WELA

WELA Windows Event Log Analyzer ゑ羅 A tool for auditing Windows event log settings. Created by Yamato Security — make sure you are actually recording the events that matter for DFIR. 📖 Read the Documentation → Available in 15 languages — English · 日本語 · 繁體中文 · 한국어 · Deutsch · Türkçe · Français ·...

steghide

Ce dépôt est en lecture seule. Une organisation GitHub,StegHigh, a été mise en place pour maintenir steghide. Veuillez soumettre toutes les PR, discussions et problèmes là-bas. De plus,StegHigh/steghide recherche des mainteneurs. Veuillez contribuer ! Introduction : Steghide est un programme de...

ClickOnceBlobber

ClickOnce AppDomainManager Injection Toolkit Weaponize signed .NET ClickOnce applications for initial access by hijacking a dependency DLL via AppDomainManager injection and loading a C port of ProxyBlob Agent. Ships with a C port of ProxyBlob — a SOCKS5 proxy that tunnels all traffic through Azu...

ThreatActors-TTPs

THREAT ACTORS AND RANSOMWARES - TTPs This repository was created with the aim of assisting companies and independent researchers in studying the Tactics, Techniques, and Procedures TTPs , based on the MITRE ATT &CK framework, adopted by active or inactive Ransomware operators/groups and other...

lsawhisper-bof

LSA Whisperer BOF A Cobalt Strike Beacon Object File BOF port of LSA Whisperer — the tool that talks directly to Windows authentication packages through the LSA untrusted/trusted client interface, without touching LSASS process memory even when PPL and Credential Guard is enabled. Why This Exists...

morphHTA

Disclaimer As usual, this code and tool should not be used for malicious purposes. Written by Vincent Yiu of MDSec Consulting's ActiveBreach team. Modification of code is allowed with credits to author. Explorer and SWBemLocator COM Moniker research is by @enigma0x3 morphHTA Usage : usage:...

CVE-2026-5201

CVE-2026-5201 gdk-pixbuf JPEGローダーにおけるヒープベースのバッファオーバーフロー こんにちは、Kağan Çapar です。私は、実質的にすべてのLinuxデスクトップ環境に影響するgdk-pixbufのJPEG画像ローダーにおけるヒープベースのバッファオーバーフロー脆弱性を発見しました。この脆弱性には CVE-2026-5201 が割り当てられ、Red Hat によって CVSS スコア 7.5 重要 として確認されました。 このリポジトリには、私の完全な分析、ゼロから作成した再現コード、および実際の Ubuntu 24.04 LTS...

azazel

Azazel A lightweight eBPF-based runtime security tracer purpose-built for malware analysis sandboxes. Drop a sample into an isolated container, and Azazel captures every syscall, file touch, network connection, and suspicious behavior, then hands you a clean JSON stream of everything that happene...

jvmxray

JVMXRay: Java Application Security Monitoring Duke history Documentation | Changes from Upstream | Project Blog JVMXRay monitors Java applications in real-time via bytecode injection, detecting vulnerabilities and suspicious activity without code changes. 19 modular sensors track file access,...

jvmxray

JVMXRay: مراقبة أمان تطبيقات Java تاريخ Duke التوثيق | التغييرات من المنبع | مدونة المشروع يراقب JVMXRay تطبيقات Java في الوقت الفعلي عبر حقن البايت كود، ويكشف الثغرات والأنشطة المشبوهة دون تغيير الكود. 19 مستشعرًا معياريًا يتتبعون الوصول إلى الملفات، اتصالات الشبكة، استعلامات SQL، العمليات...

posta

Posta Posta is a tool for researching Cross-document Messaging communication. It allows you to track, explore and exploit postMessage vulnerabilities, and includes features such as replaying messages sent between windows within any attached browser. Prerequisites Google Chrome / Chromium Node.js...

osint_toolkit

OSINT Toolkit Warning OSINT Toolkit is not production ready yet. This is an early prototype, that still needs some work to be done. A fullstack web application built for security analysts OSINT Toolkit is a self-hostable, on-demand analysis platform designed for security specialists. It...

threadtear

Threadtear Threadtear is a multifunctional deobfuscation tool for java. Android application support is coming soon Currently working on a dalvik to java converter. Suitable for easier code analysis without worrying too much about obfuscation. Even the most expensive obfuscators like ZKM or String...

AllTools

AllTools All reasonably stable tools AccessMask - decode access mask for common object types BgInfo - WPF version of the Sysinternals BgInfo tool BITSMgr - BITS jobs manager application CLR Explorer - View .NET process information / dump file CpuStres - thread/CPU stress testing app CpuStress...

sigint-hombre

sigint-hombre Author: John Page — malvuln aka hyp3rlinx Copyright c 2026 Purpose: Generate derived Suricata detection rules from live URLhaus threat indicators at runtime and deploy them to the Security Onion platform for high-coverage real-time network monitoring. Current Version v2.0 • Major...

sigmalite

github.com/runreveal/sigmalite Package sigmalite provides a parser and an execution engine for the Sigma detection format. rule, err := sigmalite.ParseRulebyte title: My example rule detection: keywords: - foo - bar selection: EventId: 1234 condition: keywords and selection if err != nil return e...

CVE-2019-7609

CVE-2019-7609 استغلال CVE-2019-7609 Kibana RCE بالطريقة الصحيحة عبر سكربتات python2 لقطة شاشة الاستخدام python2 CVE-2019-7609-kibana-rce.py -h usage: CVE-2019-7609-kibana-rce.py -h -u URL -host REMOTEHOST -port REMOTEPORT --shell optional arguments: -h, --help show this help message and exit -u U...

SysmonCommunityGuide

Guide communautaire Sysmon de TrustedSec Cette œuvre est sous licence Licence Creative Commons Attribution - Partage dans les mêmes conditions 4.0 International, veuillez attribuer à TrustedSec LLC Vous êtes libre de : Partager — copier et redistribuer le contenu sur tout support ou format. Adapt...

ms-photos_NTLM_Leak

Microsoft ms-photos URI NTLM Leak New vulnerability allowing to leak NTLM hashes from browsers with one click By Ruben Enkaoua Description The Microsoft ms-photos URI scheme takes fileName as parameter, which can be submitted with a UNC path, leaking NTLMv2-SSP hashes one opened. By crafting a...

polypyus

Polypyus Firmware Historian Polypyus learns to locate functions in raw binaries by extracting known functions from similar binaries. Thus, it is a firmware historian. Polypyus works without disassembling these binaries, which is an advantage for binaries that are complex to disassemble and where...