A work-in-progress deobfuscator for movfuscated binaries
Repository Index
47,133 repositories indexed
25–48 of 56 · Most stars
ClamAV antivirus scanning for Node.js — scan file uploads with a single function call. Zero dependencies. Typed Symbol verdicts. Local or Docker/clamd.
- clamscan
- file-scanner
- virus-scan
- docker-compose
Fake sshd that logs ip addresses, usernames, and passwords.
Simple promise-based session middleware for Next.js, micro, Express, and more
- javascript
- middleware
- session
- promise
DC3 Malware Configuration Parser (DC3-MWCP) is a framework for parsing configuration information from malware. The information extracted from malware includes items such as addresses, passwords, filenames, and mutex names.
- python
- malware-analysis
- automation
- config-dump
Respounder detects presence of responder in the network.
- responder
- golang
- network-security-monitoring
- network-security
A collection of useful utility functions
- utility
- utilities
- string
- strings
CVE-2026-109618 / CVE-2026-109619 pre-auth RCE in PHP session.upload_progress (mod_php): version-aware exploit profiles, Docker labs, heap calibration and detection guidance.
- cve-2026-109618
- cve-2026-109619
- exploit
- mod-php
Pakkero is a binary packer written in Go made for fun and educational purpose. Its main goal is to take in input a program file (elf binary, script, even appimage) and compress it, protect it from tampering and intrusion.
- launcher
- payload
- elf
- elf-binaries
Open source Windows x64 PE packer and crypter. Compresses and encrypts executables with a custom virtual machine into a self extracting stub.
- compression
- packer
- pe-packer
- pe-compress
Encrypted Chat. No History. No Logs.
- encryption
- nacl
- chat
- secure
PHP2Shell exploit framework — CVE-2026-109618/619 PHP session.upload_progress UAF to RCE
A Wordpress Honeypot
RSA public/private key encryption, private key signing and public key verification in Swift using the Swift Package Manager. Works on iOS, macOS, and Linux (work in progress).
- swift
- rsa-cryptography
- rsa-signature
- macos
php2shell (CVE-2026-109618 & CVE-2026-109619) security patches for EOL PHP 5.4–8.1. Official & enhanced backports for vanilla php.net and Remi Collet trees. Restores safe file uploads & progress bars without RCE. Fleet-tested on OpenCart, WordPress, HestiaCP, aaPanel.
- cve
- hestiacp
- opencart
- php
PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full control ladders, fixed-version negative control on 8.5.12
- cve-2026-109618
- cve-2026-109619
- exploit
- memory-corruption
A PE (Portable Executable) packer with Huffman Compression and Xor encryption.
- huffman-compression
- huffman-algorithm
- pe-header
- packer
Simple Connect / Express Steam authentication library.
Comprehensive security for Lucky framework
- lucky-framework
- authentication
- security
- crystal
Analysis tool for estimating the likelihood that a binary contains compressed or encrypted bytes
- entropy
- pe-file
- pe-files
- pe-format
a native library implementing secp256k1 purely for the crystal language.
- crystal
- crystal-language
- native-library
- secp256k1
Proof of concept denial of service over TOR stress test tool
go-fasttld is a high performance effective top level domains (eTLD) extraction module.
- compressed-trie
- idn
- idna
- ipv4
WordPress Honeypot