codeql

CodeQL Questo repository open source contiene le librerie e le query CodeQL standard che alimentano GitHub Advanced Security e gli altri prodotti di sicurezza applicativa che GitHub mette a disposizione dei suoi clienti in tutto il mondo. Come imparare CodeQL ed eseguire query? Esiste un'ampia...

static-code-analysis-helper

Static-Code-Analysis-Helper Description It detects functions that are likely to cause attack methodologies in many web programming languages ​​and frameworks in your project folder. Helps you perform static code analysis. Note : Many of the functions described here may not cause vulnerabilities...

ida-efitools2

About It is an IDA plugin for extending UEFI reverse engineering capabilities. Based on ida-efitools with a bunch of fixes and new features. Works with both Python 2 and Python 3. Supports outdated versions of IDA Pro 7.x with no guarantees. Features GUIDs defining Structures propagating register...

cobol-shield

cobol-shield Security auditing toolkit for COBOL legacy systems Part of VTR Research Methodology | DOI: 10.5281/zenodo.22063208 Status: Reproducible | License: MIT | Track: Critical Infrastructure What it does Detects compilation context divergences, invisible Unicode attacks, and unsafe COBOL...

MobileApp-Pentest-Cheatsheet

Mobile Application Penetration Testing Cheat Sheet The Mobile App Pentest cheat sheet was created to provide concise collection of high value information on specific mobile application penetration testing topics and checklist, which is mapped OWASP Mobile Risk Top 10 for conducting pentest. Mobil...

smoke_conf_extract

Smoke Config Extraction Overview This project aims to extrct configurations from smokeloader samples starting at the initial stage. I was set on doing this statically so had to rely on things like Unicorn to bypass some of the more complicated components. Regardless of how this extraction works f...

haruspex

haruspex "Hacking is the discipline of questioning all your assumptions all of the time." -- Dave Aitel Haruspex is a blazing-fast IDA headless plugin that extracts pseudocode generated by IDA's decompiler in a format that should be suitable to be imported into an IDE, or parsed by static analysi...

Asyncrat-Venom-Dcrat-Config-Extractor

Asyncrat-Venom-Dcrat-Config-Extractor Static Config Extractor for Asyncrat/Dcrat/VenomRat Utilises dnlib to locate encrypted Config data and associated Encryption values. Values are decrypted in the script without emulating or executing malware code Assumes config lies under the Client.Settings...

AuraBorealisApp

AuraBorealis: Do You Know What's In Your Python Packages? About AuraBorealis is a web application for visualizing anomalous and potentially malicious code in Python package registries. It uses security audit data produced by scanning the Python Package Index PyPI via Aura, a static analysis...

gokart

GoKart - Análisis Estático de Seguridad para Go GoKart es una herramienta de análisis estático para Go que encuentra vulnerabilidades utilizando la forma SSA asignación única estática del código fuente Go. Es capaz de rastrear el origen de variables y argumentos de funciones para determinar si la...

gokart

GoKart - Go Security Static Analysis GoKart is a static analysis tool for Go that finds vulnerabilities using the SSA single static assignment form of Go source code. It is capable of tracing the source of variables and function arguments to determine whether input sources are safe, which reduces...

jsprime

Authors Nishant Das Patnaik nishant.dp@ Sarathi Sabyasachi Sahoo sarathisahoo@ Introduction Today, more and more developers are switching to JavaScript as their first choice of language. The reason is simple JavaScript has now been started to be accepted as the mainstream programming for...

pyre-check

!WARNING This Repository Is Archived This repository is no longer maintained and has been archived. Type checking: Pyre has been replaced by Pyrefly, our next-generation Python typechecker and language server. Security analysis Pysa: Pysa has moved to its own repository at github.com/facebook/Pys...

pyre-check

!WARNING Este repositorio está archivado Este repositorio ya no se mantiene y ha sido archivado. Type checking: Pyre ha sido reemplazado por Pyrefly, nuestro verificador de tipos y servidor de lenguaje de próxima generación para Python. Análisis de seguridad Pysa: Pysa se ha trasladado a su propi...

flare-qdb

FireEye Labs Query-Oriented Debugger flare-qdb is a command-line and scriptable Python-based tool for evaluating and manipulating native program state. It uses Vivisect to set a breakpoint on each queried instruction and executes Python code when hit. flare-qdb frees the analyst to take a nonline...

ApkAnalyser

Copyright C 2012 Sony Mobile Communications AB This file is part of ApkAnalyser. Licensed under the Apache License, Version 2.0 the "License"; you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless...

gradle-static-analysis-plugin

DEPRECATED Gradle static analysis plugin ⚠️ A fork of this project is maintained at https://github.com/GradleUp/static-analysis-plugin/ Please migrate by using com.gradleup.static-analysis plugin id instead. A Gradle plugin to easily apply the same setup of static analysis tools across different...

octopus

Octopus Huge thanks to QuoScient for having sponsored this project. Octopus is a security analysis framework for WebAssembly module and Blockchain Smart Contract. The purpose of Octopus is to provide an easy way to analyze closed-source WebAssembly module and smart contracts bytecode to understan...

sast-scan-action

Offensive360 SAST Scan — GitHub Action Run a full Offensive360 static application security scan SAST on every push or pull request. Deep taint and data-flow analysis across 60+ languages, results as SARIF for the GitHub code scanning tab, and a severity gate for your pipeline. Free for open sourc...

BlueBox

BlueBox Malware analysis Box and Cyber threat Hunting What is it? Threat intelligence data about a malware, an IP or a domain , URL ? a Quick Analysis suspicious File or Malware ! BlueBox is an Open Source Intelligence, or OSINT solution to get threat intelligence data about a specific file, an I...