and generates actionable intelligence for Blue Teamers. It creates a simulated environment consisting of staged OSINT sources, such as social media profiles and leaked...

guac

GUAC: Graph for Understanding Artifact Composition Note: GUAC is under active development - if you are interested in contributing, please look at contributor guide. GUAC is an OpenSSF incubating project under the Supply Chain Integrity WG. Graph for Understanding Artifact Composition GUAC...

depx

depx Malicious package & supply-chain intelligence Features • Installation • Usage • Running depx • JSON • Join Discord depx is a fast, passive supply-chain intelligence CLI. It tells you whether a package is known malicious hijacked publishes, credential stealers, install-script backdoors by...

safe-npm

safe-npm A security-focused npm installer that protects your projects from newly compromised packages. Why does this exist? Supply chain attacks on npm packages are a growing threat. Attackers sometimes compromise legitimate packages by: Stealing maintainer credentials Publishing malicious update...

hexora

hexora Hexora is a static analysis tool designed to detect malicious and harmful patterns in Python code. It combines a rule-based static analysis engine with a machine-learned model that scores entire source files to classify them as malicious or benign. It can be used to: Audit project...

terrier

Terrier Terrier is a Image and Container analysis tool that can be used to scan OCI images and Containers to identify and verify the presence of specific files according to their hashes. A detailed writeup of Terrier can be found on the Heroku blog,...

proxy

git-pkgs proxy A caching proxy for package registries. Speeds up package downloads by caching artifacts locally, reducing bandwidth usage and improving reliability. Version Cooldown Most supply chain attacks rely on speed: a malicious version gets published and consumed by automated pipelines...

ropium

About ROPium ex-ROPGenerator is a library/tool that makes ROP-exploits easy. It automatically extracts and analyses gadgets from binaries and lets you find ROP-chains with semantic queries. ROPium supports X86 and X64 architectures, soon to be extended with ARM. Key features: Effortless : ROPium...

flar

flar FLAR is the Fast Light Agent Restrictor. It runs on rocks called gars. It is a simple, lightweight CLI tool in Go to run coding agent CLIs like Claude Code, Antigravity, Codex, Copilot and Reasonix safely inside isolated Bubblewrap bwrap sandboxes. The purpose is to instantly and without...

DeepSleep

DeepSleep A variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC. Huge thanks to @waldoirc for documenting large parts of this technique on his blog This implementation is different in that it does not make use of any APCs and is fully implemented as PIC. Description I have...

RustChain

Description This tool is a simple PoC of how to hide memory artifacts using a ROP chain in combination with hardware breakpoints. The ROP chain will change the main module memory page's protections to N/A while sleeping i.e. when the function Sleep is called. For more detailed information about...

bumblebee

Threat Intelligence Exposure Catalogs Maintained exposure catalogs for recent supply-chain campaigns, built from public threat-intelligence reporting with Perplexity Computer and updated via PRs as fresh campaigns are reported. Pass a catalog to a scan with --exposure-catalog . Review the entries...