SysWhispers3

SysWhispers3 SysWhispers ayuda con la evasión generando archivos de cabecera/ASM que los implantes pueden usar para realizar llamadas directas al sistema. Canal oficial de Discord ¡Ven a pasar el rato en Discord! ¿Por qué demonios no creé un PR para SysWhispers2? Las razones para que SysWhispers3...

pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

tracee

Before moving on, please consider giving us a GitHub star ⭐️. Thank you! About Tracee Tracee is a runtime security and observability tool that helps you understand how your system and applications behave. It is using eBPF technology to tap into your system and expose that information as events tha...

gustave

c Airbus 2021, sduverger GUSTAVE - Embedded OS kernel fuzzer What is it ? GUSTAVE is a fuzzing platform for embedded OS kernels. It is based on QEMU and AFL and all of its forkserver siblings. It allows to fuzz OS kernels like simple applications. Thanks to QEMU, it is multi-platform. One can see...

MalDev

MalDev Hey! Welcome to my repo : I am Captain Magma, a passionate individual dedicated to cybersecurity, malware development, and analysis. The design for this repository is to manage my MalDev road-path as I learn and update this repository with my notes and code. I am not the author of any of...

SysWhispers4

SysWhispers4 AV/EDR evasion via direct and indirect system calls Windows NT 3.1 through Windows 11 24H2 · x64 · x86 · WoW64 · ARM64 SysWhispers4 is a Python-based syscall stub generator that produces C/ASM code for invoking NT kernel functions directly, bypassing user-mode hooks placed by AV/EDR...

rsyscall

Summary rsyscall is a library which provides a interface to an ever-growing subset of Linux system calls. This interface is: process-independent : all system calls are called as methods on process objects, which can refer to the "local" process or to other processes under our control, possibly on...

tiny_tracer

tinytracer A Pin Tool for tracing: API calls, including input and output of selected functions defined local functions, and functions from statically linked libraries selected instructions: RDTSC, CPUID, INT inline system calls, including parameters of selected syscalls transition between section...

BestEdrOfTheMarket

Mejor EDR del Mercado BEOTM V3 🐲🏴‍☠️ Best Edr Of The Market es un laboratorio de código abierto diseñado para implementar y comprender, desde una perspectiva de bajo nivel, los métodos de detección utilizados por los productos de seguridad de detección y respuesta de endpoints EDR y sus soluciones...

SysWhispers2

SysWhispers2 SysWhispers helps with evasion by generating header/ASM files implants can use to make direct system calls. All core syscalls are supported and example generated files available in the example-output/ folder. Difference Between SysWhispers 1 and 2 The usage is almost identical to...

CallStackSpoofer

CallStackSpoofer Questo repository dimostra un'implementazione PoC per spoofare call stack arbitrarie quando si effettuano chiamate di sistema. Per una descrizione tecnica completa, consulta il post del blog qui: https://labs.withsecure.com/blog/spoofing-call-stacks-to-confuse-edrs. Di default...

osx-re-101

osx & ios re 101 Lavori in corso, li sto raccogliendo attivamente. Da leggere assolutamente https://reverse.put.as/ https://blog.paloaltonetworks.com/tag/mac-os-x/ https://www.synack.com/blog/r-d-projects/os-x-security-research/ https://pewpewthespells.com/re.html https://github.com/bx/machO-tool...

LetMeowIn

LetMeowIn Un dump di LSASS sofisticato e furtivo che utilizza C++ e MASM x64. Come visto su Binary Defense e Cyber Security News Esclusione di responsabilità Non essere malvagio con questo. Ho creato questo strumento per imparare. Non sono responsabile se i federali bussano alla tua porta...

play-go-copy-fail-cve-2026-31431

Play Go Copy Fail CVE-2026-31431 उद्देश्य लिनक्स सिस्कॉल निम्न-स्तरीय सीखें पायथन और सी को गोलैंग में पोर्ट करें अपना खुद का पेलोड तैयार करें और फिर नौसिखिए के रूप में एक्सप्लॉइट करें पीटीवाई को मैन्युअल रूप से ऑटो-अपग्रेड करें प्रेरणा tgies/copy-fail-c painoob/Copy-Fail-Exploit-CVE-2026-31431...

PT-2026-79296

Software installed and run as a non-privileged user may conduct GPU system calls which cause GPU memory leaks and possible kernel heap corruption. Scenario caused by memory free paths not maintaining state data of upgraded higher order allocations. This could cause memory leak or double free even...

CVE-2026-49428

In FreeBSD's posixshm module, open(2) with O_TRUNC and fspacectl(2) failed to verify whether operations are permitted on largepage objects, incorrectly freeing kernel memory. An unprivileged local user can read freed kernel memory and escalate privileges. Affected: all supported versions prior to...

EUVD-2026-54956

A vulnerability was determined in bartekke8it56w2 new-mcp 0.1.0. This impacts the function fs.writeFileSync/fs.existsSync/fs.readFileSync of the file index.ts of the component geminithinking. This manipulation of the argument sessionCommand/sessionPath causes path traversal. The attack requires...

CVE-2026-45204

Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger OOB access and kernel null pointer dereference in an error path. Null pointer dereference occurs in an error path of a function running in kernel thread of execution leading to kernel exceptions,...

EUVD-2026-54348

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memory access and in certain cases cause GPU UAF of arbitrary pages. Incorrect validation of array index can lead to OOB read and potentially to GPU UAF of arbitrary pages...

Important: Red Hat Security Advisory: rhc security update

An update for rhc is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...