Repository Index

A revamped and updated version of my original OneRuleToRuleThemAll hashcat rule

CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows.

Linker/Compiler/Tool detector for Windows, Linux and MacOS.

• detect
• reverse-engineering
• signature
• malware-analysis

DC3 Malware Configuration Parser (DC3-MWCP) is a framework for parsing configuration information from malware. The information extracted from malware includes items such as addresses, passwords, filenames, and mutex names.

• python
• malware-analysis
• automation
• config-dump

Lua Decompiler for Lua version 5.1

• lua
• c
• decompiler

The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices

🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.

Enable root SSH on BMW MGU head units (iDrive 7 / ID8 BDC3 / ID8 BCP) over ENET - flash the debug image, enroll, persistent SSH with no B7F8E5 DTC, and a unique per-car key.

• developer-mode
• idrive
• idrive7
• root

A collection of useful utility functions

• utility
• utilities
• string
• strings

CVE-2026-109618 / CVE-2026-109619 pre-auth RCE in PHP session.upload_progress (mod_php): version-aware exploit profiles, Docker labs, heap calibration and detection guidance.

• cve-2026-109618
• cve-2026-109619
• exploit
• mod-php

We took PersistenceSniper, merged it with Python, and misspelled it on purpose. Meet PyrsistenceSniper.

• cybersecurity
• cybersecurity-tools
• incident-response
• security

CMS/LMS/Library etc Versions Fingerprinter

• fingerprinting
• cms
• security-tools

macOS persistence tool

• persistence
• macos

Android Loadable Kernel Modules - mostly used for reversing and debugging on controlled systems/emulators

• loadable-kernel-modules
• android-lkms
• emulators
• kernel

A framework for the JOSE standards JWS, JWE, and JWK written in Swift.

• jws
• jwk
• swift
• jwe

SuperGhidra: Autonomous Agent Reverse Engineering, Lock-Free Ghidra Daemon & C++ Recovery Suite

• arm64
• binary-analysis
• decompiler
• disassembler

Portable version of Bouncy Castle with support for .NET 4, .NET Standard 2.0, MonoAndroid, Xamarin.iOS, .NET Core

PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full control ladders, fixed-version negative control on 8.5.12

• cve-2026-109618
• cve-2026-109619
• exploit
• memory-corruption

Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabbing, version-based detection.

• crtsh
• cve
• cve-2026-109618
• cve-2026-109619

Repo for the Open Source version of NOVA

A version of TurboPower LockBox2, that is aimed at being compatible with Delphi, FPC and Lazarus 32/64 bit

Common Lisp system for parsing and generating bcrypt password hashes

• bcrypt
• cl-bcrypt
• common-lisp
• password-hashing

Patched version of as3crypto (ActionScript)

A Single Library Parser to extract meta information,static analysis and detect macros within the files.

• malware-analysis
• pdf-parsing
• pe-executable
• office-files