Awesome Stars

A curated list of my GitHub stars!

Contents

• ActionScript
• AppleScript
• AsciiDoc
• Assembly
• AutoIt
• Batchfile
• Boo
• C
• C#
• C++
• CMake
• CSS
• Coq
• Dart
• Dockerfile
• FreeMarker
• Go
• HCL
• HTML
• Hack
• Haskell
• Inno Setup
• Java
• JavaScript
• Jinja
• Jupyter Notebook
• Kotlin
• LLVM
• Lua
• Makefile
• OCaml
• Objective-C
• Others
• PHP
• Pascal
• Perl
• PowerShell
• Python
• QMake
• Rich Text Format
• Ruby
• Rust
• SCSS
• SaltStack
• Scala
• Shell
• Smarty
• Solidity
• Swift
• SystemVerilog
• Tcl
• TeX
• TypeScript
• VBA
• VBScript
• VHDL
• Vala
• Verilog
• Visual Basic
• Visual Basic .NET
• Vue
• XSLT
• YARA

ActionScript

• InQuest/malware-samples - A collection of malware samples and relevant dissection information, most probably referenced from http://blog.inquest.net

AppleScript

• Soorma07/OS-X-Bluetooth-Pairing-Value-To-Windows-Value - A useful script to simultaneously pair a bluetooth device to your Mac in OS X and Boot Camp Windows

AsciiDoc

• bitcoinbook/bitcoinbook - Mastering Bitcoin 2nd Edition - Programming the Open Blockchain

Assembly

• jthuraisamy/SysWhispers - AV/EDR evasion via direct system calls.
• cryptwareapps/Malware-Database - A large repository of malware samples with 2500+ malware samples & source codes for a variety of platforms by Cryptware Apps.
• winterknife/PINKPANTHER - Windows x64 handcrafted token stealing kernel-mode shellcode
• outflanknl/InlineWhispers - Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF)
• hasherezade/7ev3n_decoders - Decoders for 7ev3n ransomware
• jthuraisamy/SysWhispers2 - AV/EDR evasion via direct system calls.
• klezVirus/inceptor - Template-Driven AV/EDR Evasion Framework
• corkami/pics - File formats explanations, logos redrawing...
• hasherezade/bearparser_tests - External tests for bearparser
• vxunderground/MalwareSourceCode - Collection of malware source code for a variety of platforms in an array of different programming languages.
• Cpasjuste/pemu -
• mytechnotalent/Reverse-Engineering - A FREE comprehensive reverse engineering tutorial covering x86, x64, 32-bit ARM & 64-bit ARM architectures.
• hasherezade/malware_training_vol1 - Materials for Windows Malware Analysis training (volume 1)
• aadomn/aes - Fast constant-time AES implementations on 32-bit architectures
• HosakaCorp/riscv-business - RISC-V: RV64G Linux assembly and payloads from the ground up
• Ko-/riscvcrypto - Optimized assembly implementations of crypto for the RV32I (RISC-V) architecture
• SpinalHDL/VexRiscv - A FPGA friendly 32 bit RISC-V CPU implementation

AutoIt

• jschicht/SetRegTime - Registry timestamp manipulation
• jschicht/UsnJrnl2Csv - Parser for $UsnJrnl on NTFS
• jschicht/ExtractUsnJrnl - Tool to extract the $UsnJrnl from an NTFS volume
• jschicht/LogFileParser - Parser for $LogFile on NTFS

Batchfile

• Yamato-Security/EnableWindowsLogSettings - Documentation and scripts to properly enable Windows event logs.
• abbodi1406/KMS_VL_ALL_AIO - Smart Activation Script
• Vichingo455/MalwareDatabase - One of the few malware collection
• CronUp/Malware-IOCs -
• ForbiddenProgrammer/conti-pentester-guide-leak - Leaked pentesting manuals given to Conti ransomware crooks
• ion-storm/sysmon-config - Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic Artifact Events for UEBA, Detect Exploitation events with wide CVE Coverage, and Risk Scoring of CVE, UEBA, Forensic, and MITRE ATT&CK Events.
• diogo-fernan/ir-rescue - A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
• swagkarna/Defeat-Defender-V1.2.0 - Powerful batch script to dismantle complete windows defender protection and even bypass tamper protection ..Disable Windows-Defender Permanently....Hack windows. POC
• kkkgo/LTSC-Add-MicrosoftStore - Add Windows Store for LTSC
• jakobadam/packer-qemu-templates - Packer qemu templates
• Phoenix1747/fake-sandbox - 👁‍🗨 This script will simulate fake processes of analysis sandbox/VM software that some malware will try to avoid.
• NextronSystems/APTSimulator - A toolset to make a system look as if it was the victim of an APT attack
• massgravel/Microsoft-Activation-Scripts - A Windows and Office activator using HWID / KMS38 / Online KMS activation methods, with a focus on open-source code and fewer antivirus detections.

Boo

• byt3bl33d3r/SILENTTRINITY - An asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR

C

• crs-chin/smspy - Desecting GSM and CDMA transport layer SMS TPDU(GSM 03.40, TS 23.040 & 3GPP2 C.S0015-A )
• ptrrkssn/psmsd - Peter's SMS gateway daemon
• shishi012/gsm-pdu-decoder - SMS PDU decoder/encoder based on GSM 3.40 standard
• hu55a1n1/Multi-part-SMS-PDU-generator - A simplified C library for generating PDU encoded multi-part multilingual SMS. This library uses the versatile SMS Server Tools for encoding/decoding.
• matrix207/sms - send sms by GSM modem
• obsy/sms_tool - SMS Tool for 3G/4G modem
• xiekeli/SmsSender - 一个短信收发软件，采用VC编写，基于串口池的短信猫
• Idov31/Cronos - PoC for a new sleep obfuscation technique leveraging waitable timers to evade memory scanners.
• apriorit/CryptoDevice -
• V0VEK/IBKS_RegFSFilter - Driver-Filter for filesystem and registry
• pinkyfox/Windows-File-System-Filter-Driver - Курсовая работа по дисциплине "СПОВМ". БГУИР, ВМСиС, 2020 год. Тема: Драйвер устройства.
• linux-audit/audit-userspace - Linux audit userspace repository
• aide/aide - aide source code
• lastpass/lastpass-cli - LastPass command line interface tool
• reveng007/ReflectiveNtdll - A Dropper POC focusing EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (using pe2shc by @hasherezade). Payload encryption via SystemFucntion033 NtApi and No new thread via Fiber
• antonioCoco/RoguePotato - Another Windows Local Privilege Escalation from Service Account to System
• assarbad/ddkwizard - DDKWizard is a project creation wizard for Visual Studio .NET, .NET 2003, 2005 and 2008. It allows to wrap the standalone DDK/WDK build process in a Visual Studio solution. No pull requests (this is actually a mirrored Mercurial repo).
• OmriBaso/RToolZ - A Stealthy Lsass Dumper - can abuse ProcExp152.sys driver to dump PPL Lsass, no dbghelp.lib calls.
• paranoidninja/Proxy-Function-Calls-For-ETwTI - The code is a pingback to the Dark Vortex blog: https://0xdarkvortex.dev/hiding-memory-allocations-from-mdatp-etwti-stack-tracing/
• infoskirmish/hive - The CIA Hive source code as released by Wikileaks
• paranoidninja/Proxy-DLL-Loads - The code is a pingback to the Dark Vortex blog:
• rapid7/metasploit-payloads - Unified repository for different Metasploit Framework payloads
• mcmilk/7-Zip-zstd - 7-Zip with support for Brotli, Fast-LZMA2, Lizard, LZ4, LZ5 and Zstandard
• jart/blink - tiniest x86-64-linux emulator
• Maldev-Academy/HellHall - Performing Indirect Clean Syscalls
• vitoplantamura/BugChecker2002 - SoftICE-like debugger for Windows 2000 and XP. Archived.
• vitoplantamura/BugChecker - SoftICE-like kernel debugger for Windows 11
• intel/haxm - Intel® Hardware Accelerated Execution Manager (Intel® HAXM)
• elastic/PPLGuard -
• hse-project/hse - HSE: Heterogeneous-memory storage engine
• Genymobile/scrcpy - Display and control your Android device
• paranoidninja/DotNetTracer - C code to enable ETW tracing for Dotnet Assemblies
• mtrojnar/stunnel - Public repository based on official releases
• chobits/ngx_http_proxy_connect_module - A forward proxy module for CONNECT request handling
• tinyproxy/tinyproxy - tinyproxy - a light-weight HTTP/HTTPS proxy daemon for POSIX operating systems
• varnishcache/varnish-cache - Varnish Cache source code repository
• Xilinx/Vitis-Tutorials - Vitis In-Depth Tutorials
• safing/portmaster-windows-kext - The Windows kernel-mode driver for Portmaster integration
• Octoberfest7/KDStab - BOF combination of KillDefender and Backstab
• NUL0x4C/AtomPePacker - A Highly capable Pe Packer
• DataSoft/Honeyd - virtual honeypots
• cbcrg/tcoffee - A collection of tools for Multiple Alignments of DNA, RNA, Protein Sequence
• TimoLassmann/kalign - A fast multiple sequence alignment program.
• refresh-bio/FAMSA - Algorithm for ultra-scale multiple sequence alignments (3M protein sequences in 5 minutes and 24 GB of RAM)
• Darkabode/zerokit - Zerokit/GAPZ rootkit (non buildable and only for researching)
• nyx0/Rovnix - Rovnix Bootkit
• FirstBlood12/RedPetyaOpenSSL - A full rewrite of Red Petya ransomware from 2016 with full MBR and GPT support
• JohnnyLChang/MBRProtector -
• DavidBuchanan314/pwn-mbr - A simple MBR hijack demonstration
• NextSecurity/Gozi-MBR-rootkit - Gozi-MBR-rootkit Bootkit Modified
• m0n0ph1/Win64-Rovnix-VBR-Bootkit - Win64/Rovnix - Volume Boot Record Bootkit
• Rohde-Schwarz/TrustedGRUB2 - DEPRECATED TPM enabled GRUB2 Bootloader
• Deputation/hygieia - Hygieia, a vulnerable driver traces scanner written in C++ as an x64 Windows kernel driver.
• Hildaboo/PetyaBuilder - My (OLD) RE Take On The Faux Green Petya Ransomware Builder & Client.
• Hildaboo/duh - Duh iPhone Botnet - forked from my very old github I lost access to.
• Hildaboo/BabukBuilder - Reversed source code to the Babuk ransomware builder.
• openwrt/openwrt - This repository is a mirror of https://git.openwrt.org/openwrt/openwrt.git It is for reference only and is not active for check-ins. We will continue to accept Pull Requests here. They will be merged via staging trees then into openwrt.git.
• tio/tio - A simple serial device I/O tool
• kingToolbox/WindTerm - A professional cross-platform SSH/Sftp/Shell/Telnet/Serial terminal.
• dgros/Malware_Analyzer - Framework complet d'analyse de malware
• bigzz/Gold -
• 340211173/Gold -
• honeynet/capture-hpc -
• quantumcore/paradoxiaRAT - ParadoxiaRat : Native Windows Remote access Tool.
• lengjibo/FourEye - AV Evasion Tool For Red Team Ops
• center-for-threat-informed-defense/adversary_emulation_library - An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs.
• wrongbaud/hackaday-u - Course materials for hackaday.io Ghidra training
• h3xduck/TripleCross - A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
• SinaKarvandi/Hypervisor-From-Scratch - Source code of a multiple series of tutorials about the hypervisor. Available at: https://rayanfam.com/tutorials
• microsoft/Windows-Driver-Frameworks - WDF makes it easy to write high-quality Windows drivers
• Cerbersec/KillDefenderBOF - Beacon Object File PoC implementation of KillDefender
• mdsecactivebreach/firewalker -
• bats3c/DarkLoadLibrary - LoadLibrary for offensive operations
• outflanknl/FindObjects-BOF - A Cobalt Strike Beacon Object File (BOF) project which uses direct system calls to enumerate processes for specific loaded modules or process handles.
• CCob/BOF.NET - A .NET Runtime for Cobalt Strike's Beacon Object Files
• boku7/spawn - Cobalt Strike BOF that spawns a sacrificial process, injects it with shellcode, and executes payload. Built to evade EDR/UserLand hooks by spawning sacrificial process with Arbitrary Code Guard (ACG), BlockDll, and PPID spoofing.
• helpsystems/nanodump - The swiss army knife of LSASS dumping
• xforcered/CredBandit - Proof of concept Beacon Object File (BOF) that uses static x64 syscalls to perform a complete in memory dump of a process and send that back through your already existing Beacon communication channel
• outflanknl/Dumpert - LSASS memory dumper using direct system calls and API unhooking.
• gentilkiwi/kekeo - A little toolbox to play with Microsoft Kerberos in C
• trustedsec/CS-Situational-Awareness-BOF - Situational Awareness commands implemented using Beacon Object Files
• bats3c/shad0w - A post exploitation framework designed to operate covertly on heavily monitored environments
• gloxec/CrossC2 - generate CobaltStrike's cross-platform payload
• TheWover/donut - Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters
• phra/PEzor - Open-Source Shellcode & PE Packer
• citusdata/citus - Distributed PostgreSQL as an extension
• gojue/ecapture - capture SSL/TLS text content without CA cert using eBPF. supports Linux/Android x86_64/Aarch64.
• Octoberfest7/BeatRev - POC for frustrating/defeating Malware Analysts
• Nitrokey/nitrokey-pro-firmware - Firmware for the Nitrokey Pro device
• iovisor/bcc - BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
• AdityaSec/C-Code-To-Disassembly -
• xalicex/Unhook-Import-Address-Table - Piece of code to detect and remove hooks in IAT
• codingtest/r0ak - r0ak ("roak") is the Ring 0 Army Knife -- A Command Line Utility To Read/Write/Execute Ring Zero on for Windows 10 Systems
• robertdavidgraham/masscan - TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.
• thefLink/DeepSleep - A variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC
• cilium/tetragon - eBPF-based Security Observability and Runtime Enforcement
• horsicq/PDBRipper - PDBRipper is a utility for extract an information from PDB-files.
• KeenSecurityLab/BinAbsInspector-binaries -
• Mr-Un1k0d3r/RedTeamCCode - Red Team C code repo
• m417z/Multiline-Ultimate-Assembler - A multiline (and ultimate) assembler (and disassembler) plugin for x64dbg and OllyDbg. A perfect tool for modifying and extending a compiled executable functionality.
• Octoberfest7/XLL_Phishing - XLL Phishing Tradecraft
• outflanknl/C2-Tool-Collection - A collection of tools which integrate with Cobalt Strike (and possibly other C2 frameworks) through BOF and reflective DLL loading techniques.
• NVIDIA/open-gpu-kernel-modules - NVIDIA Linux open GPU kernel module source
• emqx/neuron - Open source industrial IoT connectivity server
• microsoft/omi - Open Management Infrastructure
• trustedsec/ELFLoader -
• enjoy-digital/litex - Build your hardware, easily!
• fpgadeveloper/ethernet-fmc-zynq-gem - Example design for the Ethernet FMC using the hard GEMs of the Zynq
• adki/gen_amba_2021 - AMBA bus generator including AXI4, AXI3, AHB, and APB
• proferosec/HelloKittyUnpacker - A tool to assist in analysis of packed HelloKitty ransomware binaries
• hfiref0x/UACME - Defeating Windows User Account Control
• mytechnotalent/Hacking-Windows - A FREE Windows C development course where we will learn the Win32API and reverse engineer each step utilizing IDA Free in both an x86 and x64 environment.
• xroche/httrack - HTTrack Website Copier, copy websites to your computer (Official repository)
• 0vercl0k/sic - Enumerate user mode shared memory mappings on Windows.
• hacksysteam/HackSysExtremeVulnerableDriver - HackSys Extreme Vulnerable Windows Driver (HEVD)
• HyperDbg/HyperDbg - State-of-the-art native debugging tool
• microsoft/ndis-driver-library - Code to make it easier to write an NDIS network driver on Windows
• zodiacon/WinSys - C++ library for low-level Windows development
• tianocore/edk2 - EDK II
• Bonfee/CVE-2022-0995 - CVE-2022-0995 exploit
• KANKOSHEV/Detect-HiddenThread-via-KPRCB - Detect removed thread from PspCidTable.
• henrypp/memreduct - Lightweight real-time memory management application to monitor and clean system memory on your computer.
• microsoft/winfile - Original Windows File Manager (winfile) with enhancements
• TheCruZ/EFI_Driver_Access - Efi Driver Access is a simply project to load a driver during system boot with the idea to give the user kernel access for read/write memory without restrictions
• l3af-project/eBPF-Package-Repository - eBPF Programs
• coreboot/coreboot - Mirror of https://review.coreboot.org/coreboot.git. We don't handle Pull Requests.
• danielkrupinski/KernelProcessList - Example Windows Kernel-mode Driver which enumerates running processes.
• conix-security/zer0m0n - zer0m0n driver for cuckoo sandbox
• hh-honghu/ssdt_get_function -
• PowerfulGun/HookorUnhookSSDT - hookssdt
• Marsh61/Windows-Driver-Hook-ZwEnumerateValueKey - This driver will hook the ZwEnumerateValueKey on 32 bit windows systems by hooking the function through the SSDT table. The malicious hook will hide registry keys with a name that contains "root"
• tcwangshiqi/SSDT - My SSDT Hook which could supervise opening processes, terminating processes and hide targeted processes.
• Iolop/SSDT-Hook - SSdt-Hook in C<Driver mode>
• paud/HookSSDTMinifilter - HookSSDTMinifilter
• SxyHack/HelloRing0Driver - SSDT HOOK 练手
• quackerd/ssdt_hook - [RO/Mirror] Windows XP x86-32 SSDT table hook
• H4Security/SSDTFinder -
• amiryeshurun/windows-syscalls-introspection - A Windows driver that overrides the SSDT to hook NT system calls
• robopyh/SSDT_Detection - Kerenel-level anti-rootkit
• haidragon/SSDTHOOK_win7x64 - SSDTHOOK_win7x64
• Reshahar/FireWall - 基于SSDT Hook技术和网络中间层驱动的软件防火墙
• Cody2333/SSDT_HOOK - ssdt hook 框架的简单实现
• YYZ-coder/Process_Protect_Module - Monitor and protect processes use "PsSetCreateProcessNotifyRoutineEx" and kernel ssdt hook.
• papadp/shd - Ssdt Hook Detection tool
• SamuelGD/Hooking-the-Windows-Kernel - Two drivers that hook the IDT table and the SSDT table of the Windows kernel. Developed in 2010.
• yufanpi/SSDT_process_hide_protect - SSDT_process_hide_protect
• weixu8/RegistryMonitor - Formely KMon, a Windows Kernel Driver designed to prevent malware attacks by monitoring the creation of registry keys in common autorun locations and prompting the user whether they want to allow the creation of the key. More of an experiment into Kernel level SSDT hooks but a fun project nonetheless
• yawenok/SSDT-Hook - The windows kernel ssdt hook demo
• s18leoare/Hackshield-Driver-Bypass - Bypass HackShield several specific SSDT hook in Ring0
• sin5678/hidedir - 使用SSDT HOOK 在windows上隐藏指定文件或者文件夹
• xiaofen9/SSDTHOOK - An SSDT hook for Windows
• tanduRE/AvastHV - Hooking SSDT with Avast Internet Security Hypervisor
• SweetIceLolly/Prevent_Process_Creation - Record & prevent process creation in kernel mode
• anthemtotheego/InlineExecute-Assembly - InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module
• ireader/sdk - portable system call(aio/socket/thread/process/lock/event/pipe)
• bperez77/xilinx_axidma - A zero-copy Linux driver and a userspace interface library for Xilinx's AXI DMA and VDMA IP blocks. These serve as bridges for communication between the processing system and FPGA programmable logic fabric, through one of the DMA ports on the Zynq processing system. Distributed under the MIT License.
• outflanknl/Ps-Tools - Ps-Tools, an advanced process monitoring toolkit for offensive operations
• goldsborough/ipc-bench - 🐎 Benchmarks for Inter-Process-Communication Techniques
• landhb/HideProcess - A basic Direct Kernel Object Manipulation rootkit that removes a process from the EPROCESS list, hiding it from the Task Manager
• DaanDeMeyer/reproc - A cross-platform (C99/C++11) process library
• simonhf/sharedhashfile - Share Hash Tables With Stable Key Hints Stored In Memory Mapped Files Between Arbitrary Processes
• phaag/nfdump - Netflow processing tools
• WuBingzheng/libleak - detect memory leak by LD_PRELOAD, without changing the target program
• Yaxser/Backstab - A tool to kill antimalware protected processes
• pingostack/pingos - Based on the NGINX/RTMP/HTTP-FLV/HTTP-TS/HLS/HLS+/DASH/H.264/H.265/AAC/MP3/Live/Record/VOD/Push/Pull/Multiple Processes/Dynamic Configuration/Configuration Variables/Console Interface/Notify
• JuliaStrings/utf8proc - a clean C library for processing UTF-8 Unicode data
• unpaper/unpaper - A post-processing tool for scanned sheets of paper.
• hyperrealm/libconfig - C/C++ library for processing configuration files
• cyring/CoreFreq - CoreFreq is a CPU monitoring software designed for the 64-bits Processors.
• ufrisk/LeechCore - LeechCore - Physical Memory Acquisition Library & The LeechAgent Remote Memory Acquisition Agent
• ufrisk/pcileech - Direct Memory Access (DMA) Attack Software
• ufrisk/MemProcFS - The Memory Process File System
• 504ensicsLabs/LiME - LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that ar
• dav/word2vec - This tool provides an efficient implementation of the continuous bag-of-words and skip-gram architectures for computing vector representations of words. These representations can be subsequently used in many natural language processing applications and for further research.
• rsyslog/rsyslog - a Rocket-fast SYStem for LOG processing
• stephenfewer/ReflectiveDLLInjection - Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a library from memory into a host process.
• htop-dev/htop - htop - an interactive process viewer
• fluent/fluent-bit - Fast and Lightweight Logs and Metrics processor for Linux, BSD, OSX and Windows
• hishamhm/htop - htop is an interactive text-mode process viewer for Unix systems. It aims to be a better 'top'.
• minglinchen/WinKernelDev -
• egione/Agnentro - Agnentro is an approximate binary search tool and entropy scanner.
• CMU-SAFARI/GenASM - Source code for the software implementations of the GenASM algorithms proposed in our MICRO 2020 paper: Senol Cali et. al., "GenASM: A High-Performance, Low-Power Approximate String Matching Acceleration Framework for Genome Sequence Analysis" at https://people.inf.ethz.ch/omutlu/pub/GenASM-approximate-string-matching-framework-for-genome-analysis_micro20.pdf
• flori/amatch - Approximate String Matching library
• locasto/libdisorder - A simple C library for entropy measurement of byte streams and other data.
• comotion/edd - Entropy DDoS Detection
• circulosmeos/circle - statistics ASCII circle for analysing byte entropy in files
• libfuse/libfuse - The reference implementation of the Linux FUSE (Filesystem in Userspace) interface
• trickster0/TartarusGate - TartarusGate, Bypassing EDRs
• am0nsec/HellsGate - Original C Implementation of the Hell's Gate VX Technique
• ScarredMonk/SysmonSimulator - Sysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detections and correlation rules by Blue teams.
• hfiref0x/SyscallTables - Windows NT x64 Syscall tables
• greendow/A-variant-of-NIST-SP-800-22-test-suit - A variant of NIST SP 800-22 revison.1a test suit
• jgamblin/Mirai-Source-Code - Leaked Mirai Source Code for Research/IoC Development Purposes
• hkx3upper/FOKS-TROT - It's a minifilter used for transparent-encrypting.
• ipwnosx/de4dot-All-Version-2021 - GG
• xmrig/xmrig - RandomX, KawPow, CryptoNight and GhostRider unified CPU/GPU miner and RandomX benchmark
• filippiazikou/SmithWaterman - Smith Waterman Algorithm for subsequence matching using C language
• klon/ucrdtw - Python extension for UCR Suite highly optimized subsequence search using Dynamic Time Warping (DTW)
• taoito/lcs-parallel - Longest common subsequence parallel implementations
• leea/diff-cpp - C++ template library for computing a longest common subsequence (diff)
• jeffdaily/parasail - Pairwise Sequence Alignment Library
• atks/vt - A tool set for short variant discovery in genetic sequence data.
• lh3/seqtk - Toolkit for processing sequences in FASTA/Q formats
• abhichand26/longest-common-subsequence - Program to find longest common sub-sequence using Dynamic Programming
• schiffma/distlib - Distance related functions (Damerau-Levenshtein, Jaro-Winkler , longest common substring & subsequence) implemented as SQLite run-time loadable extension. Any UTF-8 strings are supported.
• amirsalarpour/Time-Series-Similarity -
• denggaoshan/SimilarityJudge - 用C++写的，一个简单的，作业相似度判断系统。。。。。 可以用于判断简单作业的 代码相似度，比如OJ之类的
• laurentnoe/yass - genomic alignment similarity search tool
• lh3/partig - An experimental tool to estimate the similarity between all pairs of contigs
• wooorm/levenshtein.c - Levenshtein algorithm in C
• rieck/harry - A Tool for Measuring String Similarity
• miohtama/python-Levenshtein - The Levenshtein Python C extension module contains functions for fast computation of Levenshtein distance and string similarity
• pgvector/pgvector - Open-source vector similarity search for Postgres
• eulerto/pg_similarity - set of functions and operators for executing similarity queries
• ofercas/ransomware_begone - ransomware_begone
• DecryptoniteTeam/Decryptonite - Ransomware Detection and Mitigation Software
• mitchellkrogza/apache-ultimate-bad-bot-blocker - Apache Block Bad Bots, (Referer) Spam Referrer Blocker, Vulnerability Scanners, Malware, Adware, Ransomware, Malicious Sites, Wordpress Theme Detectors and Fail2Ban Jail for Repeat Offenders
• SlavaMelanko/ScannerFileSystemMinifilterDriver -
• SweetIceLolly/Prevent_File_Deletion - Record & prevent file deletion in kernel mode
• yuezhihan/anti-ransomware-minifilter - A minifilter driver for detecting and blocking ransomware virus
• comor86/MyMiniEncrypt - 使用minifilter编写的透明加解密驱动。
• JKornev/NTlib - Static library and headers for linking your software with ntdll.dll
• JKornev/hidden - 🇺🇦 Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc
• 474172261/DataProtector - A simple ransomware defender.It uses minifilter to filt "rewrite" and "delete" events in kernel.And it handles event in user mode.
• hkx3upper/Minifilter - 参考《Windows内核安全与驱动开发》的透明加密解密Minifilter
• guidoreina/minivers - Windows file system minifilter driver which generates backup copies of certain files before they change
• tandasat/Scavenger - A minifilter driver preserves all modified and deleted files.
• somma/Minifilter-HOL - Minifilter driver development Hands-On-Labs
• bobranten/Ext4Fsd - Ext4 file system driver for Windows
• microsoft/Windows-driver-samples - This repo contains driver samples prepared for use with Microsoft Visual Studio and the Windows Driver Kit (WDK). It contains both Universal Windows Driver and desktop-only driver samples.
• tpn/windows-nt-file-system-internals-book - Source code on the 1.44MB 3.5 floppy accompanying the Windows NT File System Internals book.
• psankar/simplefs - A simple, kernel-space, on-disk filesystem from the scratch
• taosdata/TDengine - TDengine is an open source, high-performance, cloud native time-series database optimized for Internet of Things (IoT), Connected Cars, Industrial IoT and DevOps.
• timescale/timescaledb - An open-source time-series SQL database optimized for fast ingest and complex queries. Packaged as a PostgreSQL extension.
• armink/FlashDB - An ultra-lightweight database that supports key-value and time series data | 一款支持 KV 数据和时序数据的超轻量级数据库
• wavestone-cdt/EDRSandblast -
• Mr-Un1k0d3r/EDRs -
• NtRaiseHardError/Sysmon - Sysmon shenanigans
• ionescu007/winipt - The Windows Library for Intel Process Trace (WinIPT) is a project that leverages the new Intel Processor Trace functionality exposed by Windows 10 Redstone 5 (1809), through a set of libraries and a command-line tool.
• nsntrace/nsntrace - Perform network trace of a single process by using network namespaces.
• prash-wghats/Dtrace-ETW - DTrace for Windows in userspace; Frontend to ETW
• boku7/injectEtwBypass - CobaltStrike BOF - Inject ETW Bypass into Remote Process via Syscalls (HellsGate|HalosGate)
• repnz/etw-providers-docs - Document ETW providers
• pathtofile/PPLRunner - Run Processes as PPL with ELAM
• xuanxuan0/TiEtwAgent - PoC memory injection detection agent based on ETW, for offensive and defensive research purposes
• tdevuser/MalwFinder -
• zodiacon/WindowsInternals - Windows Internals Book 7th edition Tools
• Sqdwr/HideDriver - 之前那份是7600的，每次编译搞得好麻烦。更新一个VS2017可以直接编译的。
• zhuhuibeishadiao/NewHideDriverEx - Hide Driver By MiProcessLoaderEntry
• ZhanLang/msddk - windows driver develop kit with c++ mail:[email protected]
• ZhanLang/msdk -
• Aekras1a/Labs -
• gentilkiwi/mimikatz - A little tool to play with Windows security
• zyantific/zyan-hook-engine - Advanced x86/x86-64 hooking library (WIP).
• zyantific/zycore-c - Internal library providing platform independent types, macros and a fallback for environments without LibC.
• HoShiMin/EnjoyTheRing0 - Шаблон полнофункционального драйвера и обёртки над ядерным API
• zyantific/zydis - Fast and lightweight x86/x86-64 disassembler and code generation library
• yuchdev/NtfsFileEraser - NTFS file eraser for wiping out deleted file remains from the filesystem. Support of encrypted and compressed filesystems.
• ewedominic/FLock - File system lock driver - hides, locks files and folders using extended-attributes on NTFS
• hkscy/RawNTFSFileExtraction - A tool that extracts files from NTFS filesystems based on the file offest and block device label.
• DeDf/ParseNTFS -
• makitos666/MFT_Fast_Transcoder - MFT Fast Transcoder is a fast forensic tool to analyze MFT of NTFS partitions.
• whu-enjoy/NTFSDirectoryBrowser - This code is used to learn NTFS File System . It's like a directory browser
• dr-anoroc/rawccopy - Command line utility for copying files on NTFS using low level disk access
• DougRogers/NTFSDirectorySystem - Fast NTFS Directory Scan and Search
• limbenjamin/nTimetools - Timestomper and Timestamp checker with nanosecond accuracy for NTFS volumes
• tuxera/ntfs-3g - NTFS-3G Safe Read/Write NTFS Driver
• mgeeky/ntfs-journal-viewer - Utterly simple NTFS Journal dumping utility. Handy when it comes to Computer Forensics and Malware Forensics Ops.
• LGA1150/ntfs3-oot - Cherry-picked from https://aur.archlinux.org/packages/ntfs3-dkms/
• sleuthkit/sleuthkit - The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
• nmap/npcap - Nmap Project's Windows packet capture and transmission library
• tekwizz123/demos - Forked from Akayan. Windows Kernel Exploitation. Static & dynamic analysis, exploits & vuln reasearch. Mitigations bypass's, genric bug-class's.
• flxflx/weasel - Public repository of the dynamic binary analysis framework WEASEL. WEASEL's main purpose is the identification and elimination of backdoors in server applications.
• LouisBrunner/valgrind-macos - A valgrind mirror with latest macOS support
• wmkhoo/taintgrind - A taint-tracking plugin for the Valgrind memory checking tool
• codespecs/fjalar - A dynamic analysis framework for C and C++ programs
• Milo-D/libvmcu-Virtual-MCU-Library - A Library for Static and Dynamic Analysis of AVR binaries.
• SiriDB/siridb-server - SiriDB is a highly-scalable, robust and super fast time series database. Build from the ground up SiriDB uses a unique mechanism to operate without a global index and allows server resources to be added on the fly. SiriDB's unique query language includes dynamic grouping of time series for easy analysis over large amounts of time series.
• DynamoRIO/drmemory - Memory Debugger for Windows, Linux, Mac, and Android
• cado-security/DFIR_Resources_REvil_Kaseya - Resources for DFIR Professionals Responding to the REvil Ransomware Kaseya Supply Chain Attack
• PKRoma/ProcessHacker - A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware—mirror of https://github.com/processhacker2/processhacker.git
• kaiserfarrell/malware - virus collection source code
• hfiref0x/KDU - Kernel Driver Utility
• bats3c/Ghost-In-The-Logs - Evade sysmon and windows event logging
• aaaddress1/wowInjector - PoC: Exploit 32-bit Thread Snapshot of WOW64 to Take Over $RIP & Inject & Bypass Antivirus HIPS (HITB 2021)
• aaaddress1/PR0CESS - some gadgets about windows process and ready to use :)
• aaaddress1/Skrull - Skrull is a malware DRM, that prevents Automatic Sample Submission by AV/EDR and Signature Scanning from Kernel. It generates launchers that can run malware on the victim using the Process Ghosting technique. Also, launchers are totally anti-copy and naturally broken when got submitted.
• elfmaster/libelfmaster - Secure ELF parsing/loading library for forensics reconstruction of malware, and robust reverse engineering tools
• OALabs/BlobRunner - Quickly debug shellcode extracted during malware analysis
• rieck/malheur - A Tool for Automatic Analysis of Malware Behavior
• hasherezade/loaderine - A demo implementation of a well-known technique used by some malware to evade userland hooking, using my library: libpeconv.
• hasherezade/flareon2019 - Flare-On solutions
• hasherezade/chimera_pe - ChimeraPE (a PE injector type - alternative to: RunPE, ReflectiveLoader, etc) - a template for manual loading of EXE, loading imports payload-side
• processhacker/phnt - Native API header files for the Process Hacker project.
• hasherezade/hidden_bee_tools - Parser for a custom executable format from Hidden Bee malware (first stage)
