gef

GEF pronounced ʤɛf - "Jeff" is a set of commands for x86/64, ARM, MIPS, PowerPC and SPARC to assist exploit developers and reverse-engineers when using old school GDB. It provides additional features to GDB using the Python API to assist during the process of dynamic analysis and exploit...

twiga

Twiga A tool that enumerates Android devices for information useful in understanding its internals and for exploit development. It supports android 4.2 to android 7.1.1 Requirements The most current ADB must be in your path and fully functional The report name must not have any whitespace...

ronin

ronin Website Source Issues Documentation Discord | Mastodon Description Roninwebsite is a free and Open Source Ruby toolkit for security research and development. Ronin contains many different CLI commands and Ruby librariesronin-rb for a variety of security tasks, such as encoding/decoding data...

heap-viewer

HeapViewer An IDA Pro plugin to examine the heap, focused on exploit development. Currently supports the glibc malloc implementation ptmalloc2. 3rd place winner of the 2018 Hex-Rays Plugin Contest Requirements IDA Pro = 7.0 Tested on glibc 2.23 = 2.26 GraphView for linked lists bins/tcache Struct...

webapp-exploits

webapp-exploits Web Application Exploit Development...

pythem

pythem - Penetration Testing Framework pythem is a multi-purpose pentest framework written in Python. It has been developed to be used by security researchers and security professionals. The tool intended to be used only for acts within the law. I am not liable for any undue and unlawful act...

CVE-2019-0708-PoC-Hitting-Path

CVE-2019-0708-PoC-Hitting-Path Really Really Bad, don't judge this code hahaha it's terrible It's only hitting vulnerable path in termdd.sys!!! NOT DOS Tested only on Windows XP Sp3 x86, Windows 7 will need negotiation part probably so it won't work I hope that work at all Maybe it will be useful...

exploitgym

ExploitGym ExploitGym is a large-scale, realistic benchmark built from real-world vulnerabilities across userspace programs, Google's V8 engine, and the Linux kernel, designed to evaluate AI agents' ability to develop exploits. Quick start 1. Python deps uv sync --extra proxy 2. Build runtime...

awesome-reverse-engineering-and-malware-analysis

Awesome Reverse Engineering & Malware Analysis A map of reverse engineering and malware analysis that's actually been read. Every link was opened and checked before it went in, and it gets pulled the moment it rots - no dead pages, no one-word notes, no "great resource!" filler. unpacked covers a...

peda

peda PEDA - Python Exploit Development Assistance for GDB Key Features: Enhance the display of gdb: colorize and display disassembly codes, registers, memory information during debugging. Add commands to support debugging and exploit development for a full list of commands use peda help: aslr --...

CVE-2017-13089

CVE-2017-13089 wget v1.19.1 for exploit dev. NOTE This is not a working exploit - under development. Usage Build the container docker build -t cve201713089 . OR ... docker pull robertcolejensen/cve201713089 Play around in the container, src will be mounted at /opt/CVE-2017-13089/src ./run.sh...

CopyFail-Experiment

Just an experiment to verify that the LLM can find this vuln and construct a working exploit. Usage gcc -o poc poc.c ./poc...

CVE-2021-41773-Exploit-Lab

CVE-2021-41773 — Exploit Development Lab Overview This project documents the research, reproduction, and Proof-of-Concept PoC development for CVE-2021-41773, a Path Traversal vulnerability affecting Apache HTTP Server 2.4.49. The vulnerability was reproduced in an isolated Docker laboratory...

awesome-exploit-development

awesome-exploit-development A curated list of resources books, tutorials, courses, tools and vulnerable applications for learning about Exploit Development A project by Fabio Baroni. Read the full article here!...

CVE-2022-22947-exp

CVE-2022-22947-exp Reproduced the CVE-2022-22947 vulnerability, wrote an exploit exp Later, based on an article by a senior, wrote an exp for memory horse injection, for reference only...

Awesome-Fuzzing

Welcome to Awesome Fuzzing A curated list of fuzzing resources Books, courses - free and paid, videos, tools, tutorials and vulnerable applications to practice on for learning Fuzzing and initial phases of Exploit Development like root cause analysis. Contents Books Courses Free Paid Videos NYU...

AI_HACKING

AIHACKING Collection of CVEwork on tenserflow binary pwning it FOR CVE202223591WHICH IS STILL UNDER WORK I NEED TO FIGURE OUT HOW TO TURN BACK JSON TO PROTOBUF AND THAN DO with tf.io.gfile.GFile'test.pb', 'rb' as f: graphdef = tf.compat.v1.GraphDef print"aiciaaaaaaaaaaaaaa" printgraphdef...

cve-2026-40369-exploit

This references https://voidsec.com/cve-2026-40369-browser-sandbox-escape/, the approach differs significantly from https://github.com/orinimron123/CVE-2026-40369-EXPLOIT, and since I didn't see any public exp from them, I documented it...

Ponce

Ponce Ponce pronounced 'poN θe pon-they is an IDA Pro plugin that provides users the ability to perform taint analysis and symbolic execution over binaries in an easy and intuitive fashion. With Ponce you are one click away from getting all the power from cutting edge symbolic execution. Entirely...

CVE-2025-5548

💣 Exploit Development - Buffer Overflow This repository documents the full process of exploiting a Buffer Overflow vulnerability, following a structured methodology from initial analysis to execution flow control. 🎯 Objective The goal of this phase is to develop a functional exploit that allows...