Fnord

Fnord Fnord is a pattern extractor for obfuscated code Description Fnord has two main functions: 1. Extract byte sequences and create some statistics 2. Use these statistics, combine length, number of occurrences, similarity and keywords to create a YARA rule 1. Statistics Fnord processes the fil...

Nodejs-Tracer

nodejs-tracer Simple Node.jstracer that logs calls to core modules, can spoof certain calls to defeat anti-analysis, save files written by the application and more. Useful to analyze heavily obfuscated Node.js malware. Usage root@kitploit: node -r .\tracer.js main.js Example trace with DISPLAYSTA...

foolav

foolav Executable compiled with this code is useful during penetration tests where there is a need to execute some payload meterpreter maybe? while being certain that it will not be detected by antivirus software. The only requirement is to be able to upload two files: binary executable and paylo...

np-audit

np-audit — npm package auditor Static security analysis for npm packages — detects obfuscated lifecycle scripts, known vulnerabilities, and malicious patterns before they run. Drop-in replacement for npm install and...

Krakatau

Krakatau provides an assembler and disassembler for Java bytecode, which allows you to convert binary classfiles to a human readable text format, make changes, and convert it back to a classfile, even for obfuscated code. You can also create your own classfiles from scratch by writing bytecode...

PSAsyncShell

PSAsyncShell PSAsyncShell es una Shell TCP Inversa Asíncrona escrita en PowerShell puro. A diferencia de otros reverse shells, todo el flujo de comunicación y ejecución se realiza de forma asíncrona, permitiendo omitir algunos firewalls y algunas contramedidas contra este tipo de conexiones...

ObfuscatedSharpCollection

Obfuscated SharpCollection Quick and dirty stab at automated Obfuscation using yetAnotherObfuscator by @0xcc00 together with fresh builds of common C offensive tools, in a CDI fashion using Azure DevOps release pipelines. Obfuscated SharpCollection is not intended to be as complete as the...

ios-malicious-bithunter

iOS Malicious Bit Hunter Abstract iOS Malicious Bit Hunter is a malicious plug-in detection engine for iOS applications. It can analyze the head of the macho file of the injected dylib dynamic library based on runtime, and can perform behavior analysis through interface input characteristics to...

kong

Kong: The Agentic Reverse Engineer LLM orchestration for reverse engineering binaries What is Kong? Most tasks follow a linear relationship: the more difficult a task, the longer it usually takes. Reverse engineering and binary analysis is a task in which the actual difficulty is somewhat trivial...

GWTMap

Description GWTMap is a tool to help map the attack surface of Google Web Toolkit GWT based applications. The purpose of this tool is to facilitate the extraction of any service method endpoints buried within a modern GWT application's obfuscated client-side code, and attempt to generate example...

CVE-2024-3094-info

CVE-2024-3094-info CVE-2024-3094 PoC Exploration https://github.com/amlweems/xzbot https://github.com/lockness-Ko/xz-vulnerable-honeypot https://tukaani.org/xz-backdoor/ - Lasse Collin response https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27...

PolinRider

PolinRider: DPRK Threat Actor Implants Malware in Hundreds of GitHub Repos Date: 2026-03-07 Last updated: 2026-04-11 — see April 10–11 Update below Severity: CRITICAL — active supply chain infection across 1,950+ public repositories, confirmed operational merger with the TasksJacker / Contagious...

Graffiti

NOTE : Never upload payloads to online checkers Graffiti is a tool to generate obfuscated oneliners to aid in penetration testing situations. Graffiti accepts the following languages for encoding: Python Perl Batch Powershell PHP Bash Graffiti will also accept a language that is not currently on...

CVE-2019-0708-POC

CVE-2019-0708-POC CVE-2019-0708 の動作する概念実証コードです。リモートシェルを起動します。 python3 で実行します。 使用例 python3 CVE-2019-0708-windows.py Linux と Windows では異なるバージョンが必要です。 明白な理由により難読化されています。...

slopShell

slopShell php webshell Since I derped, and forgot to talk about usage. Here goes. For this shell to work, you need 2 things, a victim that allows php file uploadyourself, in an educational environment and a way to send http requests to this webshell the client script is the 100% best way to...

qs_old

QuickSand.io For QuickSand Version 2 written in Python with PDF analysis support, see quicksand.io. QuickSand Version 1 Lite is no longer being actively developed. QuickSand is a compact C framework to analyze suspected malware documents to 1 identify exploits in streams of different encodings, 2...

svg_phishing_tools

SVG セキュリティ解析ツールキット - ツールドキュメント このツールキットには、悪意のある可能性のある SVG ファイルを解析し、セキュリティメカニズムを検出するための専門的な Python ツールが含まれています。 概要 このツールキットは、主に 4 つのツールで構成されています： 1. extract.py - 難読化された URL 抽出のための静的解析 2. extractdynamic.py - box-js を使用した JavaScript 実行のための動的解析 3. cfprobe.py - Cloudflare 保護の検出（Turnstile、CAPTCHA など）...

MyLog4Shell

MyLog4Shell log4j RCE Exploitation Detection You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228 Grep / Zgrep This command searches for exploitation attempts in uncompressed files in folder /var/log - '/usr/var/log' and all sub...

flare-floss

FLOSS スクリプト FLOSS は出力をさまざまなツール用のスクリプトに変換する機能をサポートしています。このディレクトリにあるレンダースクリプトを参照してください。 さらに、FLOSS が難読化された文字列を自動的に抽出し、IDA で現在ロードされているモジュールに適用できるようにする IDA 用プラグイン もあります。idaplugin.py は、IDA Pro 内で直接実行できる IDAPython スクリプトです File - Script File... ALT + F7。 インストール これらのスクリプトは、FLOSS の GitHub...

CVE-2024-3094-XZ-Backdoor-Detector

Description Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific...