Repository Index

Cross-platform, open-source shellbag parser

x86 emulation and shellcode detection

Invoke-LiveResponse

• ir
• dfir
• winrm
• liveresponse

A docker based honeypot.

Detect hidden files and text in images

• steganography
• ctf
• stego
• capture-the-flag

php2shell (CVE-2026-109618 & CVE-2026-109619) security patches for EOL PHP 5.4–8.1. Official & enhanced backports for vanilla php.net and Remi Collet trees. Restores safe file uploads & progress bars without RCE. Fleet-tested on OpenCart, WordPress, HestiaCP, aaPanel.

• cve
• hestiacp
• opencart
• php

Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design

• exploit
• php
• php2shell
• php2shell-cve

PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full control ladders, fixed-version negative control on 8.5.12

• cve-2026-109618
• cve-2026-109619
• exploit
• memory-corruption

Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabbing, version-based detection.

• crtsh
• cve
• cve-2026-109618
• cve-2026-109619

Custom password cracking rules for Hashcat and John the Ripper

• password-cracking
• hashcat
• johntheripper
• jtr

A honeypot for the Log4Shell vulnerability (CVE-2021-44228).

SSH, FTP and Telnet honeypots based on Twisted

• honeypot
• python
• twisted
• ssh

Honeypot (Dionaea and kippo) setup script

Simplified CA and device cert manager for strongSwan VPN

Security and Hacking Tools, Exploits, Proof of Concepts, Shellcodes, Scripts.

Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise

• detection
• splunk
• bpfdoor
• vulnerability

Bind/Reverse Shells, SOCKS, etc over Tor in Golang

• tor
• ethical-hacking
• reverse-shell
• bind-shell

Mimicry is a dynamic deception tool that actively deceives an attacker during exploitation and post-exploitation.

• backdoor
• honeypot
• incident-response
• security

Gulp.js command execution for humans

• gulp
• execa
• gulp-plugin
• gulpjs

Intrusion Prevention System (IPS) for Secure Shell (SSH)

Collection of hashcat lists and things.

• hashcat
• hashcat-rules
• hashcat-masks
• password-cracking

Bash and Python Honeyport scripts

autocrack adds queue support for hashcat cracking.

PowerSponse is a PowerShell module focused on targeted containment and remediation during incident response.

• powershell
• powershell-modules
• incident-response
• containment