A repository of LIVE malwares for your own joy and pleasure. theZoo is a project created to make the possibility of malware analysis open and available to the public.
- malware
- malware-analysis
- malware-samples
- malware-research
Repository Index
47,133 repositories indexed
1–24 of 32 · Most stars
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
Malware Configuration And Payload Extraction
- configs
- debugging-tools
- malware
- malware-analysis
A deliberately vulnerable CI/CD environment. Learn CI/CD security through multiple challenges.
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
- cve-2026-109618
- cve-2026-109619
- detection-rules
- exploit
yarGen is a generator for YARA rules
- python
- yara
- malware
- malware-research
Extract and aggregate threat intelligence.
- ioc
- indicators-of-compromise
- threatintel
- threat-intelligence
Sandboxed Execution Environment
Modular file scanning/analysis framework
- python
- analytic-machines
- analysis-framework
- python-script
Defanged Indicator of Compromise (IOC) Extractor.
- ioc
- indicators-of-compromise
- library
- ioc-extractor
Simplifying encrypted traffic analysis for researchers by making protocol decryption effortless.
Samsung Tizen root
- embedded-linux
- firmware-analysis
- hardware-hacking
- mali-gpu
MQTT-PWN intends to be a one-stop-shop for IoT Broker penetration-testing and security assessment operations.
- python
- mqtt
- mqtt-broker
- mqtt-client
Limon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time indicators of Linux malware. It allows one to inspect Linux malware before execution, during execution, and after execution (post-mortem analysis) by performing static, dynamic and memory analysis using open source tools
CVE-2026-109618 / CVE-2026-109619 pre-auth RCE in PHP session.upload_progress (mod_php): version-aware exploit profiles, Docker labs, heap calibration and detection guidance.
- cve-2026-109618
- cve-2026-109619
- exploit
- mod-php
Python implementation of the Packed Executable iDentifier (PEiD)
- peid
- peid-signature
- pe-file
- pe-files
Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design
- exploit
- php
- php2shell
- php2shell-cve
A modular Python application to pull intelligence about malicious files
- malware-analysis
- malware-research
- investigation
- cybersecurity
PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full control ladders, fixed-version negative control on 8.5.12
- cve-2026-109618
- cve-2026-109619
- exploit
- memory-corruption
This repository contains reverse engineering results and resources for a few specific car models of a very specific car manufacturer. Please don't sue.
- car-hacking
- automotive-security
Code for our DLS'21 paper - BODMAS: An Open Dataset for Learning based Temporal Analysis of PE Malware. BODMAS is short for Blue Hexagon Open Dataset for Malware AnalysiS.
- malware
- pe-malware
- malware-dataset
- malware-research
AI-powered platform for OSINT intelligence analysis. Features archive discovery with hypothesis-driven investigation, GLiNER entity extraction, Mapbox geospatial visualization, network analysis, and document processing. Built with FastAPI, Next.js, Weaviate, and DSPy.
- ai-agents
- document-processing
- dspy
- entity-extraction
Docker image gathering packers and tools for making datasets of packed executables and training machine learning models for packing detection
- docker-image
- executable-packing
- malware-packers
- research-platform
Sublime Malware Research Tool