nullscan

Description A modular framework designed to chain and automate security tests. It parses target definitions from the command line and runs corresponding modules and their nullscan-tools afterwards. It can also take hosts and start nmap first in order to perform a basic portscan and run the module...

fibratus

Fibratus Security sensor for realtime threat detection and protection Get Started » Docs • Rules • Filaments • Download • Discussions Fibratus detects and eradicates advanced attacker tradecraft, malware, and emerging threats by scrutinizing and asserting a wide spectrum of system events against ...

ShadeBIOS

Shade BIOS README is present in each Pkg folder ModuleLoaderPkg: DXE module that loads & executes DXE modules from a USB stick ShadeBiosPkg: Main Shade BIOS package VarPrintPkg: Library that allows printing debug messages or statuses to the UEFI variables Author Kazuki Matsuo. © FFRI Security, In...

mad-metasploit

Metasploit custom modules, plugins, resource script and.. awesome metasploit collection https://www.hahwul.com/p/mad-metasploit.html Awesome open awesome.md Add mad-metasploit to metasploit framework 1. config your metasploit-framework directory $ vim config/config.rb $metasploitpath =...

rpef

Router Post-Exploitation Framework Currently, the framework includes a number of firmware image modules: 'Verified' - This module is confirmed to work and is stable. 'Unverified' - This module is believed to work or should work with little additional effort, but awaits being tested on a physical...

shed

Shed - .NET runtime inspector Shed is an application that allow to inspect the .NET runtime of a program in order to extract useful information. It can be used to inspect malicious applications in order to have a first general overview of which information are stored once that the malware is...

Maverick

Maverick An Adaptix C2 agent built with Crystal Palace — a custom PIC Position Independent Code linker and PICO module system. Demonstrates how to build modular shellcode agents where each component transport, tasks, obfuscation is a separate PICO blob loaded at runtime. Note This agent does not...

xmap

XMap: The Internet Scanner XMap is a fast network scanner designed for performing Internet-wide IPv6 & IPv4 network research scanning. XMap is reimplemented and improved thoroughly from ZMap and is fully compatible with ZMap, armed with the "5 minutes" probing speed and novel scanning techniques...

nmlinux

NMLinux · v1.7.14 A unified network toolkit for Linux and macOS — inspect, connect, diagnose. NMLinux is a single, unified GUI that brings together 29 network modules in one window: interface monitoring, Wi-Fi, DNS, SSH terminal, firewall viewer, topology map, traceroute, and more. Built from...

doona

Doona - Network fuzzing tool .:: About ::. Doona is a fork of the Bruteforce Exploit Detector Tool BED. BED is a program which is designed to check daemons for potential buffer overflows, format string bugs etc. Doona is Australian for duvet. It adds a significant enough number of features/change...

beef

=============================================================================== Copyright c 2006-2026 Wade Alcorn - [email protected] Browser Exploitation Framework BeEF - https://beefproject.com See the file 'doc/COPYING' for copying permission...

yara

!IMPORTANT This project is in maintenance mode. More info: https://virustotal.github.io/yara-x/blog/yara-x-is-stable/ YARA in a nutshell YARA is a tool aimed at but not limited to helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malwar...

pcileech

PCILeech Summary: PCILeech uses PCIe hardware devices to read and write target system memory. This is achieved by using DMA over PCIe. No drivers are needed on the target system. PCILeech also works without hardware together with a wide range of software memory acqusition methods supported by the...

redpill

:octocat: Project Description The redpill project aims to assist reverse tcp shells in post-exploration tasks. Often, on redteam appointments we need to use unconventional ways to access the target system, like reverse tcp shells not metasploit in order to bypass the defenses implemented by the...

mal_unpack

malunpack Dynamic unpacker based on PE-sieve 📖 Read more . It deploys a packed malware, waits for it to unpack the payload, dumps the payload, and kills the original process. !CAUTION This unpacker deploys the original malware. Use it only on a VirtualMachine. ⚙ Usage Basic usage: malunpack.exe...

flare-learning-hub

FLARE Learning Hub The FLARE Learning Hub freely distributes quality reverse engineering and malware analysis educational content from the FLARE team. The FLARE Learning Hub modules are hosted as web-published Google Docs, which are linked in the respective descriptions below. This repository...

zuthaka

A collaborative free open-source Command & Control integration framework that allows developers to concentrate on the core function and goal of their C2. Explore the docs » · Report Bug · Request Feature · Table of Contents 1. About The Project Problem statement Solution Built With 2. Already...

dropengine

by @s0lst1c3 Current release: v0.1.0-alpha Supports Python 3.7+. Overview Defense Evasion techniques tend to have a short shelf-life, and this is especially true for techniques used during initial access. Because of this, initial access payloads are often prepared on a per-engagement basis, which...

DevSec-Defense

DevSec-Defense Accompanying PowerShell Modules & Demos for DevSec Defense Presentation DevSec Defense: How DevOps Practices Can Drive Detection Development For Defenders...

ssct

ShadowSocks ConnecTion A wrapper tool for shadowsocks to consistently bypass firewalls. Quick start Automatically connect The easiest way to run this tool is just type ssct in terminal, and ssct will acquire available shadowsocks servers from ishadowsocks and connect to it automatically. Connect ...