Repository Index

A Go implementation of in-toto. in-toto is a framework to protect software supply chain integrity.

• in-toto
• software-supply-chain
• security

Tools for the Computer Incident Response Team :computer:

• dfir
• python
• carbonblack
• malware-analysis

Python implementation of the Packed Executable iDentifier (PEiD)

• peid
• peid-signature
• pe-file
• pe-files

A Python library and command line tools to provide interactive log visualization.

• cybersecurity
• investigation
• malware-analysis
• malware-research

Minimal, consistent Python API for building integrations with malware sandboxes.

• sandbox
• malware-analysis
• api-client
• library

A warehouse for your malware

Straightforward HTTP session management

• session-management
• session
• http
• golang

Randomly changes Win32/64 PE Files for 'safer' uploading to malware and sandbox sites.

BluePill: Neutralizing Anti-Analysis Behavior in Malware Dissection (Black Hat Europe 2019, IEEE TIFS 2020)

• malware-analysis
• reverse-engineering
• debugger
• malware

A modular Python application to pull intelligence about malicious files

• malware-analysis
• malware-research
• investigation
• cybersecurity

Automated malware unpacker

Detect and log CVE-2019-19781 scan and exploitation attempts.

Authentication plugin for CakePHP. Can also be used in PSR7 based applications.

• php
• cakephp
• cakephp-plugin
• authentication

Simple framework to extract "actionable" data from Android malware (C&Cs, phone numbers etc.)

NTFUZZ: Enabling Type-Aware Kernel Fuzzing on Windows with Static Binary Analysis (IEEE S&P '21)

• fuzzer
• fuzzing
• kernel-fuzzer
• windows-kernel

Malware/IOC ingestion and processing engine

A honeypot for malware that propagates via USB storage devices

Ragpicker is a Plugin based malware crawler with pre-analysis and reporting functionalities. Use this tool if you are testing antivirus products, collecting malware for another analyzer/zoo.

Tool to help guess a files 256 byte XOR key by using frequency analysis

• frequency-analysis
• python
• xor
• malware

Middleware based authorization for Absinthe GraphQL powered by Bodyguard

A dead simple, highly performant, highly customizable sessions middleware for go http servers.

PSR7 Middleware for authorization

• php
• cakephp
• authorization
• middleware

Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise

• detection
• splunk
• bpfdoor
• vulnerability

Docker image gathering packers and tools for making datasets of packed executables and training machine learning models for packing detection

• docker-image
• executable-packing
• malware-packers
• research-platform