• hasherezade/module_overloading - A more stealthy variant of "DLL hollowing"
• hasherezade/process_chameleon - A process overwriting its own PEB to make an illusion that it has been loaded from a different path.
• odzhan/injection - Windows process injection methods
• hasherezade/process_doppelganging - My implementation of enSilo's Process Doppelganging (PE injection technique)
• danstowell/kdpee - k-d partitioning entropy estimator: A fast estimator for the entropy of multidimensional data distributions. Written in C, can be used from C/C++, Python, Matlab or Octave.
• ELIFE-ASU/Inform - A cross platform C library for information analysis of dynamical systems
• Cyan4973/FiniteStateEntropy - New generation entropy codecs : Finite State Entropy and Huff0
• vxunderground/VXUG-Papers - Research code & papers from members of vx-underground.
• mohuihui/antispy - AntiSpy is a free but powerful anti virus and rootkits toolkit.It offers you the ability with the highest privileges that can detect,analyze and restore various kernel modifications and hooks.With its assistance,you can easily spot and neutralize malwares hidden from normal detectors.
• m0nad/Diamorphine - LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x (x86/x86_64 and ARM64)
• vxunderground/VX-API - Collection of various WINAPI tricks / features used or abused by Malware
• glmcdona/Process-Dump - Windows tool for dumping malware PE files from memory back to disk for analysis.
• VirusTotal/yara - The pattern matching swiss knife
• screetsec/TheFatRat - Thefatrat a massive exploiting tool : Easy tool to generate backdoor and easy tool to post exploitation attack like browser attack and etc . This tool compiles a malware with popular payload and then the compiled malware can be execute on windows, android, mac . The malware that created with this tool also have an ability to bypass most AV software protection .
• cristeigabriel/memscan - Feature-rich C99 library for memory scanning purposes, designed for Windows running machines, meant to work on both 32-bit and 64-bit portable executables. Has a modern C++ wrapper.
• zodiacon/PEExplorerV2 - Portable Executable Explorer version 2
• hasherezade/transacted_hollowing - Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging
• 0x00Jeff/BetterGetProcAddress - POC of a better implementation of GetProcAddress for ntdll using binary search
• processhacker/plugins-extra - These are highly unstable, buggy, incomplete plugins that are not included with Process Hacker by default.
• bpotvin/nt-usn - display usn change journal info.
• rsa9000/ntfsheurecovery - NT File System (NTFS) recovery tool
• AdamWhiteHat/Judge-Jury-and-Executable - A file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV. Threats and data can be probed harnessing the power and syntax of SQL.
• bzmework/FastSearch - FastSearch是一个快速文件搜索系统，它的原理是通过读取NTFS文件系统中的USN日志文件，快速地读取磁盘中的所有文件，并通过文件名称快速查找。
• teozoia/Caronte - Caronte, Windows filter driver for software behavior analysis.
• bekdepo/wininotify - A library/utility to give features like inotify(of Linux) like capability in windows through a filter driver
• lelamaar/driverFilter - A filter driver for Windows 7/8/8.1/10 that allows you to restrict the access rights of processes to objects in the file system.
• D7EAD/Windump - A Windows tcpdump-esc utility used for monitoring traffic following a specified traffic filter.
• basil00/Divert - WinDivert: Windows Packet Divert
• walklang/RestFilter - RestFilter: a windows filesystem driver mini-filter.
• martona/mhook - A Windows API hooking library
• apriorit/mhook - A Windows API hooking library
• apriorit/backup_filter_driver_sample -
• mtth-bfft/win32k-mitigation - A test project to try the new win32k.sys system call filtering mitigation in Windows 10
• raja-jamwal/Spysym - Mini filter filesystem driver to prevent kernel level execution of executable code and files from the removable devices
• a4501150/LambseaDriver - windows kernel-mode driver, provide memory reading & writing, mini-filters, obCallbacks
• Penguinang/WinFSFilter - A simple FS filter,which can intercept IO operation and decide whether execute it,by which you can protect your data against change.
• JokerMars/MiniEngine - Final Transparent encrypted version
• JokerMars/DirFilter - To encrypt the file transparently
• pixos/palmtrie - Palmtrie: A Ternary Key Matching Algorithm for IP Packet Filtering Rules
• Kyromyr/D2DropFilter -
• GuillaumeGas/MiniFilterDriver - Simple minifilter driver
• CynicalApe/FSFilterDriver-QuickEditApp - KDMF File System Filter Driver && Quick Edit APP
• abysdom/bus-filter-framework - A framework for KMDF-based upper filter drivers to behave as bus filters. You don't need to write WDM drivers any more!
• gfleury/ProtegeDados_ProjetoFinal - Microsoft Windows real time file integrity monitoring and filtering using minifilter technology, this is was my university final project
• giuliafrascaria/ebpf-data-filter -
• slavaim/WDM-Storage-Filter - A WDM Windows driver to issue IO to storage devices with asynchronous multithreaded processing
• Chuyu-Team/woflib - An open source library for operating the Windows Overlay Filter driver.
• luigi1809/webfilter-ng - Transparent HTTP/HTTPS/TLS web filter
• Iamgublin/NDIS6.30-NetMonitor - NDIS6.30 Filter Library
• Netronome/libkefir - Convert network filtering rules from various formats into BPF programs
• slavaim/Windows-System-Wide-Filter - Windows WDM driver filters to filter IO to devices and file systems
• vedantk/quotient-filter - a quotient filter written in C
• bakercp/ofxIO - A collection of I/O core utils including a directory watcher, file filters and ordering, compression and more.
• xiao70/X70FSD - Windows file system filter drivers(minifilter) to encrypt, compress, or otherwise modify file-based data require some of the most complex kernel software developed for Windows.
• JaredWright/WFPStarterKit - An example driver for Windows that shows how to set-up some basic components of the Windows Filtering Platform
• Lochnair/xt_tls - Filter TLS traffic with IPtables
• kiyo-masui/bitshuffle - Filter for improving compression of typed binary data.
• ryanries/PassFiltEx - PassFiltEx. An Active Directory Password Filter.
• google/kafel - A language and library for specifying syscall filtering policies.
• jvirkki/libbloom - A simple and small bloom filter implementation in plain C.
• begeekmyfriend/CuckooFilter - Substitute for bloom filter.
• stanford-futuredata/sparser - Sparser: Raw Filtering for Faster Analytics over Raw Data
• jpr5/ngrep - ngrep is like GNU grep applied to the network layer. It's a PCAP-based tool that allows you to specify an extended regular or hexadecimal expression to match against data payloads of packets. It understands many kinds of protocols, including IPv4/6, TCP, UDP, ICMPv4/6, IGMP and Raw, across a wide variety of interface types, and understands BPF filter logic in the same fashion as more common packet sniffing tools, such as tcpdump and snoop.
• apriorit/file-system-filter - Windows file system filter driver - illustration of the technology
• henrypp/simplewall - Simple tool to configure Windows Filtering Platform (WFP) which can configure network activity on your computer.
• rspamd/rspamd - Rapid spam filtering system.
• iovisor/ubpf - Userspace eBPF VM
• mit-pdos/xv6-riscv - Xv6 for RISC-V
• one30/BS_SM4 -
• YWsGithub/s-box - AES and SM4 s-box in C
• ikantech/gm - 不依赖第三方库实现国密SM2、SM3、SM4算法
• guanzhi/GmSSL - 支持国密SM2/SM3/SM4/SM9/SSL的密码工具箱
• sebastien-riou/masked-bit-sliced-aes-128 - masked, bit-sliced AES-128 demo code
• ntop/nDPI - Open Source Deep Packet Inspection Software Toolkit
• ntop/PF_RING - High-speed packet processing framework
• emscripten-core/emscripten - Emscripten: An LLVM-to-WebAssembly Compiler
• xen-project/xen - Mirror of the Xen Repository (PRs not accepted see: http://wiki.xenproject.org/wiki/Submitting_Xen_Project_Patches)
• tklengyel/drakvuf-doppelganging - Shellcode used for Doppelganging with DRAKVUF
• tklengyel/libvmi -
• arkq/SM2349 - GM/T serial standards implementations
• westerndigitalcorporation/sweet-b - Sweet B is a safe, compact, embeddable library for elliptic curve cryptography.
• ANSSI-FR/libecc - Library for elliptic curves cryptography
• Nuclei-Software/nuclei-sdk - Nuclei RISC-V Software Development Kit
• rime/ibus-rime - 【中州韻】Rime for Linux/IBus
• debauchee/barrier - Open-source KVM software
• jgru/vmi-gui-reconstruction - Proof-of-concept code to reconstruct the GUI of a Xen guest running Windows
• nektra/Deviare2 - Deviare API Hook
• mrexodia/TitanHide - Hiding kernel-driver for x86/x64.
• T-head-Semi/xuantie-yocto - Yocto project for Xuantie RISC-V CPU
• libbpf/libbpf - Automated upstream mirror for libbpf stand-alone build.
• Sysinternals/SysinternalsEBPF - The Linux port of the Sysinternals Sysmon tool.
• ispras/qemu -
• KVM-VMI/kvm - Fork of KVM with Virtual Machine Introspection patches
• bitdefender/bddisasm - bddisasm is a fast, lightweight, x86/x64 instruction decoder. The project also features a fast, basic, x86/x64 instruction emulator, designed specifically to detect shellcode-like behavior.
• bitdefender/libkvmi - KVM Virtual Machine Introspection Library
• napocahv/napoca - Lightweight type-1 hypervisor offering a foundation for building advanced security-focused functionality.
• Dion-Systems/metadesk -
• gpakosz/whereami - Locate the current running executable and the current running module/library on the file system 🔎
• Winbagility/Winbagility - [ARCHIVED] mov rax, ${Thalium/IceBox}; jmp rax;
• hvmi/hvmi - Hypervisor Memory Introspection Core Library
• carter-yagemann/vmi-unpack - VMI-Unpack - A Virtual Machine Introspection (VMI) based generic unpacker.
• Wenzel/r2vmi - Hypervisor-Level Debugger based on Radare2 / LibVMI, using VMI IO and debug plugins
• libvmi/libvmi - The official home of the LibVMI project is at https://github.com/libvmi/libvmi.
• intel/kernel-fuzzer-for-xen-project - Kernel Fuzzer for Xen Project (KF/x) - Hypervisor-based fuzzing using Xen VM forking, VMI & AFL
• ispras/swat - SWAT - System-Wide Analysis Toolkit
• lgeek/dynamorio_pin_escape -
• wargio/r2dec-js - radare2 plugin - converts asm to pseudo-C code.
• radareorg/radare2-book - Radare2 official book
• radareorg/radare2 - UNIX-like reverse engineering framework and command-line toolset
• mrexodia/driver_unpacking - Ghetto user mode emulation of Windows kernel drivers.
• 1ce0ear/DllLoaderUnpacker -
• hasherezade/process_ghosting - Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted file
• hasherezade/demos - Demos of various injection techniques found in malware
• hasherezade/mal_unpack - Dynamic unpacker based on PE-sieve
• hfiref0x/WDExtract - Extract Windows Defender database from vdm files and unpack it
• VenTaz/Themidie - x64dbg plugin to bypass Themida 3.x Anti-Debugger / VM / Monitoring programs checks (x64)
• Visgean/Zeus - NOT MY CODE! Zeus trojan horse - leaked in 2011, I am not the author. This repository is for study purposes only, do not message me about your lame hacking attempts.
• pbatard/libwdi - Windows Driver Installer library for USB devices
• pbatard/rufus - The Reliable USB Formatting Utility
• AppImage/AppImageKit - Package desktop applications as AppImages that run on common Linux-based operating systems, such as RHEL, CentOS, openSUSE, SLED, Ubuntu, Fedora, debian and derivatives. Join #AppImage on irc.libera.chat
• flatpak/flatpak - Linux application sandboxing and distribution framework
• nevermosby/linux-bpf-learning - learn how to use BPF/eBPF
• Orange-OpenSource/bmc-cache - In-kernel cache based on eBPF.
• microsoft/ebpf-for-windows - eBPF implementation that runs on top of Windows
• chompie1337/Linux_LPE_eBPF_CVE-2021-3490 -
• DPDK/dpdk - Data Plane Development Kit
• Sysinternals/SysmonForLinux -
• sdnfv/openNetVM - A high performance container-based NFV platform from GW and UCR.
• mxmssh/drAFL - AFL + DynamoRIO = fuzzing binaries with no source code on Linux
• googleprojectzero/winafl - A fork of AFL for fuzzing Windows binaries
• google/honggfuzz - Security oriented software fuzzer. Supports evolutionary, feedback-driven fuzzing based on code coverage (SW and HW based)
• google/AFL - american fuzzy lop - a security-oriented fuzzer
• intel/qemu-sgx -
• aclements/mtrace - Memory access tracing QEMU
• GlacierW/MBA - Malware Behavior Analyzer
• Xilinx/qemu - Xilinx's fork of Quick EMUlator (QEMU) with improved support and modelling for the Xilinx platforms.
• 0xKira/qemu-vm-escape -
• ray-cp/vm-escape - some interesting vm-escape game
• andreafioraldi/qasan - QASan is a custom QEMU 3.1.1 that detects memory errors in the guest using AddressSanitizer.
• keystone-enclave/keystone - Keystone Enclave (QEMU + HiFive Unleashed)
• yifengyou/learn-kvm - Qemu KVM(Kernel Virtual Machine)学习笔记
• nccgroup/TriforceAFL - AFL/QEMU fuzzing with full-system emulation.
• intel/nemu - ARCHIVED: Modern Hypervisor for the Cloud. See https://github.com/cloud-hypervisor/cloud-hypervisor instead
• Juniper/trishool - Malware Reversal Toolkit
• geohot/qira - QEMU Interactive Runtime Analyser
• virtio-win/kvm-guest-drivers-windows - Windows paravirtualized
• yourtion/30dayMakeOS - 《30天自制操作系统》源码中文版。自己制作一个操作系统（OSASK）的过程
• qemu/qemu - Official QEMU mirror. Please see http://wiki.qemu.org/Contribute/SubmitAPatch for how to submit changes to QEMU. Pull Requests are ignored. Please only use release tarballs from the QEMU website.
• huang-zhen/Ocasta - A set of system tools including monitors for Linux system calls and Windows API calls, a versioning key-value database, and a versioning file system.
• TanakaYasen/InstDrv - Win Driver Installer
• TanakaYasen/Syscall-Monitor - A syscall monitor hook that record syscall api
• shuveb/sparkler - A virtual machine monitor and a tiny "operating system" to go with it. When you start Sparkler, it creates a virtual machine using Linux's KVM API. It is written in C and emulates a serial console and some other devices that fetch a tweet from an account, etc.
• DynamoRIO/drk - Dynamic instrumentation of the Linux kernel
• aengelke/instrew - A high performance LLVM-based dynamic binary instrumentation framework
• zhechkoz/PwIN - Security Evaluation of Dynamic Binary Instrumentation Engines
• unicorn-engine/unicorn - Unicorn CPU emulator framework (ARM, AArch64, M68K, Mips, Sparc, PowerPC, RiscV, S390x, TriCore, X86)
• frida/frida-gum - Cross-platform instrumentation and introspection library written in C
• dyninst/dyninst - DyninstAPI: Tools for binary instrumentation, analysis, and modification.
• S2E/s2e-old - This is the archived S2E 1.0 repo. We do not maintain it anymore.
• panda-re/panda - Platform for Architecture-Neutral Dynamic Analysis
• decaf-project/DECAF - DECAF (short for Dynamic Executable Code Analysis Framework) is a binary analysis platform based on QEMU. This is also the home of the DroidScope dynamic Android malware analysis platform. DroidScope is now an extension to DECAF.
• AFLplusplus/AFLplusplus - The fuzzer afl++ is afl with community patches, qemu 5.1 upgrade, collision-free coverage, enhanced laf-intel & redqueen, AFLfast++ power schedules, MOpt mutators, unicorn_mode, and a lot more!
• DynamoRIO/dynamorio - Dynamic Instrumentation Tool Platform
• REMnux/distro - This repository contains supplemental files for the REMnux distro and the source files for the Debian packages that the distro installs from the REMnux package repository on Launchpad.
• Juniper/HoneyProcs - Deception Technology for Endpoints
• MellowNight/physmem-Scanner - scans through physical memory and paging tables in kernel mode
• hasherezade/hollows_hunter - Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
• taviso/avscript - Avast JavaScript Interactive Shell
• zodiacon/SystemExplorer - Windows System Explorer
• Neosama/AntiSandBox-with-Drivers - Anti - Sandbox with Drivers for Windows. This trick bypass Cuckoo Sandbox, Falcon Sandbox and more.
• jayo78/win-api-monitor - A windows userland executable monitor
• flatpak/flatpak-xdg-utils - Simple portal-based commandline tools for use inside flatpak sandboxes
• serializingme/emofishes - Emofishes is a collection of proof-of-concepts that help improve, bypass or detect virtualized execution environments (focusing on the ones setup for malware analysis).
• accidentalrebel/RATwurst - Windows-only Remote Access Tool (RAT) with anti-debugging and anti-sandbox checks. For educational purposes only.
• darrenldl/sandboxing - Scripts, files and tools related to sandboxing
• sandboxie-plus/LogApiDll - API logging Library for Buster Sandbox Analyzer
• mtth-bfft/ntsec - Standalone tool to explore the security model of Windows and its NT kernel. Use it to introspect privilege assignments and access right assignments, enumerate attack surfaces from the point of view of a sandboxed process, etc.
• utoni/potd - A high scalable low to medium interactive SSH/TCP honeypot using Linux Namespaces, capabilities, seccomp, cgroups designed for OpenWrt and IoT devices.
• CoolerVoid/0d1n - Tool for automating customized attacks against web applications. Fully made in C language with pthreads, it has fast performance.
• CoolerVoid/HiddenWall - Linux kernel module generator for Hidden firewall that follows the rules in the external YAML file.
• netblue30/firetunnel - Tunneling program for Firejail sandboxes
• LloydLabs/wsb-detect - wsb-detect enables you to detect if you are running in Windows Sandbox ("WSB")
• cloudflare/sandbox - Simple Linux seccomp rules without writing any code
• thestinger/playpen - A secure application sandbox built with modern Linux sandboxing features - no longer actively developed, but still works fine, use bubblewrap if you need more functionality
• ioi/isolate - Sandbox for securely executing untrusted programs
• adtac/fssb - A filesystem sandbox for Linux using syscall intercepts.
• asamy/ksm - A fast, hackable and simple x64 VT-x hypervisor for Windows and Linux. Builtin userspace sandbox and introspection engine.
• winsiderss/systeminformer - A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ http://www.windows-internals.com
• wbenny/injdrv - proof-of-concept Windows Driver for injecting DLL into user-mode processes using APC
• Cisco-Talos/MBRFilter - Cisco Talos MBR Filter Driver
• Cisco-Talos/pyrebox - Python scriptable Reverse Engineering Sandbox, a Virtual Machine instrumentation and inspection framework based on QEMU
• a0rtega/pafish - Pafish is a testing tool that uses different techniques to detect virtual machines and malware analysis environments in the same way that malware families do
• containers/bubblewrap - Unprivileged sandboxing tool
• netblue30/firejail - Linux namespaces and seccomp-bpf sandbox
• sandboxie-plus/Sandboxie - Sandboxie Plus & Classic
• telekom-security/tpotce - 🍯 T-Pot - The All In One Honeypot Platform 🐝
• WireGuard/wireguard-nt - This repo is a mirror only. Official repository is at https://git.zx2c4.com/wireguard-nt
• WireGuard/wintun - Mirror only. Official repository is at https://git.zx2c4.com/wintun
• RT-Thread/rt-thread - RT-Thread is an open source IoT operating system.
• eugene-tarassov/vivado-risc-v - Xilinx Vivado block designs for FPGA RISC-V SoC running Debian Linux distro
• gpg/libgcrypt - The GNU crypto library. NOTE: Maintainers are not tracking this mirror. Do not make pull requests here, nor comment any commits, submit them usual way to bug tracker (https://www.gnupg.org/documentation/bts.html) or to the mailing list (https://www.gnupg.org/documentation/mailing-lists.html).
• Xilinx/HLS - Vitis HLS LLVM source code and examples
• Xilinx/XRT - Xilinx Run Time for FPGA
• Tongsuo-Project/Tongsuo - A Modern Cryptographic Primitives and Protocols Library
• rvboards/d1_demo - The demo projects for Allwinner D1 SBC
• zhangleyi/copker -
• jidongxiao/suse - Secure User Space Encryption (SUSE)
• mjosaarinen/lwaes_isa - [HISTORICAL] A Lightweight (RISC-V) ISA Extension for AES and SM4
• T-head-Semi/riscv-aosp - Patches & Script for AOSP to run on Xuantie RISC-V CPU
• openwall/john - John the Ripper jumbo - advanced offline password cracker, which supports hundreds of hash and cipher types, and runs on many operating systems, CPUs, GPUs, and even some FPGAs
• raymondrc/riscv-isa-extension-for-SM4 - RISC-V instruction set extensions for SM4 block cipher
• linux-sunxi/linux-sunxi - Linux source for Allwinner/Boxchip F20 (sun3i), A10 (sun4i), A12/A13/A10S (sun5i) and A20 (sun7i) SoCs
• riscv/riscv-crypto - RISC-V cryptography extensions standardisation work.
• clawsoftware/clawPDF - Open Source virtual PDF printer for Windows // Print to PDF, PDF/A, PDF/X, PNG, JPEG, TIF and text
• sumatrapdfreader/sumatrapdf - SumatraPDF reader
• armink/EasyFlash - Lightweight IoT device information storage solution: KV/IAP/LOG. | 轻量级物联网设备信息存储方案：参数存储、在线升级及日志存储 ，全新一代版本请移步至 https://github.com/armink/FlashDB
• systemd/casync - Content-Addressable Data Synchronization Tool
• mjosaarinen/sm4ni - Demonstration that AES-NI instructions can be used to implement the Chinese Encryption Standard SM4
• maanrachid/PFE-SGX - An implementation for Private Function Evaluation using SGX Intel technology
• bjqiwei/chilli - CTI CallCenter IVR
• wb2osz/direwolf - Dire Wolf is a software "soundcard" AX.25 packet modem/TNC and APRS encoder/decoder. It can be used stand-alone to observe APRS traffic, as a tracker, digipeater, APRStt gateway, or Internet Gateway (IGate). For more information, look at the bottom 1/4 of this page and in https://github.com/wb2osz/direwolf/blob/dev/doc/README.md
• OLIMEX/OLINUXINO - OLINUXINO is Open Source / Open Hardware, low cost from EUR 24 Linux Industrial grade Single Board Computer capable to operate -25+85C
• lldpd/lldpd - implementation of IEEE 802.1ab (LLDP)
• OISF/suricata - Suricata git repository maintained by the OISF
• HoShiMin/HookLib - The functions interception library written on pure C and NativeAPI with UserMode and KernelMode support
• ossec/ossec-hids - OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
• wazuh/wazuh - Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
• PDFium/PDFium -
• espressif/esp-idf - Espressif IoT Development Framework. Official development framework for Espressif SoCs.
• TencentCloud/tc-iot-sdk-embedded-for-esp8266 -
• alibaba/AliOS-Things - 面向IoT领域的、高可伸缩的物联网操作系统，可去官网了解更多信息https://www.aliyun.com/product/aliosthings
• zephyrproject-rtos/zephyr - Primary Git Repository for the Zephyr Project. Zephyr is a new generation, scalable, optimized, secure RTOS for multiple hardware architectures.
• BPI-SINOVOIP/BPI-R64-bsp-4.19 - Supports Banana Pi BPI-R64 (MT7622) (Kernel 4.19)
• arendst/Tasmota - Alternative firmware for ESP8266 with easy configuration using webUI, OTA updates, automation using timers or rules, expandability and entirely local control over MQTT, HTTP, Serial or KNX. Full documentation at
• netdata/netdata - Real-time performance monitoring, done right! https://www.netdata.cloud
• wolfSSL/wolfBoot - wolfBoot is a portable, OS-agnostic, secure bootloader for microcontrollers, supporting firmware authentication and firmware update mechanisms.
• microsoft/PQCrypto-SIDH - SIDH Library is a fast and portable software library that implements state-of-the-art supersingular isogeny cryptographic schemes. The chosen parameters aim to provide security against attackers running a large-scale quantum computer, and security against classical algorithms.
• J08nY/ecgen - Tool for generating Elliptic curve domain parameters
• Mbed-TLS/mbedtls - An open source, portable, easy to use, readable and flexible TLS library, and reference implementation of the PSA Cryptography API.
• ProtonVPN/android-app - Official ProtonVPN Android app
• sandboxie/sandboxie - The Sandboxie application
• libtom/libtomcrypt - LibTomCrypt is a fairly comprehensive, modular and portable cryptographic toolkit that provides developers with a vast array of well known published block ciphers, one-way hash functions, chaining modes, pseudo-random number generators, public key cryptography and a plethora of other routines.
• userlandkernel/USBusted - Research on Apple's USB protocols
• cvra/CAN-USB-dongle-fw - slcan firmware for the CVRA CAN to USB dongle
• spurious/usbip-windows-mirror - An unofficial, automated USB/IP windows driver/userland mirror
• ataradov/dgw - USB HID Data Gateway
• pampanic/pam_panic - A PAM module that protects sensitive data and provides a panic function for emergency situations. Authentication through passwords or removable media.
• gomesjj/r8152 - USB NIC Driver for ESXi 5.1/5.5/6.0/6.5/6.7 based on the Realtek r8152 source code
• pololu/libusbp - The Pololu USB Library (also known as libusbp) is a cross-platform C library for accessing USB devices.
• saewave/STM32F103-USB-CDC-CMSIS - STM32F103 USB CDC CMSIS
• unicornx/osrusbfx2 - Some USB driver code sample for learning writing host drivers for USB devices.
• bb-qq/aqc111 - DSM driver for Aquantia AQC111U(5Gbps) based USB Ethernet adapters
• LinJiabang/virtual-display - USB/Ethernet Display driver sample for Windows
• lcgamboa/USBIP-Virtual-USB-Device - Emulates USB Devices using USBIP in Python or c
• Seagate/openSeaChest - Cross platform utilities useful for performing various operations on SATA, SAS, NVMe, and USB storage devices.
• dgiagio/ipheth - iPhone USB Ethernet Driver
• satoshinm/pill_serial - Triple USB-to-serial adapter firmware for flashing onto an STM32F103C8T6 "blue pill" minimum development board ⛺
• cezuni/usbip_windows - Revive Windows' USB/IP drivers and tools from the dormant SourceForge's one
• fetisov/lrndis - stm32 ethernet over usb (rndis + lwip)
• qca/open-ath9k-htc-firmware - The firmware for QCA AR7010/AR9271 802.11n USB NICs
• NateBrune/silk-guardian - << Silk Guardian >> is an anti-forensic kill-switch that waits for a change on your usb ports and then wipes your ram, deletes precious files, and turns off your computer.
• diederikdehaas/rtl8812AU - Realtek 8812AU USB WiFi driver
• Nuand/bladeRF - bladeRF USB 3.0 Superspeed Software Defined Radio Source Code
• fanggai/loadableDiskFilter - a loadable windows disk filter driver
• amxku/diskfilter - QuickSYS has created this diskfilter SYS for you
• trietptm/diskflt - Automatically exported from code.google.com/p/diskflt
• tanvir-ahmed-m4/com0com - Null-modem emulator - The virtual serial port driver for Windows. Brought to you by: vfrolov Vyacheslav Frolov
• wolfSSL/wolfssl - The wolfSSL library is a small, fast, portable implementation of TLS/SSL for embedded devices to the cloud. wolfSSL supports up to TLS 1.3!
• LibVNC/libvncserver - LibVNCServer/LibVNCClient are cross-platform C libraries that allow you to easily implement VNC server or client functionality in your program.
• Foundry376/Mailspring - 💌 A beautiful, fast and fully open source mail client for Mac, Windows and Linux.
• galkahana/PDF-Writer - High performance library for creating, modiyfing and parsing PDF files in C++
• galkahana/HummusJS - Node.js module for high performance creation, modification and parsing of PDF files and streams
• alibaba/GCanvas - A lightweight cross-platform graphics rendering engine. (超轻量的跨平台图形引擎) https://alibaba.github.io/GCanvas
• cuber/ngx_http_google_filter_module - Nginx Module for Google Mirror
• SoftEtherVPN/SoftEtherVPN - Cross-platform multi-protocol VPN software. Pull requests are welcome. The stable version is available at https://github.com/SoftEtherVPN/SoftEtherVPN_Stable.

C#

• Idov31/Sandman - Sandman is a NTP based backdoor for red team engagements in hardened networks.
• bitwarden/mobile - The mobile app vault (iOS and Android).
• bitwarden/server - The core infrastructure backend (API, database, Docker, etc).
• tryallthethings/DNS-Swapper - This small tools helps to switch between two (IPv4) DNS-Servers with a single mouse click. Intended to be used with Pi-Hole but works great without it as well.
• andrewbadge/DNSRoaming - DNS Roaming is a free and Open Source Client and Service to ensure the DNS Servers are set via a rule / policy rather than the network a PC is connected to.
• Flangvik/TeamFiltration - TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts
• cyberark/PipeViewer - A tool that shows detailed information about named pipes in Windows
• S3cur3Th1sSh1t/SharpImpersonation - A User Impersonation tool - via Token or Shellcode injection
• dotnet/runtime - .NET is a cross-platform runtime for cloud, mobile, desktop, and IoT apps.
• srwi/EverythingToolbar - Everything integration for the Windows taskbar.
• daem0nc0re/TangledWinExec - PoCs and tools for investigation of Windows process execution techniques
• Accenture/Codecepticon - .NET/PowerShell/VBA Offensive Security Obfuscator
• skahwah/SQLRecon - A C# MS SQL toolkit designed for offensive reconnaissance and post-exploitation.
• 0xsp-SRD/0xsp.com - a variety of tools,scripts and techniques developed and shared with different programming languages by 0xsp Lab
• pseymour/MakeMeAdmin - Make Me Admin is a simple, open-source application for Windows that allows standard user accounts to be elevated to administrator-level, on a temporary basis.
• Mr-Un1k0d3r/AMSI-ETW-Patch - Patch AMSI and ETW
• DigitalRuby/IPBan - Since 2011, IPBan is the worlds most trusted, free security software to block hackers and botnets. With both Windows and Linux support, IPBan has your dedicated or cloud server protected. Upgrade to IPBan Pro today and get a discount. Learn more at ↓
• miroslavpejic85/p2p - 🖥️ P2P Remote Desktop - Portable, No Configuration or Installation Needed.
• daem0nc0re/AtomicSyscall - Tools and PoCs for Windows syscall investigation.
• 0xf005ba11/vmplex-ws - A tabbed UI for Microsoft's Hyper-V
• Accenture/Spartacus - Spartacus DLL Hijacking Discovery Tool
• leiurayer/downkyi - 哔哩下载姬downkyi，B站视频下载工具，支持批量下载，支持8K、HDR、杜比视界，提供工具箱（音视频提取、去水印等）。
• Vichingo455/Ransomware3.0 - Ransomware 3.0 by CYBER SOLDIER
• Vichingo455/Petya-CSharp - A Petya version maded in C#
• Vichingo455/PurpleCascade_RansomwareSourceCode - PurpleCascade ransomware source code (decompiled using dnSpy)
• Hildaboo/Rensenware - Source code of the Rensenware ransomware in .NET
• yck1509/KoiVM -
• Loksie/KoiVM-Virtualization - Virtualization made for .NET using ConfuserEX
• advanced-threat-research/DotDumper - An automatic unpacker and logger for DotNet Framework targeting files
• zodiacon/EtwExplorer - View ETW Provider manifest
• microsoft/sbom-tool - The SBOM tool is a highly scalable and enterprise ready tool to create SPDX 2.2 compatible SBOMs for any variety of artifacts.
• Viralmaniar/BigBountyRecon - BigBountyRecon tool utilises 58 different techniques using various Google dorks and open source tools to expedite the process of initial reconnaissance on the target organisation.
• GhostPack/Koh - The Token Stealer
• ShareX/ShareX - ShareX is a free and open source program that lets you capture or record any area of your screen and share it with a single press of a key. It also allows uploading images, text or other types of files to many supported destinations you can choose from.
• harleyQu1nn/AggressorScripts - Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources
• Flangvik/SharpExfiltrate - Modular C# framework to exfiltrate loot over secure and trusted channels.
• iomoath/SharpSpray - Active Directory password spraying tool. Auto fetches user list and avoids potential lockouts.
• rasta-mouse/MiscTools - Miscellaneous Tools
• klezVirus/CheeseTools - Self-developed tools for Lateral Movement/Code Execution
• bohops/SharpRDPHijack - A POC Remote Desktop (RDP) session hijack utility for disconnected sessions
• pkb1s/SharpAllowedToAct - Computer object takeover through Resource-Based Constrained Delegation (msDS-AllowedToActOnBehalfOfOtherIdentity)
• jnqpblc/SharpSpray - SharpSpray a simple code set to perform a password spraying attack against all users of a domain using LDAP and is compatible with Cobalt Strike.
• FSecureLABS/SharpGPOAbuse - SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO.
• FortyNorthSecurity/CIMplant - C# port of WMImplant which uses either CIM or WMI to query remote systems
• mdsecactivebreach/Farmer -
• juliourena/SharpNoPSExec - Get file less command execution for lateral movement.
• 0xthirteen/MoveKit - Cobalt Strike kit for Lateral Movement
• 0xthirteen/SharpRDP - Remote Desktop Protocol .NET Console Application for Authenticated Command Execution
• RiccardoAncarani/LiquidSnake - LiquidSnake is a tool that allows operators to perform fileless lateral movement using WMI Event Subscriptions and GadgetToJScript
• improsec/SharpEventPersist - Persistence by writing/reading shellcode from Event Log
• netero1010/ScheduleRunner - A C# tool with more flexibility to customize scheduled task for both persistence and lateral movement in red team operation
• Ben0xA/DoUCMe -
• outflanknl/SharpHide - Tool to create hidden registry keys.
• mandiant/SharPersist -
• 0xthirteen/SharpStay - .NET project for installing Persistence
• Soledge/BlockEtw - .Net Assembly to block ETW telemetry in current process
• CCob/SharpBlock - A method of bypassing EDR's active projection DLL's by preventing entry point exection
• bats3c/EvtMute - Apply a filter to the events being reported by windows event logging
• GetRektBoy724/SharpUnhooker - C# Based Universal API Unhooker
• CCob/SweetPotato - Local Service to SYSTEM privilege escalation from Windows 7 to Windows 10 / Server 2019
• carlospolop/PEASS-ng - PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)
• rasta-mouse/Watson - Enumerate missing KBs and suggest exploits for useful Privilege Escalation vulnerabilities
• chrismaddalena/SharpCloud - Simple C# for checking for the existence of credential files related to AWS, Microsoft Azure, and Google Compute.
• rxwx/chlonium - Chromium Cookie import / export tool
• djhohnstein/SharpChromium - .NET 4.0 CLR Project to retrieve Chromium data, such as cookies, history and saved logins.
• outflanknl/Net-GPPPassword - .NET implementation of Get-GPPPassword. Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.
• GhostPack/KeeThief - Methods for attacking KeePass 2.X databases, including extracting of encryption key material from memory.
• GhostPack/SharpDPAPI - SharpDPAPI is a C# port of some Mimikatz DPAPI functionality.
• swisskyrepo/SharpLAPS - Retrieve LAPS password from LDAP
• mdsecactivebreach/CloneVault -
• bats3c/ADCSPwn - A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service.
• improsec/ImproHound - Identify the attack paths in BloodHound breaking your AD tiering
• Group3r/Group3r - Find vulnerabilities in AD Group Policy, but do it better than Grouper2 did.
• GhostPack/Rubeus - Trying to tame the three-headed dog.
• tevora-threat/SharpView - C# implementation of harmj0y's PowerView
• FuzzySecurity/StandIn - StandIn is a small .NET35/45 AD post-exploitation toolkit
• rvrsh3ll/SharpPrinter - Discover Printers
• Flangvik/SharpAppLocker - C# port of the Get-AppLockerPolicy PS cmdlet
• mitchmoser/SharpShares - Multithreaded C# .NET Assembly to enumerate accessible network shares in a domain
• vivami/SauronEye - Search tool to find specific files containing specific words, i.e. files containing passwords..
• EncodeGroup/Gopher - C# tool to discover low hanging fruits
• EncodeGroup/AggressiveProxy - Project to enumerate proxy configurations and generate shellcode from CobaltStrike
• Flangvik/CobaltBus - Cobalt Strike External C2 Integration With Azure Servicebus, C2 traffic via Azure Servicebus
• Flangvik/AzureC2Relay - AzureC2Relay is an Azure Function that validates and relays Cobalt Strike beacon traffic by verifying the incoming requests based on a Cobalt Strike Malleable C2 profile.
• cobbr/Covenant - Covenant is a collaborative .NET C2 framework for red teamers.
• rvrsh3ll/MSBuildAPICaller - MSBuild Without MSBuild.exe
• cobbr/SharpSploit - SharpSploit is a .NET post-exploitation library written in C#
• rasta-mouse/TikiTorch - Process Injection
• rasta-mouse/RuralBishop - D/Invoke port of UrbanBishop
• mandiant/DueDLLigence -
• rasta-mouse/ThreatCheck - Identifies the bytes that Microsoft Defender / AMSI Consumer flags on.
• aaaddress1/xlsGen - (PoC) Tiny Excel BIFF8 Generator, to Embedded 4.0 Macros in xls files without Excel.
• FuzzySecurity/Dendrobate - Managed code hooking template.
• med0x2e/GadgetToJScript - A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA based scripts.
• alphaleonis/AlphaVSS - AlphaVSS is a .NET class library released under the MIT license providing a managed API for the Volume Shadow Copy Service also known as VSS.
• alexis-/BitShelter - Snapshots & Backups for Windows
• nickvourd/COM-Hunter - COM Hijacking VOODOO
• NewEraCracker/LOIC - Low Orbit Ion Cannon - An open source network stress tool, written in C#. Based on Praetox's LOIC project. USE ON YOUR OWN RISK. WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES.
• moaistory/WinSearchDBAnalyzer - http://moaistory.blogspot.com/2018/10/winsearchdbanalyzer.html
• dotnet/maui - .NET MAUI is the .NET Multi-platform App UI, a framework for building native device applications spanning mobile, tablet, and desktop.
• xct/winpspy - CLI monitor for windows process- & file activity
• L1ghtM4n/DynamicStealer - 🔑 Load & Invoke password stealer DLL and upload report to Telegram Bot
• GhostPack/Certify - Active Directory certificate abuse.
• GhostPack/SharpUp - SharpUp is a C# port of various PowerUp functionality.
• nettitude/SharpWSUS -
• Stealerium/Stealerium - Stealer + Clipper + Keylogger
• nettitude/MalSCCM -
• filescanio/fsCommunity - Collection of scripts / samples / snippits around the community service at www.filescan.io
• nilaoda/N_m3u8DL-CLI - [.NET] m3u8 downloader 开源的命令行m3u8/HLS/dash下载器，支持普通AES-128-CBC解密，多线程，自定义请求头等. 支持简体中文,繁体中文和英文. English Supported.
• Dec0ne/KrbRelayUp - KrbRelayUp - a universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings).
• Wra7h/ARCInject - Overwrite a process's recovery callback and execute with WER
• Klocman/Bulk-Crap-Uninstaller - Remove large amounts of unwanted applications quickly.
• aspose-words/Aspose.Words-for-.NET - Aspose.Words for .NET examples, plugins and showcases
• Tulpep/Notification-Popup-Window - A notification window that appears on the lower right part of the screen.
• jstrosch/learning-malware-analysis - This repository contains sample programs that mimick behavior found in real-world malware. The goal is to provide source code that can be compiled and used for learning purposes, without having to worry about handling live malware.
• NickeManarin/ScreenToGif - 🎬 ScreenToGif allows you to record a selected area of your screen, edit and save it as a gif or video.
• icsharpcode/ILSpy - .NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!
• lostindark/DriverStoreExplorer - Driver Store Explorer [RAPR]
• PwnDexter/SharpEDRChecker - Checks running processes, process metadata, Dlls loaded into your current process and the each DLLs metadata, common install directories, installed services and each service binaries metadata, installed drivers and each drivers metadata, all for the presence of known defensive products such as AV's, EDR's and logging tools.
• UnamSanctam/UnamDownloader - A Free Silent (Hidden) Open Source Downloader (Binder) - Includes Windows Defender Bypass - Build Native - Unam Downloader
• volodymyrsmirnov/MalwareMultiScan - Self-hosted VirusTotal / MetaDefender wannabe with API, demo UI and Scanners running in Docker.
• dev-2null/ADCollector - A lightweight tool to quickly extract valuable information from the Active Directory environment for both attacking and defending.
• matterpreter/DefenderCheck - Identifies the bytes that Microsoft Defender flags on.
• lckt0/DotKill-Unpacker - This program can remove Anti De4Dot, Junk Types, Math Protection, Anti Decompiler, Control Flow protections from a .NET assembly.
• de4dot/de4dot - .NET deobfuscator and unpacker.
• XenocodeRCE/neo-ConfuserEx - Updated ConfuserEX, an open-source, free obfuscator for .NET applications
• yck1509/ConfuserEx - An open-source, free protector for .NET applications
• Washi1337/Echo - Generic static analysis framework.
• Washi1337/AsmResolver - A library for creating, reading and editing PE files and .NET modules.
• 0xd4d/dnlib - Reads and writes .NET assemblies and modules
• dnSpy/dnSpy - .NET debugger and assembly editor
• NotPrab/AgileStringDecryptor - a dynamic Agile.NET string decryptor that relies on invoke by wwh1004 | Version : 6.X
• ribthegreat99OrN0P/Agile.NET-Deobfuscator-Latest - A newly programmed tool that will deobfuscate Agile.Net Obfuscation.
• waynebonc/AgileDotNet-StringDeobfuscator - String decryption for Agile.NET packed assemblies.
• mandiant/OfficePurge -
• leeberg/CashCatRansomwareSimulator - A simple windows ransomware simulator that will rename .TXT files a ransomware extension to simulate ransomware behavior for testing various monitoring tools
• hackthedev/teardrop - Open-Source Ransomware Project for learning purpose only written in C# (csharp). Dont use it for bad things.
• NightfallGT/Nitro-Ransomware - Discord nitro gift subscription ransomware
• codesiddhant/Jasmin-Ransomware - Jasmin Ransomware is an advanced red team tool (WannaCry Clone) used for simulating real ransomware attacks. Jasmin helps security researchers to overcome the risk of external attacks.
• SneakSensed/HiddenTear - HiddenTear Cyan Edition - A real life ransomware coded in C#
• fraktalcyber/Fransom - Fraktal's Ransomware Emulator
• AlphaDelta/DUMB - A fast and advanced ransomware PoC
• nccgroup/ransomware-simulator - NCC Group Ransomware Simulator
• Virgula0/hidden-tear - An open source RansomWare
• nccgroup/KilledProcessCanary - A canary designed to minimize the impact from certain Ransomware actors
• lithnet/access-manager - Access Manager provides web-based access to local admin (LAPS) passwords, BitLocker recovery keys, and just-in-time administrative access to Windows computers in a modern, secure, and user-friendly way.
• 0x00000FF/rensenware-cut - cut version of rensenware
• goliate/hidden-tear - ransomware open-sources
• aleksk/LazyCopy - NTFS minifilter driver that can download file content from a remote location, when it is opened for the first time.
• wmjordan/PDFPatcher - PDF补丁丁——PDF工具箱，可以编辑书签、剪裁旋转页面、解除限制、提取或合并文档，探查文档结构，提取图片、转成图片等等
• microsoft/perfview - PerfView is a CPU and memory performance-analysis tool
• CyberPoint/Ruxcon2016ETW - Ruxcon2016 POC Code
• microsoft/dotnet-samples - Contains samples and documentation for libraries and tools of the .NET framework. Pull requests welcome!
• microsoft/Tx - Tx (LINQ to Events)
• 3lp4tr0n/BeaconHunter - Detect and respond to Cobalt Strike beacons using ETW.
• mai1zhi2/SharpBeacon - CobaltStrike Beacon written in .Net 4 用.net重写了stager及Beacon，其中包括正常上线、文件管理、进程管理、令牌管理、结合SysCall进行注入、原生端口转发、关ETW等一系列功能
• Flangvik/NetLoader - Loads any C# binary in mem, patching AMSI + ETW.
• lowleveldesign/process-governor - This application allows you to put various limits on a Windows process.
• lowleveldesign/wtrace - Command line tracing tool for Windows, based on ETW.
• DamonMohammadbagher/ETWProcessMon2 - ETWProcessMon2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detection by VirtualMemAlloc Events (in-memory) etc.
• microsoft/Microsoft.Diagnostics.Tracing.Logging - .NET library for logging data via EventSource/ETW
• goldshtn/etrace - Command-line tool for ETW tracing on files and real-time events
• mandiant/SilkETW -
• yuanrui/EverythingSZ - EverythingSZ is a learning project to research Everything background technology. original source code stored in CodePlex, this branch support .net core.
• Lazuplis-Mei/ADSTool - 提供操作NTFS文件的AlternateDataStream可选数据流的工具，可以用于文件的隐藏
• bsonnino/ADSViewer - Tool to list, show contents or delete Alternate Data Streams (ADS) from NTFS. This tool is handy to unblock files that come from the internet. For more details, take a look at my blog post at http://blogs.msmvps.com/bsonnino/2016/11/24/alternate-data-streams-in-c/
• TalAloni/MD5Stream - Store MD5 hash in NTFS Alternate Data Stream
• yesan/EverythingCSharp - Use NTFS Change Journal to make your EveryThing by CSharp 。Repo from https://archive.codeplex.com/?p=everythingsz
• raandree/NTFSSecurity - Managing permissions with PowerShell is only a bit easier than in VBS or the command line as there are no cmdlets for most day-to-day tasks like getting a permission report or adding permission to an item. PowerShell only offers Get-Acl and Set-Acl but everything in between getting and setting the ACL is missing. This module closes the gap.
• DiscUtils/DiscUtils - Utility libraries to interact with discs, filesystem formats and more
• ncatlin/rgat - An instruction trace visualisation tool for dynamic program analysis
• n0dec/MalwLess - Test Blue Team detections without running any attack.
• aaaddress1/my-Little-Ransomware - easy ransomware module base on csharp.
• quasar/Quasar - Remote Administration Tool for Windows
• securesean/DecryptAutoLogon - Command line tool to extract/decrypt the password that was stored in the LSA by SysInternals AutoLogon
• lsauer/entropy - ent is a small, fast command line utility, plotting various entropy related metrics of files or pipe/stdin streams
• GhostPack/Lockless - Lockless allows for the copying of locked files.
• GhostPack/SafetyKatz - SafetyKatz is a combination of slightly modified version of @gentilkiwi's Mimikatz project and @subtee's .NET PE Loader
• GhostPack/Seatbelt - Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.
• malware-dev/MDK-SE - Malware's Development Kit for SE
• the1812/Malware-Patch - 阻止中国流氓软件的管理员授权. / Prevent UAC authorization of Chinese malware.
• outflanknl/EvilClippy - A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX and Windows.
• DKorablin/PEReader - Portable Executable (+), Common Language Infrastructure format reader
• zodiacon/PEExplorer - Portable Executable Explorer
• microsoft/binskim - A binary static analysis tool that provides security and correctness results for Windows Portable Executable and *nix ELF binary formats
• secana/PeNet - Portable Executable (PE) library written in .Net
• yuzhengyang/Everything - 探索Everything背后的技术（USN和MFT）
• microsoft/Microsoft-Performance-Tools-Linux-Android - Linux, Android and Chromium Performance Tools built using the Microsoft Performance Toolkit. Cross-platform .NET Core + WPA GUI
• ShaneK2/inVtero.net - inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques
• bigbaldy1128/DotNetDetour - DotNetDetour is a software package for monitoring and instrumenting API calls
• Aetsu/SLib - SLib is a sandbox evasion library that implements some of the checks from https://evasions.checkpoint.com in C#
• lucasg/Dependencies - A rewrite of the old legacy software "depends.exe" in C# for Windows devs to troubleshoot dll load dependencies issues.
• itext/itext7-dotnet - iText for .NET is the .NET version of the iText library, formerly known as iTextSharp, which it replaces. iText represents the next level of SDKs for developers that want to take advantage of the benefits PDF can bring. Equipped with a better document engine, high and low-level programming capabilities and the ability to create, edit and enha
• ryangriggs/PDFEncrypt - A C# application to encrypt existing PDF documents
• stchan/PdfScribe - A PDF virtual printer for 64-bit Windows / .NET 4.8 or later
• pdfforge/PDFCreator - PDFCreator - The free PDF Converter
• HangfireIO/Hangfire - An easy way to perform background job processing in your .NET and .NET Core applications. No Windows Service or separate process required
• dotnet-architecture/eShopOnContainers - Cross-platform .NET sample microservices and container based application that runs on Linux Windows and macOS. Powered by .NET 7, Docker Containers and Azure Kubernetes Services. Supports Visual Studio, VS for Mac and CLI based environments with Docker CLI, dotnet CLI, VS Code or any other code editor.
• EduardoPires/EquinoxProject - Full ASP.NET Core 6 application with DDD, CQRS and Event Sourcing concepts
• dotnetcore/Util - Util是一个.net core平台下的应用框架，旨在提升小型团队的开发输出能力，由常用公共操作类(工具类)、分层架构基类、Ui组件，第三方组件封装，第三方业务接口封装，配套代码生成模板，权限等组成。
• dotnet-architecture/eShopOnWeb - Sample ASP.NET Core 6.0 reference application, powered by Microsoft, demonstrating a layered application architecture with monolithic deployment model. Download the eBook PDF from docs folder.
• ElectronNET/Electron.NET - Build cross platform desktop apps with ASP.NET Core (Razor Pages, MVC, Blazor).
• jnagykuhlen/CompactMPC - A lightweight library for secure multi-party computation (MPC) based on the GMW protocol, fully written in C#.
• Rintagi/Low-Code-Development-Platform - Rintagi is the world's first open source low-code application platform with limitless extension and rejuvenation built and maintained by Robocoder Corporation. Since 1999, Robocoder Corporation has used Rintagi to develop and maintain mission-critical database applications for reputable companies, spanning multiple industries.
• googleprojectzero/sandbox-attacksurface-analysis-tools - Set of tools to analyze Windows sandboxes for exposed attack surface.
• dathlin/HslControlsDemo - HslControls控件库的使用demo，HslControls是一个工业物联网的控件库，基于C#开发，配套HslCommunication组件可以实现工业上位机软件的快速开发，支持常用的工业图形化控件，快速的集成界面开发。 主要包含了按钮，开关，进度条，信号灯，数码管，时钟，曲线显示控件，仪表盘控件，管道控件，瓶子控件，饼图控件，传送带控件，温度计控件，鼓风机控件，阀门控件，电池控件等等。
• dathlin/HslCommunication - A very popular industrial Internet of Things communication plug-in. Using this dll can be very convenient, stable, and fast to obtain data from PLC equipment of multiple brands, and also supports redis, mqtt, websocket, etc., which can let your data on the network Free transmission, reducing enterprise development costs.
• Rambalac/ACDDokanNet - Dokan.NET based driver for Amazon Cloud Drive
• jakubgarfield/Bonobo-Git-Server - Bonobo Git Server for Windows is a web application you can install on your IIS and easily manage and connect to your git repositories. Go to homepage for release and more info.
• ONLYOFFICE/CommunityServer - Free open source office suite with business productivity tools: document and project management, CRM, mail aggregator.
• aspnetboilerplate/aspnetboilerplate - ASP.NET Boilerplate - Web Application Framework
• telerik/kendo-ui-demos-service - Back-end service used for the Kendo UI Online Demos
• PawelTroka/Computator.NET - Computator.NET is a special kind of numerical software that is fast and easy to use but not worse than others feature-wise. It's features include: - Real and complex functions charts - Real and complex calculator - Real functions numerical calculations including different methods - Over 107 Elementary functions - Over 141 Special functions - Over 21 Matrix functions and operations - Scripting language with power to easy computations including matrices - You can declare your own custom functio

C++

• 1technophile/OpenMQTTGateway - MQTT gateway for ESP8266, ESP32, Sonoff RF Bridge or Arduino with bidirectional 433mhz/315mhz/868mhz, Infrared communications, BLE, Bluetooth, beacons detection, mi flora, mi jia, LYWSD02, LYWSD03MMC, Mi Scale, TPMS, BBQ thermometer compatibility, SMS & LORA.
• rad9800/TamperingSyscalls -
• Dec0ne/HWSyscalls - HWSyscalls is a new method to execute indirect syscalls using HWBP, HalosGate and a synthetic trampoline on kernel32 with HWBP.
• JackBro/BetaShield - BetaShield Windows x86 Ring3 Anticheat v2
• horsicq/XAPKDetector - APK/DEX detector for Windows, Linux and MacOS.
• CodingGay/BlackDex - BlackDex is an Android unpack(dexdump) tool, it supports Android 5.0~12 and need not rely to any environment. BlackDex can run on any Android mobile phone or emulator, you can unpack APK File in several seconds.
• TheD1rkMtr/FilelessPELoader - Loading Remote AES Encrypted PE in memory , Decrypted it and run it
• TheD1rkMtr/ntdlll-unhooking-collection - different ntdll unhooking techniques : unhooking ntdll from disk, from KnownDlls, from suspended process, from remote server (fileless)
• TheD1rkMtr/Shellcode-Hide - This repo contains : simple shellcode Loader , Encoders (base64 - custom - UUID - IPv4 - MAC), Encryptors (AES), Fileless Loader (Winhttp, socket)
• keepassxreboot/keepassxc - KeePassXC is a cross-platform community-driven port of the Windows application “Keepass Password Safe”.
• oguzhaninan/Stacer - Linux System Optimizer and Monitoring - https://oguzhaninan.github.io/Stacer-Web
• soui3/soui - the simplest direct ui engine!
• SOUI2/soui - SOUI是目前为数不多的轻量级可快速开发window桌面程序开源DirectUI库.其前身为Duiengine,更早期则是源自于金山卫士开源版本UI库Bkwin.经过多年持续更新方得此库
• kavika13/RemCom - Remote Command Executor: A OSS replacement for PsExec and RunAs - or Telnet without having to install a server. Take your pick :)
• bitcoin/bitcoin - Bitcoin Core integration/staging tree
• rad9800/hwbp4mw -
• D1rkMtr/ExplorerPersist - Explorer Persistence technique : Hijacking cscapi.dll order loading path and writing our malicious dll into C:\Windows\cscapi.dll , when it's get loaded into the explorer process , our malicoius code get executed
• D1rkMtr/UnhookingPatch - Bypass EDR Hooks by patching NT API stub, and resolving SSNs and syscall instructions at runtime
• BitBangingBytes/gr-smart_meters -
• WerWolv/ImHex - 🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
• weak1337/Alcatraz - x64 binary obfuscator
• oclint/oclint - A static source code analysis tool to improve quality and reduce defects for C, C++ and Objective-C
• danmar/cppcheck - static analysis of C/C++ code
• trojan-gfw/trojan - An unidentifiable mechanism that helps you bypass GFW.
• kkent030315/CVE-2022-42046 - CVE-2022-42046 Proof of Concept of wfshbr64.sys local privilege escalation via DKOM
• BiltuDas1/no-edge - An Open Source Project that removes Build-in Microsoft Edge without breaking Windows Webview
• cloudfuzz/android-kernel-exploitation - Android Kernel Exploitation
• hggq/paozhu - paozhu🧨 C++ Web Framework,Support HTTP1 HTTP2, Rapid development of CRUD web applications, Include modules HttpServer HttpClient WebSocket ORM
• br-sn/CheekyBlinder - Enumerating and removing kernel callbacks using signed vulnerable drivers
• 0voice/cpp_new_features - 2021年最新整理， C++ 学习资料，含C++ 11 / 14 / 17 / 20 / 23 新特性、入门教程、推荐书籍、优质文章、学习笔记、教学视频等
• exaloop/codon - A high-performance, zero-overhead, extensible Python compiler using LLVM
• zodiacon/WFPExplorer - Windows Filtering Platform Explorer
• hackerhouse-opensource/iscsicpl_bypassUAC - UAC bypass for x64 Windows 7 - 11
• JustasMasiulis/inline_syscall - Inline syscalls made easy for windows on clang
• microsoft/terminal - The new Windows Terminal and the original Windows console host, all in the same place!
• NUL0x4C/DeleteShadowCopies - Deleting Shadow Copies In Pure C++
• hasherezade/pe-bear - Portable Executable reversing tool with a friendly GUI
• D1rkMtr/IORI_Loader - UUID shellcode Loader with dynamic indirect syscall implementation, syscall number/instruction get resolved dynamicaly at runtime, and the syscall number/instruction get unhooked using Halosgate technique. Function address get resolved from the PEB by offsets and comparaison by hashes
• chris2511/xca - X Certificate and Key management
• morispi/CONSENT - Scalable long read self-correction and assembly polishing with multiple sequence alignment
• zkmkarlsruhe/ofxTensorFlow2 - TensorFlow 2 AI/ML library wrapper for openFrameworks
• memo/ofxMSATensorFlow - openframeworks addon + examples for Google's TensorFlow numerical computation and machine learning library
• p12tic/libsimdpp - Portable header-only C++ low level SIMD library
• moble/clustalx - Version 2.1.1 for compiling with Qt 5
• sheep-o/Windows-MBR-Overwrite - Code that overwrites the Windows MBR with a custom bootloader!
• xorangekiller/gptgen - Gptgen is a tool to convert an MBR partition table to GPT while retaining all data on the disk.
• MalwareTech/FakeMBR - TDL4 style rootkit to spoof read/write requests to master boot record
• D1rkMtr/ExecRemoteAssembly - Execute Remote Assembly with args passing and with AMSI and ETW patching
• 0vercl0k/wtf - wtf is a distributed, code-coverage guided, customizable, cross-platform snapshot-based fuzzer designed for attacking user and / or kernel-mode targets running on Microsoft Windows.
• eddeeh/kdmapper - driver manual mapper (outdated/for educational purposes)
• Deputation/pagewalkr - An x64 page table iterator written in C++ as a kernel mode windows driver.
• ergrelet/Scylla - Fork of Scylla with additional fixes and Python bindings.
• x64dbg/Scripts - A collection of x64dbg scripts. Feel free to submit a pull request to add your script.
• KiFilterFiberContext/warbird-hook - Using Microsoft Warbird to automatically unpack and execute encrypted shellcode in ClipSp.sys without triggering PatchGuard
• 0xRick/PE-Parser - https://0xrick.github.io/win-internals/pe8/
• Hildaboo/NotPetyaFileEncryptor - Decompiled NotPetya File Encryptor Code
• Hildaboo/conti_locker - Conti Ransomware Source Code
• Hildaboo/BabukRansomware - Reversed source code of the Babuk Ransomware Version 1
• Serial-Studio/Serial-Studio - Multi-purpose serial data visualization & processing program
• hasherezade/petya_recovery - Application for cracking Red Petya key based on genetic algorithms.
• hasherezade/masm_shc - A helper utility for creating shellcodes. Cleans MASM file generated by MSVC, gives refactoring hints.
• 340211173/capture-hpc -
• vxunderground/VX-API - Collection of various malicious functionality to aid in malware development
• yardenshafir/SymlinkCallback - A driver that hooks C: volume using symbolic link callback to track all FS access to the volume
• Xilinx/Vitis_Libraries - Vitis Libraries
• Wh04m1001/IDiagnosticProfileUAC -
• aahmad097/AlternativeShellcodeExec - Alternative Shellcode Execution Via Callbacks
• WithSecureLabs/CallStackSpoofer - A PoC implementation for spoofing arbitrary call stacks when making sys calls (e.g. grabbing a handle via NtOpenProcess)
• geemion/Khepri - Free,Open-Source,Cross-platform agent and Post-exploiton tool written in Golang and C++.
• 0x09AL/IIS-Raid - A native backdoor module for Microsoft IIS (Internet Information Services)
• Kharos102/NtdllUnpatcher - Example code for EDR bypassing
• hlldz/RefleXXion - RefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc. In order to bypass the user-mode hooks, it first collects the syscall numbers of the NtOpenFile, NtCreateSection, NtOpenSection and NtMapViewOfSection found in the LdrpThunkSignature array.
• S3cur3Th1sSh1t/MultiPotato -
• hlldz/dazzleUP - A tool that detects the privilege escalation vulnerabilities caused by misconfigurations and missing updates in the Windows operating systems.
• hoangprod/AndrewSpecial - AndrewSpecial, dumping lsass' memory stealthily and bypassing "Cilence" since 2019.
• RedCursorSecurityConsulting/PPLKiller - Tool to bypass LSA Protection (aka Protected Process Light)
• Barbarisch/forkatz - credential dump using foreshaw technique using SeTrustedCredmanAccessPrivilege
• outflanknl/Recon-AD - Recon-AD, an AD recon tool based on ADSI and reflective DLL’s
• WithSecureLabs/C3 - Custom Command and Control (C3). A framework for rapid prototyping of custom C2 channels, while still providing integration with existing offensive toolkits.
• zeronetworks/rpcfirewall -
• Idov31/Nidhogg - Nidhogg is an all-in-one simple to use rootkit for red teams.
• polycube-network/polycube - eBPF/XDP-based software framework for fast network services running in the Linux kernel.
• airbus-cert/ttddbg - Time Travel Debugging IDA plugin
• am0nsec/wspe - Windows System Programming Experiments
• Cr4sh/KernelForge - A library to develop kernel level Windows payloads for post HVCI era
• sailay1996/CdpSvcLPE - Windows Local Privilege Escalation via CdpSvc service (Writeable SYSTEM path Dll Hijacking)
• JLospinoso/gargoyle - A memory scanning evasion technique
• m417z/global-inject-demo - A global injection and hooking example
• horsicq/XELFViewer - ELF file viewer/editor for Windows, Linux and MacOS.
• csandker/InterProcessCommunication-Samples - Some Code Samples for Windows based Inter-Process-Communication (IPC)
• wbenny/pdbex - pdbex is a utility for reconstructing structures and unions from the PDB into compilable C headers
• xct/windows-kernel-exploits - Some of my windows kernel exploits for learning purposes
• stackrox/collector -
• x64dbg/TitanEngine - Debug engine for x64dbg.
• ZipCPU/autofpga - A utility for Composing FPGA designs from Peripherals
• ultraembedded/core_ft60x_axi - FTDI FT600 SuperSpeed USB3.0 to AXI bus master
• c3rb3ru5d3d53c/binlex - A Binary Genetic Traits Lexer Framework
• archercreat/vmpfix - Universal x86/x64 VMProtect 2.0-3.X Import fixer
• seclab-ucr/IncreLux - Progressive Scrutiny: Incremental Detection of UBI bugs in the Linux Kernel
• GJDuck/RedFat - A binary hardening system
• GJDuck/LowFat - Lean C/C++ Bounds Checking with Low-Fat Pointers
• tekwizz123/HEVD-Exploit-Solutions - Solutions to HackSysExtremeVulnerableDriver challenges though my following of @FuzzySecurity's tutorials plus futher explanations where needed.
• Cracked5pider/conti_locker - Conti Locker source code
• 3nock/sub3suite - a free, open source, cross platform Intelligence gathering tool.
• ydb-platform/ydb - YDB is an open source Distributed SQL Database that combines high availability and scalability with strong consistency and ACID transactions
• TheWover/Manager - Library of tools and examples for loading/bootstrapping managed code from unmanaged code in .NET
• microsoft/win32metadata - Tooling to generate metadata for Win32 APIs in the Windows SDK.
• BehroozAbbassi/sdkffi - A code parser for C-Style header files that lets you to parse function's prototypes and data types used in their parameters.
• IntelLabs/control-flag - A system to flag anomalous source code expressions by learning typical expressions from training data
• tf-encrypted/tf-seal - Bridge between TensorFlow and the Microsoft SEAL homomorphic encryption library
• google/binexport - Export disassemblies into Protocol Buffers
• facebookresearch/fbpcf - Private computation framework library allows developers to perform randomized controlled trials, without leaking information about who participated or what action an individual took. It uses secure multiparty computation to guarantee this privacy. It is suitable for conducting A/B testing, or measuring advertising lift and learning the aggregate statistics without sharing information on the individual level.
• ceph/ceph - Ceph is a distributed object, block, and file storage platform
• hmailserver/hmailserver -
• telegramdesktop/tdesktop - Telegram Desktop messaging app
• qbittorrent/qBittorrent - qBittorrent BitTorrent client
• TheCruZ/Direct-EFI-Apex-Cheat -
• SamuelTulach/efi-memory - PoC EFI runtime driver for memory r/w & kdmapper fork
• TheCruZ/kdmapper - KDMapper is a simple tool that exploits iqvw64e.sys Intel driver to manually map non-signed drivers in memory
• UCFoxi/VTableKFunctionHook - This project will give you an example how you can hook a kernel vtable function that cannot be directly called
• Souhardya/ChimeraLdr - Multipurpose malware framework
• Souhardya/Slavyana - Windows Sandbox Framework
• crypto2011/IDR - Interactive Delphi Reconstructor
• ladislav-zezula/FileTest - Source code for File Test - Interactive File System Test Tool
• POV-Ray/povray - The Persistence of Vision Raytracer: http://www.povray.org/
• google/network-opt - A library for topological network optimization
• DragonQuestHero/Win32KernelSTL - Using C++ STL on Windows kernle development
• jxy-s/stlkrn - C++ STL in the Windows Kernel with C++ Exception Support
• nihilus/ScyllaHide -
• helloobaby/infinityhookEx - hook system call that on user mode
• FiYHer/InfinityHookPro - InfinityHookPro Win7 -> Win11 latest
• DKingAlpha/SSDT-Index - Ready-to-use headers for Windows Kernel SSDT indices
• kouzhudong/process - some code with process
• kouzhudong/libdrv - Static Library For Windows Drivers
• wes4m/unHooker - Kernel (Ring0) - SSDT unhook driver
• hostzhen/sysark - Sysark全称system anti-rootkit，是我学习内核写的工具（2013年的代码，后续不会再更新），里面基本上所有的功能都是用内核实现的。这里只是实现了反rootkit部分功能，作为工具的话，本人觉得还欠完善，但作为学习，或有人需要。目前针对的是XP SP2，对于其它版本的系统或者BSOD的问题，需要的人DIY一下。目前实现的功能： 进程/线程/模块、 驱动模块、 SSDT、 Shadow SSDT、 注册表——解析hive文件、 文件、 启动项、 服务
• namjkee/ssdt.Recover.21yu3 - 绕过卡巴斯基主动防御,加载驱动，unhook所有ssdt hook及shadow ssdt hook
• bronzeMe/SSDT_Hook_x64 -
• keystone-engine/keystone - Keystone assembler framework: Core (Arm, Arm64, Hexagon, Mips, PowerPC, Sparc, SystemZ & X86) + bindings
• cmu-sei/pharos - Automated static analysis tools for binary programs
• hasherezade/process_overwriting - Yet another variant of Process Hollowing
• ajkhoury/SigMaker-x64 - IDA Pro 7 compatible SigMaker plugin
• d3v1l401/FindCrypt-Ghidra - IDA Pro's FindCrypt ported to Ghidra, with an updated and customizable signature database
• zodiacon/PoolMonX - A GUI version of the classic PoolMon tool
• zodiacon/PoolMonXv2 - Kernel Pool Monitor
• intelpt/WindowsIntelPT - This driver implements the Intel Processor Trace functionality in Intel Skylake architecture for Microsoft Windows
• Velocidex/c-aff4 - An AFF4 C++ implementation.
• DiceLock/DiceChecker - DiceChecker is a C++ dynamic-link library (.dll) for Windows environments implementing NIST Frequency, Block Frequency, Cumulative Sum Forward, Cumulative Sum Reverse, Runs, Longest Run Of Ones, Rank, Universal, Approximate Entropy, Serial and Discrete Fourier Transform random number tests. DiceChecker allows to work with physical memory kept in RAM.
• dorcoh/EntropyApproximator - Experimental tool for approximating high dimensional combinatorics
• marbl/MashMap - A fast approximate aligner for long DNA sequences
• OSRDrivers/WDF-I - Writing WDF Drivers I: Core Concepts Lab Material
• OSRDrivers/kmexts - Simple driver to register all available process, thread, image, Registry, and Object callbacks
• zodiacon/windowskernelprogrammingbook - The Windows Kernel Programming book samples
• xuanxuan0/DripLoader - Evasive shellcode loader for bypassing event-based injection detection (PoC)
• SHA-MRIZ/FsMinfilterHooking -
• uf0o/windows-ps-callbacks-experiments - Files for http://blog.deniable.org/posts/windows-callbacks/
• Rostelecom-Red-Team/GoodbyeEDR -
• zeroperil/HookDump - Security product hook detection
• asaurusrex/Probatorum-EDR-Userland-Hook-Checker - Project to check which Nt/Zw functions your local EDR is hooking
• qtkite/defender-control - An open-source windows defender manager. Now you can disable windows defender permanently.
• phackt/stager.dll - Code from this article: https://blog.rapid7.com/2018/05/03/hiding-metasploit-shellcode-to-evade-windows-defender/
• APTortellini/unDefender - Killing your preferred antimalware by abusing native symbolic links and NT paths.
• last-byte/unDefender - Killing your preferred antimalware by abusing native symbolic links and NT paths.
• Zhuagenborn/Plants-vs.-Zombies-Online-Battle - 🧟 Plants vs. Zombies multiplayer battle, developed via reverse engineering, inline hook and dynamic-link library injection. Two online players defend and attack as the plant and zombie respectively.
• lab52io/StopDefender - Stop Windows Defender programmatically
• zodiacon/DeviceExplorer -
• MountCloud/FireDog - 🔥开源跨平台轻量级病毒特征检测引擎。Open source cross-platform lightweight virus signature detection engine.
• NabilTheNoise/LCS - LCS is an algorithm to find the Longest Common Subsequence between two Strings.
• fpavetic/lcskpp - LCSk++: Practical similarity metric for long strings
• ameli/lcs - Extracts Lagrangian Coherent Structures form flow.
• google/fast-simple-lcsk - Fast and simple algorithms for computing both LCSk and LCSk+
• TrainingByPackt/CPP-Data-Structures-and-Algorithm-Design-Principles - Leverage the power of modern C++ to build robust and scalable applications
• svgsponer/SqLoss - Sequence Regression in All-Subsequence Space
• sohamsadhu/Longest-common-subsequence - A collection of four algotihms implemented in C++ and compared to find the longest common subsequence in strings with binary digits and only genetic charactes ACGT.
• seqan/seqan3 - The modern C++ library for sequence analysis. Contains version 3 of the library and API docs.
• google/riegeli - Riegeli/records is a file format for storing a sequence of string records, typically serialized protocol buffers.
• marbl/canu - A single molecule sequence assembler for genomes large and small.
• 0vercl0k/rp - rp++ is a fast C++ ROP gadget finder for PE/ELF/Mach-O x86/x64/ARM/ARM64 binaries.
• Meteorix/pylcs - super fast cpp implementation of longest common subsequence/substring
• celstark/MST - Mnemonic Similarity Task
• zhipeng93/simrank - Code for VLDB17 paper "An Experimental Evaluation of SimRank-based Similarity Search Algorithms"
• neustar/string-similarity -
• PDB-REDO/alphafill - AlphaFill is an algorithm based on sequence and structure similarity that “transplants” missing compounds to the AlphaFold models. By adding the molecular context to the protein structures, the models can be more easily appreciated in terms of function and structure integrity.
• oertl/probminhash - ProbMinHash – A Class of Locality-Sensitive Hash Algorithms for the (Probability) Jaccard Similarity
• zhaoyanswill/RAPSearch2 - Reduced Alphabet based Protein similarity Search
• david-cortes/isotree - (Python, R, C/C++) Isolation Forest and variations such as SCiForest and EIF, with some additions (outlier detection + similarity + NA imputation)
• sdhash/sdhash - similarity digest hashing tool
• ParBLiSS/FastANI - Fast Whole-Genome Similarity (ANI) Estimation
• googleprojectzero/functionsimsearch - Some C++ example code to demonstrate how to perform code similarity searches using SimHashing.
• aetilius/pHash - pHash - the open source perceptual hash library
• nmslib/nmslib - Non-Metric Space Library (NMSLIB): An efficient similarity search library and a toolkit for evaluation of k-NN methods for generic non-metric spaces.
• facebookresearch/faiss - A library for efficient similarity search and clustering of dense vectors.
• twelvesec/panicbutton - Windows application aiming to preserve cryptographic information used by ransomware operations. If you suspect a ransomware is running on your pc, then hit the Panic button! Panic Button will dump all of your memory (and potentially the encryption keys of the ransomware) to a file and hibernate your system. Then you should call the IT guys :)
• Randomize163/FSDefender - Technion CS Ransomware Project: Writing Windows Mini-Filter Driver to protect PC from Ransomware
• fcorbelli/zpaqfranz - Deduplicating archiver with encryption and paranoid-level tests. Swiss army knife for the serious backup and disaster recovery manager. Ransomware neutralizer. Win/Linux/Unix
• mogongtech/RansomDetection - 基于行为的Ransomware检测原型
• AHXR/Trojan.Win32.Lockdown - 🔒 Shutdown 2017 Malware (Worm - Ransomware - Rogue Security Software) - Includes AHXR-ScreenLock (Screen Lock Builder - Kills Task Manager + Locks Computer + Attaches Executable)
• adamkramer/handle_monitor - Identifying and Disrupting Crypto-Ransomware (and Destructive Malware) using handle heurustics
• Hildaboo/BabukRansomwareSourceCode - Leaked source code of the babuk ransomware by VXUG
• HIBC2017/WANNAFIX - WANNAFIX is a mitigation script for the recent WANNACRY Ransomware attack
• Mahmoud7Osman/CVenom - CVenom is An Ultra Easy-To-Use Cross-Platform Malware Development Framework For Advanced Malware Development
• Mahmoud7Osman/Cleny - Cleny is An Interpreted Coding Language Used To Facilate UI Structuring And Styling For CLI Based Projects
• graniet/fsociety-ransomware-MrRobot - This is Jester ransomware like, in Mr Robot movie (coded by Darlene S1E2,3), Please beware warning, after start you can't recover the files (In movie, the private key is not shared). IMPORTANT NOT FULLY STEP COMPLETED
• Neo23x0/Raccine - A Simple Ransomware Vaccine
• tsdgeos/poppler_mirror - mirror of https://cgit.freedesktop.org/poppler/poppler/ + .travis.yml file
• pravinsrc/MiniFilter-File-backup -
• jgh0721/Win-IO-Monitor - Windows IO Monitor( by using minifilter )
• shines77/Antinvader2015 - An minifilter-based transparent encryptor on Windows.
• RafWu/RansomWatch - Ransomware detection application for Windows using Windows Minifilter driver
• ETEFS/ETEFS_User - Easy Transparent Encrypted File System Based on API-Hooking
• ETEFS/ETEFS_Mini - Easy Transparent Encrypted File System Based on Minifilter File System Driver
• armvirus/CosMapper - Loads a signed kernel driver which allows you to map any driver to kernel mode without any traces of the signed / mapped driver.
• rogerorr/NtTrace - An strace-like program for the Windows 'native' API
• K2/EhTrace - ATrace is a tool for tracing execution of binaries on Windows.
• griddb/griddb - GridDB is a next-generation open source database that makes time series IoT and big data fast,and easy.
• pinusdb/pinusdb - 以简单、易用、高性能为目标、开源的时序数据库，支持Linux和Windows， Time Series Database
• ION28/BLUESPAWN - An Active Defense and EDR software to empower Blue Teams
• s3team/CryptoHunt -
• wbenny/EtwConsumerNT - Simple project that demonstrates how an ETW consumer can be created just by using NTDLL
• med0x2e/ExecuteAssembly - Load/Inject .NET assemblies by; reusing the host (spawnto) process loaded CLR AppDomainManager, Stomping Loader/.NET assembly PE DOS headers, Unlinking .NET related modules, bypassing ETW+AMSI, avoiding EDR hooks via NT static syscalls (x64) and hiding imports by dynamically resolving APIs (hash).
• google/orbit - C/C++ Performance Profiler
• Donpedro13/etwprof - Sampling profiler for native applications on Windows, based on ETW
• huoji120/MakeInfinityHookGreatAgain - 让Etwhook再次伟大! Make InfinityHook Great Again!
• GameTechDev/PresentMon - Tool for collection and processing of ETW events related to frame presentation on Windows.
• google/UIforETW - User interface for recording and managing ETW traces
• Silica/sandbox - Application virtualization tool for Windows
• horsicq/Nauz-File-Detector - Linker/Compiler/Tool detector for Windows, Linux and MacOS.
• mq1n/EasyRing0 - Windows kernel samples
• zodiacon/ProcExpX -
• zodiacon/windowskernelprogrammingbook2e - Samples for the book Windows Kernel Programming, 2nd edition
• zodiacon/ProcMonXv2 - Process Monitor X v2
• kkent030315/anycall - x64 Windows kernel code execution via user-mode, arbitrary syscall, vulnerable IOCTLs demonstration
• TonyChen56/WeChatRobot - PC版微信机器人 微信Api、WeChatApis.dll、微信聊天机器人 python微信api 微信接口 微信数据库解密
• TonyChen56/HackerTools - 使用MFC编写的病毒技术合集
• ZhanLang/jcfs - 极客桌面搜索
• IgorKorkin/PPL - The demo of RtlTestProtectedAccess() and RtlProtectedAccess involved in creation Protected Process.
• IgorKorkin/AllMemProTestBed - Legal access: The driver and console app to demonstrate the basic memory access in kernel mode
• IgorKorkin/AllMemPro - AllMemPro
• tandasat/EopMon - Elevation of privilege detector based on HyperPlatform
• tandasat/GuardMon - Hypervisor based tool for monitoring system register accesses.
• tandasat/MemoryMon - Detecting execution of kernel memory where is not backed by any image file
• IgorKorkin/MemoryRanger - MemoryRanger protects kernel data and code by running drivers and hosting data in isolated kernel enclaves using VT-x and EPT features. MemoryRanger has been presented at the BlackHat, HITB, CDFSL.
• DarthTon/Polychaos - PE permutation library
• DarthTon/Xenos - Windows dll injector
• DarthTon/Blackbone - Windows memory hacking library
• HoShiMin/Sig - The most powerful and customizable binary pattern scanner
• HoShiMin/formatPE - A bunch of parsers for PE and PDB formats in C++
• diversenok/Kernel-Bridge - Windows kernel hacking framework, driver template, hypervisor and API written on C++
• shtirlitz-dev/ntfs_file_streams - A tool to manage NTFS additional streams
• RuneN007/NTFSObjectIDParser - Digital Forensic tool parsing the $ObjID index file and correlating it with the $MFT
• FarGroup/FarManager - File and Archive Manager
• TakayukiTomatsuri/NTFS-EA-operation-library -
• kirankumarcelestial/NTFSChangeJournalUserMode - Reference Implementation for NTFS Change Journal on user mode
• czm23333/NTFSDisk - NTFS volume analyzing API
• Jichao/ntfs-search - mirror from https://sourceforge.net/projects/ntfs-search/
• aliakseis/NTFS-Search - Taken from https://sourceforge.net/projects/ntfs-search/
• ambray/Ntfs - Various libraries focused on examining/parsing NTFS-specific structures
• grimm-co/SetRegTime - Registry timestamp manipulation. A C-rewrite of https://github.com/jschicht/SetRegTime
• orkblutt/NTFS-Parser-Lib - From https://www.codeproject.com/Articles/81456/An-NTFS-Parser-Lib by cyb70289
• kusano/ntfsdump - Extract files from NTFS Volume
• mxway/FileRecovery - windows系统下fat32及ntfs删除文件恢复
• NoMoreFood/Repacls - Windows File Security Utility (replacement for xcacls, icacls, setacl, and subinacl)
• strozfriedberg/ntfs-linker - An NTFS journal parser
• wheres-crypto/wheres-crypto -
• seladb/PcapPlusPlus - PcapPlusPlus is a multiplatform C++ library for capturing, parsing and crafting of network packets. It is designed to be efficient, powerful and easy to use. It provides C++ wrappers for the most popular packet processing engines such as libpcap, WinPcap, DPDK and PF_RING.
• atxsinn3r/amsiscanner - A C/C++ implementation of Microsoft's Antimalware Scan Interface
• forrest-orr/moneta - Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs
• NtRaiseHardError/Antimalware-Research - Research on Anti-malware and other related security solutions
• ThomasThelen/Anti-Debugging - A collection of c++ programs that demonstrate common ways to detect the presence of an attached debugger.
• mgeeky/PE-library - Lightweight Portable Executable parsing library and a demo peParser application.
• mgeeky/ThreadStackSpoofer - Thread Stack Spoofing - PoC for an advanced In-Memory evasion technique allowing to better hide injected shellcode's memory allocation from scanners and analysts.
• mgeeky/ShellcodeFluctuation - An advanced in-memory evasion technique fluctuating shellcode's memory protection between RW/NoAccess & RX and then encrypting/decrypting its contents
• mgeeky/HEVD_Kernel_Exploit - Exploits pack for the Windows Kernel mode driver HackSysExtremeVulnerableDriver written for educational purposes.
• mgeeky/UnhookMe - UnhookMe is an universal Windows API resolver & unhooker addressing problem of invoking unmonitored system calls from within of your Red Teams malware
• pathtofile/Sealighter - Sysmon-Like research tool for ETW
• microsoft/krabsetw - KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.
• wecooperate/iMonitor - iMonitor（冰镜 - 终端行为分析系统）
• wecooperate/iMonitorSDK - 系统监控开发套件（sysmon、promon、edr、终端安全、主机安全、零信任、上网行为管理）
• basketwill/Sysmon_reverse -
• marcosd4h/sysmonx - SysmonX - An Augmented Drop-In Replacement of Sysmon
• everdox/InfinityHook - Hook system calls, context switches, page faults and more.
• D4stiny/HandleMaster - Changes handle's access rights using DKOM with a vulnerable driver
• D4stiny/spectre - A Windows kernel-mode rootkit that abuses legitimate communication channels to control a machine.
• D4stiny/ForkPlayground - An implementation and proof-of-concept of Process Forking.
• jacob-baines/elfparser - Cross Platform ELF analysis
• aaaddress1/wowGrail - PoC: Rebuild A New Path Back to the Heaven's Gate (HITB 2021)
• yuawn/MediaTek-Fuzzing-Workshop - MediaTek Fuzzing Workshop in HITCON 2021
• aaaddress1/Windows-APT-Warfare - 著作《Windows APT Warfare：惡意程式前線戰術指南》各章節技術實作之原始碼內容
• ionescu007/Simpleator - Simpleator ("Simple-ator") is an innovative Windows-centric x64 user-mode application emulator that leverages several new features that were added in Windows 10 Spring Update (1803), also called "Redstone 4", with additional improvements that were made in Windows 10 October Update (1809), aka "Redstone 5".
• jafarlihi/serpentine - C++/Win32/Boost Windows RAT (Remote Administration Tool) with a multiplatform Java/Spring RESTful C2 server and Go, C++/Qt5 frontends
• CheckPointSW/InviZzzible - InviZzzible is a tool for assessment of your virtual environments in an easy and reliable way. It contains the most recent and up to date detection and evasion techniques as well as fixes for them.
• Aekras1a/Updated-Carbanak-Source-with-Plugins - https://twitter.com/itsreallynick/status/1120410950430089224
• Cr4sh/MicroBackdoor - Small and convenient C2 tool for Windows targets. [ Русский -- значит нахуй! ]
• D4stiny/PeaceMaker - PeaceMaker Threat Detection is a Windows kernel-based application that detects advanced techniques used by malware.
• BreakingMalware/PowerLoaderEx - PowerLoaderEx - Advanced Code Injection Technique for x32 / x64
• hasherezade/petya_green - Application for random attack on Green Petya's key
• hasherezade/decryptors_archive - Archive of ransomware decryptors
• hasherezade/libpeconv_demo - Demo projects and utilities made with the help of libPeConv
• ValveSoftware/Proton - Compatibility tool for Steam Play based on Wine and additional components
• MaxXor/keygenme-v7 - Source code of my KeygenMe V7 challenge
• hasherezade/wke_exercises - My solutions for HackSys Extreme Vulnerable Driver
• securesean/Shim-Process-Scanner - Windows x64 Process Scanner to detect application compatability shims
• hasherezade/libpeconv_wrappers - A ready-made template for a new project based on libPeConv library
• hasherezade/challs - My solutions for random crackmes and other challenges
• hasherezade/IAT_patcher_samples - Sample libraries to be used with IAT Patcher
• hasherezade/mastercoder2014 - My solutions
• microsoft/wil - Windows Implementation Library
• jxy-s/herpaderping - Process Herpaderping proof of concept, tool, and technical deep dive. Process Herpaderping bypasses security products by obscuring the intentions of a process.
• hasherezade/tag_converter -
• hasherezade/exe_to_dll - Converts a EXE into DLL
• hasherezade/dll_to_exe - Converts a DLL into EXE
• hasherezade/beardisasm - A wrapper for capstone for bearparser
• hasherezade/ViDi - ViDi Visual Disassembler (experimental)
• hasherezade/IAT_patcher - Persistent IAT hooking application - based on bearparser
• hasherezade/paramkit_tpl - A template for a project using ParamKit
• hasherezade/pe_utils - A set of small utilities, helpers for PIN tracers
• hasherezade/libpeconv_tpl - A ready-made template for a project based on libpeconv.
• hasherezade/libpeconv_and_detours_tpl - A template for projects using both libPeConv and MS Detours
• hasherezade/funky_malware_formats - Parsers for custom malware formats ("Funky malware formats")
• hasherezade/petya_key - A decoder for Petya victim keys, using the Janus' masterkey.
• hasherezade/antianalysis_demos - Set of antianalysis techniques found in malware
• hasherezade/dll_injector - A simple commandline injector using classic DLL injection
• hasherezade/persistence_demos - Demos of various (also non standard) persistence methods used by malware
• hasherezade/mal_unpack_drv - MalUnpack companion driver
• hasherezade/libpeconv - A library to load, manipulate, dump PE files. See also: https://github.com/hasherezade/libpeconv_tpl
• hasherezade/paramkit - A small library helping to parse commandline parameters (for C/C++)
• wolf32d/permutation_entropy - Fast evaluation of permutation entropy of a time series. A Python (NumPy) wrapper is included.
• ulikoehler/entropy-analysis-tools -
• Albuso0/entropy - Entropy estimator
• plasma-umass/entroprise - measure entropy of memory allocators
• madvn/infotheory - C++/Python Information theoretic analyses tools
• usnistgov/SP800-90B_EntropyAssessment - The SP800-90B_EntropyAssessment C++package implements the min-entropy assessment methods included in Special Publication 800-90B.
• lzhang10/maxent - Maximum Entropy Modeling Toolkit for Python and C++
• richkmeli/Richkware - Framework for building Windows malware, written in C++
• mstfknn/malware-sample-library - Malware sample library.
• AHXR/ghost - 👻 RAT (Remote Access Trojan) - Silent Botnet - Full Remote Command-Line Access - Download & Execute Programs - Spread Virus' & Malware
• swwwolf/wdbgark - WinDBG Anti-RootKit Extension
• MinhasKamal/TrojanCockroach - A Stealthy Trojan Spyware
• rek7/mXtract - mXtract - Memory Extractor & Analyzer
• RamadhanAmizudin/malware - Malware Samples. Uploaded to GitHub for those want to analyse the code. Code mostly from: http://www.malwaretech.com
• m0n0ph1/Process-Hollowing - Great explanation of Process Hollowing (a Technique often used in Malware)
• UBoat-Botnet/UBoat - HTTP Botnet
• JustasMasiulis/nt_wrapper - A wrapper library around native windows sytem APIs
• JustasMasiulis/lazy_importer - library for importing functions from dlls in a hidden, reverse engineer unfriendly way
• evandowning/windbg-trace - Use WinDBG to trace the Windows API calls of any Portable Executable file
• feel-the-dz3n/pelauncher - Portable Executable launcher for Windows NT bypassing loader
• pstolarz/dumpext - WinDbg debugger extension library providing various tools to analyse, dump and fix (restore) Microsoft Portable Executable files for both 32 (PE) and 64-bit (PE+) platforms.
• lief-project/LIEF - LIEF - Library to Instrument Executable Formats
• SurrealSky/PETOOLS - PE文件解析和加壳工具
• mkucenski/libNTFSUsnJrnl - Library for parsing Windows Change Journal records (aka USN Journal).
• thewhiteninja/ntfstool - Forensics tool for NTFS (parser, mft, bitlocker, deleted files)
• FangWHao/A-Good-Local-File-Searcher - 用C++实现的基于NTFS下MFT和USN-Journal检索与类正则表达式-NFA-DFA字符串匹配的本地文件查找系统
• farfella/ntfs-cpu-search - From 2011: Quickly search for files in NTFS volumes parsing the Master File Table (MFT). A decent amount of how NTFS and MFT work was painstakingly reverse-engineered since it's undocumented.
• owwlo/Search.It - A ultra fast file searching tool. Generate index with MFT on NTFS.
• sunglinf404/SearchDeleteFile - ntfs文件系统的数据恢复
• TautvydasZilys/FileSystemSearch -
• c1y2m3/FileSearch - C++枚举磁盘列表、遍历指定盘搜索特定类型文件/微信导出密钥,文件回传等功能
• ChrisS85/FastFileSearch - Extremely fast file search using the NTFS USN journal
• Chaoses-Ib/IbEverythingExt - Everything 拼音搜索、快速选择扩展
• LeiHao0/Fake-Everything - Everything的原理猜想与实现
• CobaltFusion/DebugViewPP - DebugView++, collects, views, filters your application logs, and highlights information that is important to you!
• a4501150/LambseaExternal - Players' Unknown Battleground Vulnerabilities Test PoC
• cpu-chromium/WoF - Windows overlay FS explorations
• openframeworks/openFrameworks - openFrameworks is a community-developed cross platform toolkit for creative coding in C++.
• vbpf/ebpf-verifier - eBPF verifier based on abstract interpretation
• sebastien-riou/aes-brute-force - Using Intel AES-NI and c++ threads to search an AES128 key (well, part of it)
• rime/weasel - 【小狼毫】Rime for Windows
• Presburger/qmc-decoder - Fastest & best convert qmc 2 mp3 | flac tools
• season-lab/sok-dbi-security - Library to hide DBI artifacts when using Intel Pin. Code from the ASIA CCS 2019 paper "SoK: Using Dynamic Binary Instrumentation for Security (And How You May Get Caught Red Handed)"
• CERT-Polska/drakvuf - DRAKVUF Black-box Binary Analysis
• nektra/Deviare-InProc - Deviare In Process Instrumentation Engine
• season-lab/bluepill - BluePill: Neutralizing Anti-Analysis Behavior in Malware Dissection (Black Hat Europe 2019, IEEE TIFS 2020)
• dcdelia/sniper - Robust API monitoring system presented in the paper "Designing Robust API Monitoring Solutions" (IEEE TDSC)
• necst/arancino - Arancino is a dynamic protection framework that defends Intel Pin against anti-instrumentation attacks.
• libvmtrace/libvmtrace - Virtual machine introspection library based on libvmi
• bitdefender/river - Dynamic binary translator for x86 binaries
• thalium/icebox - Virtual Machine Introspection, Tracing & Debugging
• DockDroid/openvmi - 鹏城实验室与北弓联合开发的VMI开源版本
• x64dbg/x64dbg - An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.
• rizinorg/cutter - Free and Open Source Reverse Engineering Platform powered by rizin
• hteso/iaito - This project has been moved to:
• escse/ProtocolTaint - Protocol Bytes Boundary by Taint Analysis
• lzto/pex - [USENIX SECURITY'19] PeX: A Permission Check Analysis Framework for Linux Kernel
• sslab-gatech/deadline -
• RiS3-Lab/kubo - Use on-demand control- data- flow slicing combined with taint analysis and symbolic execution to produce scalable and precise UB detection for Linux kernel.
• ucsb-seclab/dr_checker - DR.CHECKER : A Soundy Vulnerability Detection Tool for Linux Kernel Drivers
• shun-yo/Spaniel - Malware analysis tool based on taint analysis.
• AngoraFuzzer/libdft64 - libdft for Intel Pin 3.x and 64 bit platform. (Dynamic taint tracking, taint analysis)
• hasherezade/bearparser - Portable Executable parsing library (from PE-bear)
• hasherezade/tiny_tracer - A Pin Tool for tracing API calls etc
• hasherezade/pe_to_shellcode - Converts PE into a shellcode
• hasherezade/pin_n_sieve - An experimental dynamic malware unpacker based on Intel Pin and PE-sieve
• aaaddress1/RunPE-In-Memory - Run a Exe File (PE Module) in memory (like an Application Loader)
• BreakingMalware/Selfie - A Tool to Unpack Self-Modifying Code using DynamoRIO
• nickcano/RelocBonus - An obfuscation tool for Windows which instruments the Windows Loader into acting as an unpacking engine.
• dscharrer/innoextract - A tool to unpack installers created by Inno Setup
• horsicq/DIE-engine - DIE engine
• NtQuery/Scylla - Imports Reconstructor
• x64dbg/ScyllaHide - Advanced usermode anti-anti-debugger. Forked from https://bitbucket.org/NtQuery/scyllahide
• Phat3/PINdemonium - A pintool in order to unpack malware
• ucsb-seclab/difuze - Fuzzer for Linux Kernel Drivers
• OSUSecLab/SelectiveTaint -
• Oneflow-Inc/oneflow - OneFlow is a deep learning framework designed to be user-friendly, scalable and efficient.
• subsurface/subsurface - This is the official upstream of the Subsurface divelog program
• harporoeder/ebpfsnitch - Linux Application Level Firewall based on eBPF and NFQUEUE.
• pixie-io/pixie - Instant Kubernetes-Native Application Observability
• falcosecurity/falco - Cloud Native Runtime Security
• iovisor/bpftrace - High-level tracing language for Linux eBPF
• SpiderLabs/ModSecurity - ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx that is developed by Trustwave's SpiderLabs. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis. With over 10,000 deployments world-wide, ModSecurity is the most widely deployed WAF in existence.
• JonathanSalwan/Triton - Triton is a dynamic binary analysis library. Build your own program analysis tools, automate your reverse engineering, perform software verification or just emulate code.
• QBDI/QBDI - A Dynamic Binary Instrumentation framework based on LLVM.
• google/fuzzing - Tutorials, examples, discussions, research proposals, and other resources related to fuzzing
• GJDuck/e9patch - A powerful static binary rewriting tool
• GJDuck/e9afl - AFL binary instrumentation
• mothran/aflpin - aflpin enables afl to fuzz blackbox binaries using a pin tool to trace execution branches.
• googleprojectzero/bochspwn-reloaded - A Bochs-based instrumentation performing kernel memory taint tracking to detect disclosure of uninitialized memory to ring 3
• googleprojectzero/bochspwn - A Bochs-based instrumentation project designed to log kernel memory references, to identify "double fetches" and other OS vulnerabilities
• AlicanAkyol/sems - Virtualbox, VirtualMachine, Cuckoo, Anubis, ThreatExpert, Sandboxie, QEMU, Analysis Tools Detection Tools
• GlacierW/sems - Virtualbox, VirtualMachine, Cuckoo, Anubis, ThreatExpert, Sandboxie, QEMU, Analysis Tools Detection Tools
• S2E/s2e - S2E: A platform for multi-path program analysis with selective symbolic execution.
• ray-cp/browser_pwn - browser pwn, main work now
• tobimensch/aqemu - Official AQEMU repository - a GUI for virtual machines using QEMU as the backend
• vovkos/protolesshooks - API monitoring via return-hijacking thunks; works without information about target function prototypes.
• tandasat/HyperPlatform - Intel VT-x based hypervisor aiming to provide a thin VM-exit filtering platform on Windows.
• tandasat/DdiMon - Monitoring and controlling kernel API calls with stealth hook using EPT
• microsoft/Detours - Detours is a software package for monitoring and instrumenting API calls on Windows. It is distributed in source code form.
• SinaKarvandi/Pinitor - An API Monitor based on Instrumentation
• memtt/numaprof - NUMAPROF is a NUMA memory profliler based on Pintool to track your remote memory accesses.
• idc/uplift - Compatibility layer for running Orbis executables natively on Windows.
• secrary/Hooking-via-InstrumentationCallback - codes for my blog post: https://secrary.com/Random/InstrumentationCallback/
• columbia/egalito - Self-hosting binary instrumentation framework for security research
• F-Secure/Sulo - Dynamic instrumentation tool for Adobe Flash Player built on Intel Pin
• osquery/osquery - SQL powered operating system instrumentation, monitoring, and analytics.
• hasherezade/pe-sieve - Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
• upx/upx - UPX - the Ultimate Packer for eXecutables
• facebook/mariana-trench - Our security focused static analysis tool for Android and Java applications.
• Sysinternals/ProcMon-for-Linux - Procmon is a Linux reimagining of the classic Procmon tool from the Sysinternals suite of tools for Windows. Procmon provides a convenient and efficient way for Linux developers to trace the syscall activity on the system.
• Sysinternals/ProcDump-for-Linux - A Linux version of the ProcDump Sysinternals tool
• huoji120/DuckSandboxDetect - 沙箱测试,测评国内常见沙箱的代码与结论
• ChadSki/FeatherweightVirtualMachine - An OS-level container which virtualizes Windows' file system, registry, kernel, and network communication.
• iceboy233/windows-container - A lightweight sandbox for Windows application
• ZanderChang/anti-sandbox - Windows对抗沙箱和虚拟机的方法总结
• secrary/DrSemu - DrSemu - Sandboxed Malware Detection and Classification Tool Based on Dynamic Behavior
• wbenny/DetoursNT - Detours with just single dependency - NTDLL
• wbenny/hvpp - hvpp is a lightweight Intel x64/VT-x hypervisor written in C++ focused primarily on virtualization of already running operating system
• tklengyel/drakvuf - DRAKVUF Black-box Binary Analysis
• KomputeProject/kompute - General purpose GPU compute framework built on Vulkan to support 1000s of cross vendor graphics cards (AMD, Qualcomm, NVIDIA & friends). Blazing fast, mobile-enabled, asynchronous and optimized for advanced GPU data processing usecases. Backed by the Linux Foundation.
• OAID/Tengine - Tengine is a lite, high performance, modular inference engine for embedded device
• fpgasystems/fpga-network-stack - Scalable Network Stack for FPGAs (TCP/IP, RoCEv2)
• BrunoLevy/learn-fpga - Learning FPGA, yosys, nextpnr, and RISC-V
• sylefeb/Silice - Silice is an open source language that simplifies prototyping and writing algorithms on FPGA architectures.
• sony/flutter-embedded-linux - Embedded Linux embedding for Flutter
• zaphoyd/websocketpp - C++ websocket client/server library
• Nitrokey/nitrokey-app - Nitrokey's Application (Win, Linux, Mac)
• ComodoSecurity/openedr - Open EDR public repository
• sferes2/sferes2 - A lightweight, generic C++11 framework for evolutionary computation
• ashrafyassin/SGX_secure_function_evaluation - implementing secure function evaluation using intel SGX
• medicalinformatics/SecureEpilinker - Mainzelliste SecureEpiLinker (MainSEL): Privacy-Preserving Record Linkage using Secure Multi-Party Computation. ABY sMPC Node.
• encryptogroup/linearPFE - Linear-complexity Private Function Evaluation (PFE) based on homomorphic encryption (as presented at ESORICS'20).
• encryptogroup/OTExtension - C++ OT extension implementation
• encryptogroup/ABY - ABY - A Framework for Efficient Mixed-protocol Secure Two-party Computation
• encryptogroup/UC - Implementation of Valiant's universal circuit construction optimized for private function evaluation
• homenc/HElib - HElib is an open-source software library that implements homomorphic encryption. It supports the BGV scheme with bootstrapping and the Approximate Number CKKS scheme. HElib also includes optimizations for efficient homomorphic evaluation, focusing on effective use of ciphertext packing techniques and on the Gentry-Halevi-Smart optimizations.
• data61/MP-SPDZ - Versatile framework for multi-party computation
• bristolcrypto/SPDZ-2 - (Inactive, see readme) Multiparty computation with SPDZ, MASCOT, and Overdrive offline phases
• IntelAI/he-transformer - nGraph-HE: Deep learning with Homomorphic Encryption (HE) through Intel nGraph
• microsoft/SEAL - Microsoft SEAL is an easy-to-use and powerful homomorphic encryption library.
• MPC-SoK/frameworks - Sample code and build environments for MPC frameworks
• esonghori/TinyGarble - TinyGarble: Logic Synthesis and Sequential Descriptions for Yao's Garbled Circuits
• PlatONEnterprise/PlatONE-Go - PlatONE client implemented by golang
• LatticeX-Foundation/Rosetta - A Privacy-Preserving Framework Based on TensorFlow
• cryptobiu/libscapi - Comprehensive Open Source Library for Secure Multiparty Computation
• manisandro/gImageReader - A Gtk/Qt front-end to tesseract-ocr.
• tesseract-ocr/tesseract - Tesseract Open Source OCR Engine (main repository)
• UB-Mannheim/tesseract - Tesseract Open Source OCR Engine (main repository)
• giuspen/cherrytree - cherrytree
• google/sandboxed-api - Generates sandboxes for C/C++ libraries automatically
• LordNoteworthy/al-khaser - Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.
• pavel-odintsov/fastnetmon - FastNetMon - very fast DDoS sensor with sFlow/Netflow/IPFIX/SPAN support
• zeek/zeek - Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
• adafruit/Adafruit-Fingerprint-Sensor-Library - Arduino library for interfacing to the fingerprint sensor in the Adafruit shop
• 42ity/fty-discovery - Discovers power devices over the network and publishes new device elements in the asset DB
• HoShiMin/Kernel-Bridge - Windows kernel hacking framework, driver template, hypervisor and API written on C++
• HoShiMin/Avanguard - The Win32 Anti-Intrusion Library
• allweshare/TCP2COM - 网络转串口软件（基于com0com）
• monteslu/webusb-serial - virtual serialport implementation using web usb as its transport
• catid/snowshoe - Snowshoe - Portable, Secure, Fast Elliptic Curve Math Library in C
• ProtonVPN/win-app - Official ProtonVPN Windows app
• ErosZy/SecurityWorker - The best javascript code protection solution ever.
• vortex314/serial2mqtt - Implement a Linux gateway that reads serial port ( USB, serial , bluetooth) commands and transfers to MQTT host. MQTT without ethernet or Wifi on a low cost micocontroller. Don't develop a serial command interface , just use MQTT UI's and features.
• HarringayMakerSpace/usb-esp - How to make a tiny USB powered ESP-12S
• vavrusa/libusbnet - libusb wrapper to enable communication with USB devices over TCP/IP
• daynix/UsbDk - Usb Drivers Development Kit for Windows
• ViGEm/ViGEmBus - Windows kernel-mode driver emulating well-known USB game controllers.
• simonowen/fdrawcmd - fdrawcmd.sys is a Windows filter driver that exposes command-level access to the on-board floppy disk controller.
• TigerVNC/tigervnc - High performance, multi-platform VNC client and server

CMake

• microsoft/vcpkg - C++ Library Manager for Windows, Linux, and MacOS
• hasherezade/detours_cmake_tpl - A CMake template for projects using MS Detours

CSS

• rmusser01/Infosec_Reference - An Information Security Reference That Doesn't Suck; https://rmusser.net/git/admin-2/Infosec_Reference for non-MS Git hosted version.
• basscss/basscss - Low-level CSS Toolkit – the original Functional/Utility/Atomic CSS library
• trustedsec/SysmonCommunityGuide - TrustedSec Sysinternals Sysmon Community Guide
• dumbape/HIMS - Hospital Information Management System create using Node Js
• tushariscoolster/HospitalManagementSystem - Hospital management System python
• xupsh/pp4fpgas-cn - 中文版 Parallel Programming for FPGAs
• primefaces/sakai-react - Free React Admin Template
• primefaces/primereact - The Most Complete React UI Component Library
• primefaces/primeng - The Most Complete Angular UI Component Library

Coq

• mit-plv/fiat-crypto - Cryptographic Primitive Code Generation by Fiat

Dart

• authpass/authpass - AuthPass - Password Manager based on Flutter for all platforms. Keepass 2.x (kdbx 3.x) compatible.
• immich-app/immich - Self-hosted photo and video backup solution directly from your mobile phone.
• alibaba/power_image - A powerful plugin that fully uses the native image library's ability to display images on the flutter side.
• supabase/supabase-dart - A Dart client for Supabase

Dockerfile

• REMnux/docker - This repository contains Dockerfiles for building Docker images of popular malware analysis tools, which are distributed through the REMnux repository on Docker Hub.

FreeMarker

• niujt/Hospital - 医疗信息管理系统（ssm+layui+freemaker）

Go

• BishopFox/cloudfox - Automating situational awareness for cloud penetration tests.
• loxilb-io/loxilb - eBPF based cloud-native service load-balancer. Powering K8s|Edge|5G|IoT|XaaS Apps.
• crowdsecurity/crowdsec - CrowdSec - the open-source and participative IPS able to analyze visitor behavior & provide an adapted response to all kinds of attacks. It also leverages the crowd power to generate a global CTI database to protect the user network.
• hashicorp-forge/hermes - A document management system
• vmware-tanzu/cloud-native-security-inspector - This project scans and assesses workloads in Kubernetes at runtime. It can apply protection rules to workloads to avoid further risks as well.
• CosmWasm/wasmd - Basic cosmos-sdk app with web assembly smart contracts
• wormhole-foundation/cosmos-sdk -
• wormhole-foundation/wormhole-explorer - We could have named this super-parakeet. Tweet tweet.
• golang-module/dongle - A simple, semantic and developer-friendly golang package for encoding&decoding and encryption&decryption
• 0voice/Introduction-to-Golang - 【未来服务器端编程语言】最全空降golang资料补给包（满血战斗），包含文章，书籍，作者论文，理论分析，开源框架，云原生，大佬视频，大厂实战分享ppt
• mozilla-services/pkcs7 - Implements a subset of PKCS#7/Cryptographic Message Syntax (rfc2315, rfc5652)
• SSLMate/go-pkcs12 - Go library for encoding and decoding PKCS#12 files
• emmansun/gmsm - ShangMi (SM) cipher suites for golang
• zhaochuninhefei/gmgo -
• Dreamacro/clash - A rule-based tunnel in Go.
• projectdiscovery/proxify - Swiss Army knife Proxy tool for HTTP/HTTPS traffic capture, manipulation, and replay on the go.
• ghostunnel/ghostunnel - A simple SSL/TLS proxy with mutual authentication for securing non-TLS services.
• DNSCrypt/dnscrypt-proxy - dnscrypt-proxy 2 - A flexible DNS proxy, with support for encrypted DNS protocols.
• cloudradar-monitoring/rport - Manage remote systems with ease. See more https://rport.io
• safing/portmaster - 🏔 Love Freedom - ❌ Block Mass Surveillance
• devops-kung-fu/bomber - Scans Software Bill of Materials (SBOMs) for security vulnerabilities
• DataDog/threatest - Threatest is a CLI and Go framework for end-to-end testing threat detection rules.
• HavocFramework/Havoc - The Havoc Framework.
• function61/varasto - All your files in one simple, replicated, encrypted place - with built-in backups and configurable ransomware protection.
• google/trillian - A transparent, highly scalable and cryptographically verifiable data store.
• AdguardTeam/AdGuardHome - Network-wide ads & trackers blocking DNS server
• WangYihang/Platypus - 🔨 A modern multiple reverse shell sessions manager written in go
• lcvvvv/kscan - Kscan是一款纯go开发的全方位扫描器，具备端口扫描、协议检测、指纹识别，暴力破解等功能。支持协议1200+，协议指纹10000+，应用指纹20000+，暴力破解协议10余种。
• liamg/gitjacker - 🔪 Leak git repositories from misconfigured websites
• alphasoc/flightsim - A utility to safely generate malicious network traffic patterns and evaluate controls.
• ropnop/kerbrute - A tool to perform Kerberos pre-auth bruteforcing
• BishopFox/sliver - Adversary Emulation Framework
• Ne0nd0g/merlin - Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.
• drk1wi/Modlishka - Modlishka. Reverse Proxy.
• gophish/gophish - Open-Source Phishing Toolkit
• kgretzky/evilginx2 - Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
• mdsecactivebreach/o365-attack-toolkit - A toolkit to attack Office365
• sensepost/ruler - A tool to abuse Exchange services
• optiv/Ivy - Ivy is a payload creation framework for the execution of arbitrary VBA (macro) source code directly in memory. Ivy’s loader does this by utilizing programmatical access in the VBA object environment to load, decrypt and execute shellcode.
• vprix/vncproxy - This is a VNC proxy program, fully resolved the RFB protocol, support VNC proxy, record playback video, record operations as a log file, and support log file playback.
• sensepost/gowitness - 🔍 gowitness - a golang, web screenshot utility using Chrome Headless
• openclarity/kubeclarity - KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities of container images and filesystems
• ffuf/ffuf - Fast web fuzzer written in Go
• reposaur/reposaur - Open source compliance tool for development platforms.
• OJ/gobuster - Directory/File, DNS and VHost busting tool written in Go
• DataDog/stratus-red-team - ☁️ ⚡ Granular, Actionable Adversary Emulation for the Cloud
• krisnova/xpid - Linux Process Discovery. C Library, Go bindings, Runtime.
• deepfence/PacketStreamer - ⭐ ⭐ Distributed tcpdump for cloud native environments ⭐ ⭐
• eldadru/ksniff - Kubectl plugin to ease sniffing on kubernetes pods using tcpdump and wireshark
• elastic/beats - 🐠 Beats - Lightweight shippers for Elasticsearch & Logstash
• stackrox/stackrox - The StackRox Kubernetes Security Platform performs a risk analysis of the container environment, delivers visibility and runtime alerts, and provides recommendations to proactively improve security by hardening the environment.
• tiagorlampert/CHAOS - 🔥 CHAOS is a free and open-source Remote Administration Tool that allow generate binaries to control remote operating systems.
• projectdiscovery/nuclei - Fast and customizable vulnerability scanner based on simple YAML based DSL.
• projectdiscovery/httpx - httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.
• dongchany/alloydb - AlloyDB is a distributed SQL database.
• hakluke/hakcheckurl - Takes a list of URLs and returns their HTTP response codes
• hakluke/haktrails - Golang client for querying SecurityTrails API data
• hakluke/hakip2host - hakip2host takes a list of IP addresses via stdin, then does a series of checks to return associated domain names.
• hakluke/hakrawler - Simple, fast web crawler designed for easy, quick discovery of endpoints and assets within a web application
• hakluke/hakoriginfinder - Tool for discovering the origin host behind a reverse proxy. Useful for bypassing cloud WAFs!
• Tylous/Limelighter - A tool for generating fake code signing certificates or signing real ones
• Tylous/SourcePoint - SourcePoint is a C2 profile generator for Cobalt Strike command and control servers designed to ensure evasion.
• zan8in/afrog - A Vulnerability Scanning Tools For Penetration Testing
• ossf/scorecard - OpenSSF Scorecard - Security health metrics for Open Source
• ossf/package-analysis - Open Source Package Analysis
• zricethezav/gitleaks - Protect and discover secrets using Gitleaks 🔑
• NextronSystems/ransomware-simulator - Ransomware simulator written in Golang
• utkusen/wholeaked - a file-sharing tool that allows you to find the responsible person in case of a leakage
• snail007/goproxy - 🔥 Proxy is a high performance HTTP(S) proxies, SOCKS5 proxies,WEBSOCKET, TCP, UDP proxy server implemented by golang. Now, it supports chain-style proxies,nat forwarding in different lan,TCP/UDP port forwarding, SSH forwarding.Proxy是golang实现的高性能http,https,websocket,tcp,socks5代理服务器,支持内网穿透,链式代理,通讯加密,智能HTTP,SOCKS5代理,黑白名单,限速,限流量,限连接数,跨平台,KCP支持,认证API。
• murphysecurity/murphysec - An open source tool focused on software supply chain security. 墨菲安全专注于软件供应链安全，具备专业的软件成分分析（SCA）、漏洞检测、专业漏洞库。
• juicedata/juicefs - JuiceFS is a distributed POSIX file system built on top of Redis and S3.
• FourCoreLabs/EDRHunt - Scan installed EDRs and AVs on Windows
• cloudreve/Cloudreve - 🌩支持多家云存储的云盘系统 (Self-hosted file management and sharing system, supports multiple storage providers)
• grafana/mimir - Grafana Mimir provides horizontally scalable, highly available, multi-tenant, long-term storage for Prometheus.
• keybase/client - Keybase Go Library, Client, Service, OS X, iOS, Android, Electron
• Azure/azure-storage-fuse - A virtual file system adapter for Azure Blob storage
• EgeBalci/sgn - Shikata ga nai (仕方がない) encoder ported into go with several improvements
• fatedier/frp - A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.
• j3ssie/osmedeus - A Workflow Engine for Offensive Security
• hbollon/go-edlib - 📚 String comparison and edit distance algorithms library, featuring : Levenshtein, LCS, Hamming, Damerau levenshtein (OSA and Adjacent transpositions algorithms), Jaro-Winkler, Cosine, etc...
• inconshreveable/ngrok - Introspected tunnels to localhost
• cycraft-corp/Prometheus-Decryptor - Prometheus-Decryptor is a project to decrypt files encrypted by Prometheus ransomware.
• wille/cry - Cross platform PoC ransomware written in Go
• muesli/duf - Disk Usage/Free Utility - a better 'df' alternative
• optiv/ScareCrow - ScareCrow - Payload creation framework designed around EDR bypass.
• Velocidex/velociraptor - Digging Deeper....
• lunixbochs/usercorn - dynamic binary analysis via platform emulation
• bettercap/bettercap - The Swiss Army knife for 802.11, BLE, IPv4 and IPv6 networks reconnaissance and MITM attacks.
• 0xrawsec/gene - Signature Engine for Windows Event Logs
• 0xrawsec/whids - Open Source EDR for Windows
• carbonblack/binee - Binee: binary emulation environment
• SaturnsVoid/GoBot2 - Second Version of The GoBot Botnet, But more advanced.
• redcode-labs/Coldfire - Golang malware development library
• gen0cide/gscript - framework to rapidly implement custom droppers for all three major operating systems
• mauri870/ransomware - A POC Windows crypto-ransomware (Academic). Now Ransom:Win32/MauriCrypt.MK!MTB
• redcode-labs/neurax - A framework for constructing self-spreading binaries
• looterz/grimd - ⚡ fast dns proxy that can run anywhere, built to black-hole internet advertisements and malware servers
• maliceio/malice - VirusTotal Wanna Be - Now with 100% more Hipster
• y4v8/filewatcher - Filewatcher that uses the USN change journal.
• tklengyel/dwarf2json - convert ELF/DWARF symbol and type information into vol3's intermediate JSON
• kubevela/kubevela - The Modern Application Platform.
• superedge/superedge - An edge-native container management system for edge computing
• harvester/harvester - Open source hyperconverged infrastructure (HCI) software
• rancher/rke - Rancher Kubernetes Engine (RKE), an extremely simple, lightning fast Kubernetes distribution that runs entirely within containers.
• rancher/k3os - Purpose-built OS for Kubernetes, fully managed by Kubernetes.
• rancher/rancher - Complete container management platform
• skydive-project/skydive - An open source real-time network topology and protocols analyzer
• aquasecurity/tracee - Linux Runtime Security and Forensics using eBPF
• aquasecurity/trivy - Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
• vmware-tanzu/community-edition - VMware Tanzu Community Edition is no longer an actively maintained project. Code is available for historical purposes only.
• cilium/hubble - Hubble - Network, Service & Security Observability for Kubernetes using eBPF
• cilium/ebpf - ebpf-go is a pure-Go library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel.
• l3af-project/l3afd - L3AFD eBPF Programs control plane
• deepfence/SecretScanner - 🔓 🔓 Find secrets and passwords in container images and file systems 🔓 🔓
• deepfence/ThreatMapper - Open source cloud native security observability platform. Linux, K8s, AWS Fargate and more.
• cilium/cilium - eBPF-based Networking, Security, and Observability
• triggermesh/triggermesh - TriggerMesh is the open-source AWS EventBridge alternative. It provides a unified eventing experience, a developer-friendly CLI, and runs on Docker or natively on Kubernetes.
• activecm/rita - Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
• buger/goreplay - GoReplay is an open-source tool for capturing and replaying live HTTP traffic into a test environment in order to continuously test your system with real data. It can be used to increase confidence in code deployments, configuration changes and infrastructure changes.
• pritunl/pritunl-cloud - Private cloud virtualization platform
• bradfitz/embiggen-disk - embiggden-disk live-resizes a filesystem after first live-resizing any necessary layers below it: an optional LVM LV and PV, and an MBR or GPT partition table
• hashicorp/waypoint - A tool to build, deploy, and release any application on any platform.
• hashicorp/packer - Packer is a tool for creating identical machine images for multiple platforms from a single source configuration.
• crazy-max/WindowsSpyBlocker - Block spying and tracking on Windows
• 710leo/urlooker - enterprise-level websites monitoring system
• evilsocket/shieldwall - zero-trust remote firewall instrumentation
• prometheus/client_golang - Prometheus instrumentation library for Go applications
• rabbitstack/fibratus - A modern tool for Windows kernel exploration and tracing with a focus on security
• saferwall/saferwall - ☁️ Collaborative Malware Analysis Platform at Scale
• unidoc/unioffice - Pure go library for creating and processing Office Word (.docx), Excel (.xlsx) and Powerpoint (.pptx) documents
• qax-os/excelize - Go language library for reading and writing Microsoft Excel™ (XLAM / XLSM / XLSX / XLTM / XLTX) spreadsheets
• WireGuard/wireguard-windows - Download WireGuard for Windows at https://www.wireguard.com/install . This repo is a mirror only. Official repository is at https://git.zx2c4.com/wireguard-windows
• tjfoc/gmsm - GM SM2/3/4 library based on Golang (基于Go语言的国密SM2/SM3/SM4算法库)
• tw-bc-group/fabric-ca -
• Hyperledger-TWGC/tjfoc-gm - GM SM2/3/4 library based on Golang (基于Go语言的国密SM2/SM3/SM4算法库)
• joewalnes/websocketd - Turn any program that uses STDIN/STDOUT into a WebSocket server. Like inetd, but for WebSockets.
• claudiodangelis/qrcp - ⚡ Transfer files over wifi from your computer to your mobile device by scanning a QR code without leaving the terminal.
• syncthing/syncthing - Open Source Continuous File Synchronization
• tjfoc/fabric-ca-gm - 支持国密加密算法的Hyperledger Fabric CA服务
• tjfoc/hyperledger-fabric-gm - 支持国密加密算法的Hyperledger Fabric版本
• flashmob/go-guerrilla - Mini SMTP server written in golang
• gogs/gogs - Gogs is a painless self-hosted Git service
• hashicorp/boundary - Boundary enables identity-based access management for dynamic infrastructure.
• hashicorp/vault - A tool for secrets management, encryption as a service, and privileged access management
• ory/oathkeeper - A cloud native Identity & Access Proxy / API (IAP) and Access Control Decision API that authenticates, authorizes, and mutates incoming HTTP(s) requests. Inspired by the BeyondCorp / Zero Trust white paper. Written in Go.
• casbin/casbin - An authorization library that supports access control models like ACL, RBAC, ABAC in Golang
• prometheus/prometheus - The Prometheus monitoring system and time series database.
• jaypipes/ghw - Golang hardware discovery/inspection library
• OWASP/Amass - In-depth Attack Surface Mapping and Asset Discovery
• kubeedge/kubeedge - Kubernetes Native Edge Computing Framework (project under CNCF)
• cossacklabs/acra - Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.
• dreadl0ck/netcap - A framework for secure and scalable network traffic analysis - https://netcap.io
• txthinking/brook - A cross-platform network tool designed for developers. 一个为开发者设计的跨平台网络工具.
• mainflux/mainflux - Industrial IoT Messaging and Device Management Platform
• ehang-io/nps - 一款轻量级、高性能、功能强大的内网穿透代理服务器。支持tcp、udp、socks5、http等几乎所有流量转发，可用来访问内网网站、本地支付接口调试、ssh访问、远程桌面，内网dns解析、内网socks5代理等等……，并带有功能强大的web管理端。a lightweight, high-performance, powerful intranet penetration proxy server, with a powerful web management terminal.
• yjiong/iotgateway - iot gateway (modbusTCP,RTU,DLT645...to MQTT)
• ProtonMail/proton-bridge - Proton Mail Bridge application
• mattermost/mattermost-server - Mattermost is an open source platform for secure collaboration across the entire software development lifecycle.
• pdfcpu/pdfcpu - A PDF processor written in Go.

HCL

• JPCERTCC/SurfaceAnalysis-on-Cloud - Surface Analysis System on Cloud
• Coalfire-Research/Red-Baron - Automate creating resilient, disposable, secure and agile infrastructure for Red Teams.
• byt3bl33d3r/Red-Baron - Automate creating resilient, disposable, secure and agile infrastructure for Red Teams
• BlueTeamLabs/sentinel-attack - Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK
• goffinet/packer-kvm - Create VM templates with Packer for usage with Libvirt/KVM virtualization : CentOS 7, CentOS 8/9 Stream, Alma Linux 8/9, Rocky Linux 8, Bionic (Ubuntu 1804), Focal (Ubuntu 2004), Jammy (Ubuntu 2204), Debian 11 (stable), Kali Linux, Fedora.

HTML

• eddiechu/File-Smuggling - HTML smuggling is not an evil, it can be useful
• rapid7/metasploitable3 - Metasploitable3 is a VM that is built from the ground up with a large amount of security vulnerabilities.
• JPCERTCC/MemoryForensic-on-Cloud - Memory Forensic System on Cloud
• joshhighet/ransomwatch - a ransomware-group observatory 🧅👹
• f/awesome-chatgpt-prompts - This repo includes ChatGPT prompt curation to use ChatGPT better.
• francisck/DanderSpritz_lab - A fully functional DanderSpritz lab in 2 commands
• OWASP/Nettacker - Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management
• 0xRick/0xRick.github.io - Infosec blog
• KrauseFx/InAppBrowser.com - Showcasing what in-app browsers do under the hood
• j00sean/SecBugs - Full disclosures for CVE ids, proofs of concept, exploits, 0day bugs and so on.
• x0rb3l/Cyber-Bookmarks - A list of bookmarks I have used since I started my journey in cyber security
• GTFOBins/GTFOBins.github.io - GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems
• trickest/cve - Gather and update all available and newest CVEs with their PoC.
• googleprojectzero/0days-in-the-wild - Repository for information about 0-days exploited in-the-wild.
• sbousseaden/EVTX-ATTACK-SAMPLES - Windows Events Attack Samples
• AndrewRathbun/DFIRArtifactMuseum - The goal of this repo is to archive artifacts from all versions of various OS's and categorizing them by type. This will help with artifact validation processes as well as increase access to artifacts that may no longer be readily available anymore.
• kagancapar/CVE-2022-29072 - 7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area.
• garretfick/openplcproject.github.io - The original repo - the master is now openplcproject
• openplcproject/openplcproject.github.io - GitHub Page hosted site for OpenPLC Project
• sans-blue-team/blue-team-wiki - Tools, techniques, cheat sheets, and other resources to assist those defending organizations and detecting adversaries
• AndyFul/Hard_Configurator - GUI to Manage Software Restriction Policies and harden Windows Home OS
• xazlsec/APT_Sample-Weapoon - Pull some collected APT group related samples, ransomware, remote control and other malicious programs for security researchers to use.
• openraven/docs - @WIP The main repo for technical documentation for all projects. This repo is used to build the documentation site https://opensource.openraven.com
• badmojr/1Hosts - World's most advanced DNS filter-/blocklists!
• ckane/CS7038-Malware-Analysis - Course Repository for University of Cincinnati Malware Analysis Class (CS[567]038)
• jstrosch/malware-samples - Malware samples, analysis exercises and other interesting resources.
• OpenRCE/Malware-Analysis-Training - Retired beginner/intermediate malware analysis training materials from @pedramamini and @erocarrera.
• MozillaSecurity/FuzzManager - A fuzzing management tools collection
• hmislk/hmis - This is an Open Source Java EE based Hospital Information Management System
• sumitkumar1503/hospitalmanagement - Hospital Management System || Python Django
• clong/DetectionLab - Automate the creation of a lab environment complete with security tooling and logging best practices
• ontio/ontology-fpga -
• larsbrinkhoff/awesome-cpus - All CPU and MCU documentation in one place
• ITI/ICS-Security-Tools - Tools, tips, tricks, and more for exploring ICS Security.
• electrode-io/electrode - Web applications with node.js and React
• tpn/pdfs - Technically-oriented PDF Collection (Papers, Specs, Decks, Manuals, etc)
• alvarcarto/url-to-pdf-api - Web page PDF/PNG rendering done right. Self-hosted service for rendering receipts, invoices, or any content.

Hack

• D3Ext/WEF - Wi-Fi Exploitation Framework

Haskell

• clash-lang/clash-compiler - Haskell to VHDL/Verilog/SystemVerilog compiler
• jgm/pandoc - Universal markup converter
• wireapp/wire-server - 🇪🇺 Wire back-end services

Inno Setup

• mentebinaria/retoolkit - Reverse Engineer's Toolkit

Java

• xuexiangjys/XUI - 💍A simple and elegant Android native UI framework, free your hands! (一个简洁而优雅的Android原生UI框架，解放你的双手！)
• HummerRisk/HummerRisk - HummerRisk 是云原生安全平台，包括混合云安全治理和容器云安全检测。
• yeriomin/YalpStore - Download apks from Google Play Store
• google/android-classyshark - Android and Java bytecode viewer
• charles2gan/GDA-android-reversing-Tool - the fastest and most powerful android decompiler(native tool working without Java VM) for the APK, DEX, ODEX, OAT, JAR, AAR, and CLASS file. which supports malicious behavior detection, privacy leaking detection, vulnerability detection, path solving, packer identification, variable tracking, deobfuscation, python&java scripts, device memory extraction, data decryption, and encryption, etc.
• yuliskov/SmartTubeNext - Ad free app for watching tube videos on Android TV boxes
• apache/shenyu - Apache ShenYu is a Java native API Gateway for service proxy, protocol conversion and API governance.
• apache/skywalking - APM, Application Performance Monitoring System
• iSafeBlue/TrackRay - 溯光 (TrackRay) 3 beta⚡渗透测试框架（资产扫描|指纹识别|暴力破解|网页爬虫|端口扫描|漏洞扫描|代码审计|AWVS|NMAP|Metasploit|SQLMap）
• Alluxio/alluxio - Alluxio, data orchestration for analytics and machine learning in the cloud
• dromara/hertzbeat - A real-time monitoring system with custom-monitor and agentless. Aim to monitor everything! Web, database, os, middleware, cloudnative and more. Notified support discord, slack, email, telegram, dingding, wechat, feishu, webhook, sms.
• cryptomator/cryptomator - Multi-platform transparent client-side encryption of your files in the cloud
• Mr-xn/RedTeam_BlueTeam_HW - 红蓝对抗以及护网相关工具和资料，内存shellcode（cs+msf）和内存马查杀工具
• fit2cloud/riskscanner - RiskScanner 是开源的多云安全合规扫描平台，基于 Cloud Custodian 和 Nuclei 引擎，实现对主流公(私)有云资源的安全合规扫描和漏洞扫描。
• tls-attacker/TLS-Attacker - TLS-Attacker is a Java-based framework for analyzing TLS libraries. It is developed by the Ruhr University Bochum (http://nds.rub.de/), the Paderborn University (https://cs.uni-paderborn.de/syssec/), and the Hackmanit GmbH (http://hackmanit.de/).
• tls-attacker/TLS-Scanner - The TLS-Scanner Module from TLS-Attacker
• AutohomeCorp/frostmourne - Frostmourne（霜之哀伤监控平台）是基于Elasticsearch, Prometheus, SkyWalking, InfluxDB，Mysql/TiDB，ClickHouse, SqlServer, IoTDB数据的监控，报警系统. Monitor & alert & alarm for Elasticsearch，Prometheus data。主要使用springboot2 + vue-element-admin
• gephi/gephi - Gephi - The Open Graph Viz Platform
• zaproxy/zaproxy - The OWASP ZAP core project
• KeenSecurityLab/BinAbsInspector - BinAbsInspector: Vulnerability Scanner for Binaries
• nccgroup/ghostrings - Ghidra scripts for recovering string definitions in Go binaries
• M66B/FairEmail - Fully featured, open source, privacy friendly email app for Android
• simioni87/auth_analyzer - Burp Extension for testing authorization issues. Automated request repeating and parameter value extraction on the fly.
• alibaba/Sentinel - A powerful flow control component enabling reliability, resilience and monitoring for microservices. (面向云原生微服务的高可用流控防护组件)
• google/binnavi - BinNavi is a binary analysis IDE that allows to inspect, navigate, edit and annotate control flow graphs and call graphs of disassembled code.
• MyCATApache/Mycat2 - MySQL Proxy using Java NIO based on Sharding SQL,Calcite ,simple and fast
• MyCATApache/Mycat-Server -
• BiglySoftware/BiglyBT - Feature-filled Bittorrent client based on the Azureus open source project
• TorgoTorgo/ghidra-findcrypt - Ghidra analysis plugin to locate cryptographic constants
• apache/plc4x - PLC4X The Industrial IoT adapter
• DSM-fudan/KV-match - ICDE 2019 - KV-match: A Subsequence Matching Approach Supporting Normalization and Time Warping
• tdebatty/java-string-similarity - Implementation of various string similarity and distance algorithms: Levenshtein, Jaro-winkler, n-Gram, Q-Gram, Jaccard index, Longest Common Subsequence edit distance, cosine similarity ...
• coh7eiqu8thaBu/SLocker - Source code of the SLocker Android ransomware
• 000JustMe/PewCrypt - PewCrypt Ransomware Source
• openraven/magpie - A Cloud Security Posture Manager or CSPM with a focus on security analysis for the modern cloud stack and a focus on the emerging threat landscape such as cloud ransomware and supply chain attacks.
• droidefense/engine - Droidefense: Advance Android Malware Analysis Framework
• sleuthkit/autopsy - Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card.
• ac-pm/Inspeckage - Android Package Inspector - dynamic analysis with api hooks, start unexported activities and more. (Xposed Module)
• ahlashkari/CICFlowMeter - CICFlowmeter-V4.0 (formerly known as ISCXFlowMeter) is an Ethernet traffic Bi-flow generator and analyzer for anomaly detection that has been used in many Cybersecurity datsets such as Android Adware-General Malware dataset (CICAAGM2017), IPS/IDS dataset (CICIDS2017), Android Malware dataset (CICAndMal2017) and Distributed Denial of Service (CICDDoS2019).
• D4stiny/jWARE - Ransomware base in Java for all operating systems
• strazzere/anti-emulator - Android Anti-Emulator
• hiparker/opsli-boot - OPSLI 快速开发平台基于springboot、vue、element-ui ，项目采用前后端分离架构，热插拔式业务模块与插件扩展性高 ,代码简洁，功能丰富，开箱即用
• SJBSoft/Hospital-Management-System - Java mini project Hospital Management System with sql database
• SteveGan/NeusoftCloudHospital - 东软云医院。爱与健康，连接你我。🏥
• YuJian95/hospital - 医院预约挂号微信小程序（Spring Boot、Vue、Uni-app）
• openmrs/openmrs-core - OpenMRS API and web application code
• TANGKUO/HIS - HIS英文全称 hospital information system（医院信息系统），系统主要功能按照数据流量、流向及处理过程分为临床诊疗、药品管理、财务管理、患者管理。诊疗活动由各工作站配合完成，并将临床信息进行整理、处理、汇总、统计、分析等。本系统包括以下工作站：门诊医生工作站、药房医生工作站、医技医生工作站、收费员工作站、对帐员工作站、管理员工作站。
• ZainZhao/HIS - HIS英文全称 hospital information system（医疗信息就诊系统），系统主要功能按照数据流量、流向及处理过程分为临床诊疗、药品管理、财务管理、患者管理。诊疗活动由各工作站配合完成，并将临床信息进行整理、处理、汇总、统计、分析等。本系统包括以下工作站：门诊医生工作站、药房医生工作站、医技医生工作站、收费员工作站、对帐员工作站、管理员工作站。需求为东软提供的云医院。
• luoyanwu/easysign - 国密算法基于bc库使用，cms/pkcs#7格式封装，pdf盖章等
• microg/GmsCore - Free implementation of Play Services
• itext/itext7 - iText for Java represents the next level of SDKs for developers that want to take advantage of the benefits PDF can bring. Equipped with a better document engine, high and low-level programming capabilities and the ability to create, edit and enhance PDF documents, iText can be a boon to nearly every workflow.
• bioinformatics-ua/dicoogle - Dicoogle - Open Source PACS
• KOHGYLW/kiftd-source - kiftd: An open source sky driver or cloud driver server application! 欢迎访问kiftd源代码资源库！您可以在此获取kiftd源代码，并自由地进行下载和查看。该源代码仓库同时也是开发仓库，因此其版本可能比发行版靠前（但绝不会滞后）。
• uvasrg/FastGC -
• encryptogroup/me-sfe - Memory Efficient Secure Function Evaluation
• openkm/document-management-system - OpenKM is a Open Source Document Management System
• NationalSecurityAgency/ghidra - Ghidra is a software reverse engineering (SRE) framework
• keycloak/keycloak - Open Source Identity and Access Management For Modern Applications and Services
• google/data-transfer-project - The Data Transfer Project makes it easy for people to transfer their data between online service providers. We are establishing a common framework, including data models and protocols, to enable direct transfer of data both into and out of participating online service providers.
• google/tsunami-security-scanner - Tsunami is a general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence.
• tianshiyeben/wgcloud - Linux运维监控工具，支持系统硬件信息，内存，cpu，温度，磁盘空间及IO，硬盘smart，系统负载，网络流量等监控，服务接口，大屏展示，拓扑图，进程监控，端口监控，docker监控，文件防篡改，日志监控，数据可视化，web ssh，堡垒机，指令下发批量执行，Linux面板(探针)，SNMP，故障告警
• nsacyber/GRASSMARLIN - Provides situational awareness of Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) networks in support of network security assessments. #nsacyber
• beemdevelopment/Aegis - A free, secure and open source app for Android to manage your 2-step verification tokens.
• Nepxion/Discovery - ☀️ Nepxion Discovery is a solution for Spring Cloud with blue green, gray, route, limitation, circuit breaker, degrade, isolation, tracing, dye, failover, active 蓝绿灰度发布、路由、限流、熔断、降级、隔离、追踪、流量染色、故障转移、多活
• natario1/CameraView - 📸 A well documented, high-level Android interface that makes capturing pictures and videos easy, addressing all of the common issues and needs. Real-time filters, gestures, watermarks, frame processing, RAW, output of any size.
• thingsboard/thingsboard - Open-source IoT Platform - Device management, data collection, processing and visualization.
• gitblit-org/gitblit - pure java git solution
• renrenio/renren-security - 采用Spring、MyBatis、Shiro框架，开发的一套权限系统，极低门槛，拿来即用。设计之初，就非常注重安全性，为企业系统保驾护航，让一切都变得如此简单。【QQ群：324780204、145799952】
• dbeaver/dbeaver - Free universal database tool and SQL client
• dromara/MaxKey - MaxKey SSO ,Leading-Edge IAM-IDaas(Identity and Access Management) Product.
• torakiki/pdfsam - PDFsam, a desktop application to split, merge, mix, rotate PDF files and extract pages
• pflaeging/PortableSigner2 - PortableSigner - A Commandline and GUI Tool to digital sign PDF files with X.509 certificates
• intoolswetrust/jsignpdf - PDF signing software written in Java. It supports visible signatures, timestamping, certificate verification and many other cool features

JavaScript

• idank/showthedocs -
• rmlzy/export-jd-read - 一键导出京东校园版电子书
• immunefi-team/notary -
• immunefi-team/sales-poc - Repository contains a example of vulnerable contract and a PoC in hardhat framework
• immunefi-team/wormhole-uninitialized - The repository contains a runnable POC for uninitialized wormhole implementation contract
• immunefi-team/markdown-testing -
• wormhole-foundation/example-portal-fast-withdrawal - We could have named this legendary-palm-tree. We can only hope it will be as legendary.
• BoyceLig/Clash_Chinese_Patch - Clash For Windows 汉化补丁和汉化脚本
• dromara/electron-egg - A simple, cross platform, enterprise desktop software development framework
• rustdesk/rustdesk-server - RustDesk Server Program
• streetwriters/notesnook - A fully open source & end-to-end encrypted note taking alternative to Evernote.
• 1modm/petereport - PeTeReport is an open-source application vulnerability reporting tool.
• repnz/windbg-cheat-sheet - My personal cheat sheet for using WinDbg for kernel debugging
• RoganDawes/P4wnP1_aloa - P4wnP1 A.L.O.A. by MaMe82 is a framework which turns a Rapsberry Pi Zero W into a flexible, low-cost platform for pentesting, red teaming and physical engagements ... or into "A Little Offensive Appliance".
• duo-labs/cloudmapper - CloudMapper helps you analyze your Amazon Web Services (AWS) environments.
• Arno0x/DNSExfiltrator - Data exfiltration over DNS request covert channel
• kgretzky/pwndrop - Self-deployable file hosting service for red teamers, allowing to easily upload and share payloads over HTTP and WebDAV.
• beefproject/beef - The Browser Exploitation Framework Project
• aquasecurity/cloudsploit - Cloud Security Posture Management (CSPM)
• gchq/CyberChef - The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis
• M3NIX/sigmaio - simple webapp for converting sigma rules into siem queries using the pySigma library
• HeiSir2014/M3U8-Downloader - M3U8-Downloader 支持多线程、断点续传、加密视频下载缓存。
• Momo707577045/m3u8-downloader - m3u8 视频在线提取工具
• kawaiipantsu/redjoust - A quick and easy to use security reconnaissance webapp tool, does OSINT, analysis and red-teaming in both passive and active mode. Written in nodeJS and Electron.
• openpgpjs/openpgpjs - OpenPGP implementation for JavaScript
• matrix-org/matrix.to - A simple stateless privacy-protecting URL redirecting service for Matrix
• o2oa/o2oa - 开源OA系统 - 码云GVP|Java开源oa|企业OA办公平台|企业OA|协同办公OA|流程平台OA|O2OA|OA，支持国产麒麟操作系统和国产数据库（达梦、人大金仓），政务OA，军工信息化OA
• ipfs/ipfs-desktop - An unobtrusive and user-friendly desktop application for IPFS on Windows, Mac and Linux.
• chakra-core/ChakraCore - ChakraCore is an open source Javascript engine with a C API.
• gorhill/uBlock - uBlock Origin - An efficient blocker for Chromium and Firefox. Fast and lean.
• REMnux/remnux-cli - This repository contains the source code for the REMnux installer, which is the command-line tool for installing and upgrading the REMnux distro.
• roccomuso/netcat - 💻 Netcat client and server modules written in pure Javascript for Node.js.
• godocms/godocms - godocms是刚东科技开发的一套开源办公套件，遵从Apache License 2.0开源协议，非常适合二次开发，内含word/excel/ppt/pdf/svg/思维导图/流程图/日程管理等多个办公系统解决方案。godocms也是一套低代码开发套件，内含模块管理/接口管理/代码拖拽/数据库管理/表单管理等一套完善的低代码开发工具流。内含两套风格界面，win10和传统软件界面，可随时切换。
• rpgeeganage/file-less-ransomware-demo - Demonstrate about file-less malware approach using JavaScript
• cablej/ransomwhere - The open ransomware payment tracker
• bl4de/research - Bug Bounty writeups, Vulnerability Research, Tutorials, Tips&Tricks
• ntfstool/ntfstool - A ntfs tool for mac
• JPCERTCC/SysmonSearch - Investigate suspicious activity by visualizing Sysmon's event log
• hasherezade/passcrambler - https://hasherezade.github.io/passcrambler/
• MobSF/Mobile-Security-Framework-MobSF - Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
• vatesfr/xen-orchestra - The global orchestration solution to manage and backup XCP-ng and Citrix Hypervisor.
• horsicq/Detect-It-Easy - Program for determining types of files for Windows, Linux and MacOS.
• attekett/NodeFuzz -
• eth0izzle/shhgit - Ah shhgit! Find secrets in your code. Secrets detection for your GitHub, GitLab and Bitbucket repositories: www.shhgit.com
• bits-his/bits-his - An Open Source Hospital Management System
• andreimargeloiu/Hospital-management-nodejs - NodeJS web app for managing patients and planning their distribution across hospital’s rooms.
• IMA-WorldHealth/bhima - A hospital information management application for rural Congolese hospitals
• VMDashboard/vmdashboard - web-based open source virtualization management interface for QEMU and KVM virtual machines
• beepnl/BEEP - BEEP - Open source bee monitoring - App/API/Measurement system
• FrenchYeti/dexcalibur - [Official] Android reverse engineering tool focused on dynamic instrumentation automation leveraging Frida. It disassembles dex, analyzes it statically, generates hooks, discovers reflected methods, stores intercepted data and does new things from it. Its aim is to be an all-in-one Android reverse engineering platform.
• StrangerealIntel/CyberThreatIntel - Analysis of malware and Cyber Threat Intel of APT and cybercriminals groups
• v8-riscv/node - Node.js on RISC-V! See the link below to learn more and try it out.
• mynane/PDF - 收集的各种资源
• guanpengchn/awesome-books - 📚 开发者推荐阅读的书籍
• hhk7734/wiki.loliot.net -
• reactioncommerce/reaction - Mailchimp Open Commerce is an API-first, headless commerce platform built using Node.js, React, GraphQL. Deployed via Docker and Kubernetes.
• kern/filepizza - 🍕 Peer-to-peer file transfers in your browser
• jogetworkflow/jw-community - Joget is an open source no-code/low-code application platform that combines the best of rapid application development, business process automation and workflow management. This Joget open source repository is licensed under GPLv3. For commercial licensing, please visit www.joget.org.
• skyvers/skyve - Skyve is an open-source low-code platform that gives you access to all of the key capabilities needed to build sophisticated, robust and scalable cloud solutions.
• mar10/fancytree - JavaScript tree view / tree grid plugin with support for keyboard, inline editing, filtering, checkboxes, drag'n'drop, and lazy loading
• sindresorhus/pageres-cli - Capture website screenshots
• multiparty/web-mpc - Platform for deploying web-based privacy-preserving data surveys using secure multi-party computation (MPC).
• odoo/odoo - Odoo. Open Source Apps To Grow Your Business.
• node-red/node-red - Low-code programming for event-driven applications
• multiparty/jiff - JavaScript library for building web-based applications that employ secure multi-party computation (MPC).
• documize/community - Modern Confluence alternative designed for internal & external docs, built with Go + EmberJS
• silexlabs/CloudExplorer2 - Manage your users' cloud services from your application
• lexoyo/CloudExplorer2 - Manage your users' cloud services from your application
• silexlabs/unifile - Unified access to cloud storage services through a simple web API.
• cuckoosandbox/cuckoo - Cuckoo Sandbox is an automated dynamic malware analysis system
• arkime/arkime - Arkime (formerly Moloch) is an open source, large scale, full packet capturing, indexing, and database system.
• jackspirou/clientjs - Device information and digital fingerprinting written in pure JavaScript.
• bigbluebutton/bigbluebutton - Complete open source web conferencing system.
• SpiderOak/Encryptr - Encryptr is a zero-knowledge cloud-based password manager / e-wallet powered by Crypton
• samyk/poisontap - Exploits locked/password protected computers over USB, drops persistent WebSocket-based backdoor, exposes internal router, and siphons cookies using Raspberry Pi Zero & Node.js.
• andrewngu/sound-redux - A Soundcloud client built with React / Redux
• zettajs/zetta - An API-first, open source software platform for the Internet of Things.
• Freeboard/freeboard - A damn-sexy, open source real-time dashboard builder for IOT and other web mashups. A free open-source alternative to Geckoboard.
• amark/gun - An open source cybersecurity protocol for syncing decentralized graph data.
• moeiscool/Shinobi - ☮️ 🇵🇸 Shinobi CE - The Free Open Source CCTV platform written in Node.JS (Camera Recorder - Security Surveillance Software - Restreamer
• yanickrochon/koa-rbac - Role-Based Access Control for Koa
• uahengojr/mongoose-rbac - Role-based access control for mongoose apps.
• iGeeky/wolf - Wolf is an authentication and authorization system based on Role-Based Access Control (RBAC) for http applications or http restful apis. Wolf是一个基于角色访问控制（RBAC）的认证和授权系统，适用于http应用或http restful api
• stalniy/casl - CASL is an isomorphic authorization JavaScript library which restricts what resources a given user is allowed to access
• brainhubeu/react-permissible - 👮‍♂️Making the permission management for React components easier.
• joonhocho/graphql-rule - GraphQL rule / access control / auth / security / authorization / permission
• pinterest/snappass - Share passwords securely
• animir/node-rate-limiter-flexible - Count and limit requests by key with atomic increments in single process or distributed environment.
• cryptocat/cryptocat - Secure chat software for your computer.
• krakenjs/lusca - Application security for express apps.
• patriksimek/vm2 - Advanced vm/sandbox for Node.js
• sandstorm-io/sandstorm - Sandstorm is a self-hostable web productivity suite. It's implemented as a security-hardened web app package manager.
• jedireza/aqua - 💡 A website and user system starter
• jedireza/frame - 💡 A user system API starter
• flatlogic/react-dashboard - 🔥React Dashboard - isomorphic admin dashboard template (React.js, Bootstrap, Node.js, GraphQL, React Router, Babel, Webpack, Browsersync) 🔥
• LANIF-UI/dva-boot-admin - 🍰 react admin dashboard ui LANIF-ADMIN --- react 16 + react-router 4 + dva 2 + antd 4 后台管理 脚手架
• webcodesk/webcodesk-srv - Webcodesk - Web App Builder for Create React App
• opencomponents/oc - OpenComponents, serverless in the front-end world for painless micro-frontends delivery
• smallbets/userbase - Create secure and private web apps using only static JavaScript, HTML, and CSS.
• photo/frontend - The official @github repository of the Trovebox frontend software. A photo sharing and photo management web interface for data stored "in the cloud" (i.e. Amazon S3, Rackspace CloudFiles, Google Storage).
• mxstbr/login-flow - 🔑 A login/register flow built with React&Redux
• zadam/trilium - Build your personal knowledge base with Trilium Notes
• FoxUSA/OpenNote - OpenNote was built to be an open web-based alternative to Microsoft OneNote (T) and EverNote.
• keeweb/keeweb - Free cross-platform password manager compatible with KeePass
• trekjs/captcha - A Lightweight Pure JavaScript Captcha for Node.js. No C/C++, No ImageMagick, No Canvas.
• produck/svg-captcha - generate svg captcha in node
• iuap-design/tinper-bee - 🐝 一套基于 react.js 和 iuap design 设计语言实现的前端组件库 http://bee.tinper.org
• iuap-design/ucf-web - UCF-WEB 一个专注于性能与效率的前端微应用开发框架
• twbs/bootstrap - The most popular HTML, CSS, and JavaScript framework for developing responsive, mobile first projects on the web.
• forbesmyester/esqlate - Build minimum viable admin panels quickly with just SQL
• 0wczar/airframe-react - Free Open Source High Quality Dashboard based on Bootstrap 4 & React 16: http://dashboards.webkom.co/react/airframe
• lmenezes/cerebro -
• naihe138/GraphQL-demo - 🎉Koa + GraphQL + Apollo-Server demo
• hasura/graphqurl - curl for GraphQL with autocomplete, subscriptions and GraphiQL. Also a dead-simple universal javascript GraphQL client.
• nitin42/react-imgpro - 📷 Image Processing Component for React
• kdchang/reactjs101 - 從零開始學 ReactJS（ReactJS 101）是一本希望讓初學者一看就懂的 React 中文入門教學書，由淺入深學習 ReactJS 生態系 (Flux, Redux, React Router, ImmutableJS, React Native, Relay/GraphQL etc.)。
• diegohaz/arc - React starter kit based on Atomic Design
• storybook-eol/react-treebeard - React Tree View Component. Data-Driven, Fast, Efficient and Customisable.
• novnc/noVNC - VNC client web application
• frontend-collective/react-sortable-tree - Drag-and-drop sortable component for nested data and hierarchies
• nylas/nylas-mail - 💌 An extensible desktop mail app built on the modern web. Forks welcome!
• react-boilerplate/react-boilerplate - 🔥 A highly scalable, offline-first foundation with the best developer experience and a focus on performance and best practices.
• coryhouse/react-slingshot - React + Redux starter kit / boilerplate with Babel, hot reloading, testing, linting and a working example app built in
• infernojs/inferno - 🔥 An extremely fast, React-like JavaScript library for building modern user interfaces
• segmentio/evergreen - 🌲 Evergreen React UI Framework by Segment
• mui/material-ui - MUI Core: Ready-to-use foundational React components, free forever. It includes Material UI, which implements Google's Material Design.
• gatsbyjs/gatsby - The fastest frontend for the headless web. Build modern websites with React.
• netlify/netlify-cms - A Git-based CMS for Static Site Generators
• atlassian/react-beautiful-dnd - Beautiful and accessible drag and drop for lists with React
• esbenp/pdf-bot - 🤖 A Node queue API for generating PDFs using headless Chrome. Comes with a CLI, S3 storage and webhooks for notifying subscribers about generated PDFs
• yWorks/jsPDF - JavaScript PDF generation to work with SVG
• mozilla/pdf.js - PDF Reader in JavaScript
• wojtekmaj/react-pdf - Display PDFs in your React app as easily as if they were images.
• marcbachmann/node-html-pdf - This repo isn't maintained anymore as phantomjs got dreprecated a long time ago. Please migrate to headless chrome/puppeteer.
• danburzo/percollate - A command-line tool to turn web pages into beautiful, readable PDF, EPUB, or HTML docs.
• foliojs/pdfkit - A JavaScript PDF generation library for Node and the browser
• diegomura/react-pdf - 📄 Create PDF files using React
• RelaxedJS/ReLaXed - Create PDF documents using web technologies
• benoitvallon/react-native-nw-react-calculator - Mobile, desktop and website Apps with the same code
• alibaba/anyproxy - A fully configurable http/https proxy in NodeJS
• parse-community/parse-server - Parse Server for Node.js / Express
• ExpressGateway/express-gateway - A microservices API Gateway built on top of Express.js
• auth0/node-jsonwebtoken - JsonWebToken implementation for node.js http://self-issued.info/docs/draft-ietf-oauth-json-web-token.html
• kunalkapadia/express-mongoose-es6-rest-api - 💥 A boilerplate application for building RESTful APIs Microservice in Node.js using express and mongoose in ES6 with code coverage and JsonWebToken Authentication
• sahat/hackathon-starter - A boilerplate for Node.js web applications
• telerik/kendo-react-homepage-demo - A sample application showcasing the KendoReact Grid in action with GraphQL
• telerik/kendo-react-material-dashboard -
• americanexpress/jest-image-snapshot - ✨ Jest matcher for image comparisons. Most commonly used for visual regression testing.
• rsmbl/Resemble.js - Image analysis and comparison
• mapbox/pixelmatch - The smallest, simplest and fastest JavaScript pixel-level image comparison library
• yahoo/blink-diff - A lightweight image comparison tool.
• chenglou/react-motion - A spring that solves your animation problems.

Jinja

• splunk/attack_range - A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk
• KVM-VMI/kvm-vmi - KVM-based Virtual Machine Introspection

Jupyter Notebook

• datawhalechina/joyful-pandas - pandas中文教程
• geektutu/tensorflow2-docs-zh - TF2.0 / TensorFlow 2.0 / TensorFlow2.0 官方文档中文版
• sokrypton/GREMLIN_CPP - GREMLIN - learn MRF/potts model from input multiple sequence alignment! Implementation now available in C++ and Tensorflow/Python!
• SitinCloud/malwares-ml - Machine Learning and Datasets for Malwares Static Analysis.
• invoke-eric/jupyter - Jupyter Notebooks for Cyber Threat Intelligence
• jupyter/notebook - Jupyter Interactive Notebook
• fastai/fastpages - An easy to use blogging platform, with enhanced support for Jupyter Notebooks.
• OALabs/research - Research notes
• Azure/Azure-Sentinel - Cloud-native SIEM for intelligent security analytics for your entire enterprise.
• dchad/malware-detection - Malware Detection and Classification Using Machine Learning
• Xilinx/PYNQ - Python Productivity for ZYNQ
• xupsh/pp4fpgas-cn-hls - HLS Project of pp4fpgas - https://github.com/xupsh/pp4fpgas-cn
• The-Art-of-Hacking/h4cker - This repository is primarily maintained by Omar Santos (@santosomar) and includes thousands of resources related to ethical hacking / penetration testing, digital forensics and incident response (DFIR), vulnerability research, exploit development, reverse engineering, and more.

Kotlin

• pppscn/SmsForwarder - 短信转发器——监控Android手机短信、来电、APP通知，并根据指定规则转发到其他手机：钉钉群自定义机器人、钉钉企业内机器人、企业微信群机器人、飞书机器人、企业微信应用消息、邮箱、bark、webhook、Telegram机器人、Server酱、PushPlus、手机短信等。包括主动控制服务端与客户端，让你轻松远程发短信、查短信、查通话、查话簿、查电量等。（V3.0 新增）PS.这个APK主要是学习与自用，如有BUG请提ISSUE，同时欢迎大家提PR指正
• Dashlane/android-apps - 🤖 Android applications sources
• vector-im/element-android - A glossy Matrix collaboration client for Android.
• JetBrains/swot - Identify email addresses or domains names that belong to colleges or universities. Help automate the process of approving or rejecting academic discounts.

LLVM

• JonathanSalwan/Tigress_protection - Playing with the Tigress software protection. