chain-reactor

Chain Reactor Chain Reactor is an open source tool for testing detection and response coverage on Linux machines. The tool generates executables that simulate sequences of actions like process creation and network connection. Chain Reactor assumes no prior engineering experience; the tool consume...

MsfMania

MsfMania MsfMania is an advanced Python-based payload obfuscation framework designed to evade EDR/AV detection on Windows systems. It generates highly polymorphic executables through dynamic code generation, multi-layer encryption RC4, and binary metadata spoofing. ⚠️ Educational Purpose Only -...

malwoverview

Malwoverview !Alt...

rikune

Rikune Rikune is an MCP server for reverse engineering Windows executables and related binary formats. It combines sample intake, static triage, Ghidra-assisted function recovery, plugin-driven specialist tooling, artifact management, and optional isolated Windows runtime execution behind a Model...

PhantomCtx

PhantomCtx PhantomCtx is a tool that automates Activation Context hijacking with the objective of loading an arbitrary DLL into the vast majority of signed executables e.g. Microsoft, Adobe, Mozilla. The loader is presented as a modern alternative to traditional DLL Hijacking & Sideloading: unlik...

Robber

Robber — DLL Hijack Scanner Free, open source tool for finding DLL hijacking opportunities in Windows executables. No third-party dependencies. What it does Windows loads DLLs by searching a fixed set of directories in order — the executable's own directory first, then System32, Windows, PATH...

GTFOBins.github.io

GTFOBins GTFOBins is a curated list of Unix-like executables that can be used to bypass local security restrictions in misconfigured systems. Find the project at: gtfobins.org...

Binvariants

Binvariants: Register-Level Invaraint-Guided Fuzzing for Binaries This repository provides the source code for Binvariants : a prototype fuzzing framework that leverages register-level likely invariant violations for fuzzing binaries. This work is presented in our paper Binvariants: Enhancing...

metame

metame metame is a simple metamorphic code engine for arbitrary executables. From Wikipedia: Metamorphic code is code that when run outputs a logically equivalent version of its own code under some interpretation. This is used by computer viruses to avoid the pattern recognition of anti-virus...

drow

drow Description TL;DR drow is a command-line utility that is used to inject code and hook the entrypoint of ELF executables post-build. It takes unmodified ELF executables as input and exports a modified ELF contianing an embedded user-supplied payload that executes at runtime. Slightly more...

droidlysis

DroidLysis DroidLysis is a pre-analysis tool for Android apps : it performs repetitive and boring tasks we'd typically do at the beginning of any reverse engineering. It disassembles the Android sample, organizes output in directories, and searches for suspicious spots in the code to look at. The...

Inline-Execute-PE

Inline-Execute-PE DISCLAIMER: This project is complex and failure to understand how it works and adequately test it can result in you crashing Beacons and losing access! I highly encourage you to read all of the documentation up until the "Design Considerations and Commentary" section! Introducti...

backdoorppt

backdoorppt - 'Outil de falsification d'extensions Office' Version de sortie: v1.7-Stable Auteur: pedro ubuntu r00t-3xp10it Distributions supportées: Linux Kali, Ubuntu, Mint Suspicious-Shell-Activity© SSA RedTeam développé @2017 Transformez votre payload.exe en un faux document Word .ppt Script...

amcache-evilhunter

AmCache-EvilHunter AmCache-EvilHunter — это инструмент командной строки для парсинга и анализа кустов реестра Windows Amcache.hve, выявления следов выполнения, подозрительных исполняемых файлов и интеграции с VirusTotal/OpenTIP для расширенной аналитики угроз...

Creds

Creds Pentest & Forensics를 위한 유용한 스크립트 및 실행 파일 대부분의 스크립트/실행 파일은 Windows / 도메인 특화입니다. 법적 고지: 사전 상호 동의 없이 대상을 공격하기 위해 이러한 스크립트/실행 파일을 사용하는 것은 불법입니다. 모든 해당 지역, 주 및 연방 법률을 준수하는 것은 최종 사용자의 책임입니다. 개발자는 이 프로그램으로 인한 오용 또는 손해에 대해 어떠한 책임도 지지 않습니다. 교육 목적으로만 사용하십시오...

sandfly-entropyscan

What is sandfly-entropyscan? sandfly-entropyscan is a utility to quickly scan files or running processes and report on their entropy measure of randomness and if they are a Linux/Unix ELF type executable. Some malware for Linux is packed or encrypted and shows very high entropy. This tool can...

NimPackt-v1

A Nim-based packer for .NET executables and raw shellcode ByCas van Cooten @chvancooten With special thanks to Marcello Salvati @byt3bl33der and Fabian Mosch @S3cur3Th1sSh1t Description Update: NimPackt-v1 is among the worst code I have ever written I was just starting out learning Nim. Because o...

boko

boko Scanner de Détournement d’Applications pour macOS boko.py est un scanner d’applications pour macOS qui recherche et identifie les vulnérabilités potentielles de détournement de dylib dylib hijacking et de dylib faible weak dylib pour les exécutables d’applications, ainsi que les scripts qu’u...

deobf-Arxan-Deob-C

Arxan-Deob-C Простая программа на C для быстрой деобфускации Windows-исполняемых файлов, защищённых с помощью Arxan. Пока что код немного запутан... Будьте осторожны : Я планирую его почистить...

zeek-xor-exe-plugin

Corelight::PEXOR Плагин Zeek для обнаружения и дешифрования XOR-обфусцированных Windows-исполняемых файлов. Ключ, использованный для XOR-шифрования файла, будет автоматически обнаружен и использован для обратного XOR-преобразования файла в исходный исполняемый файл Windows. После деобфускации фай...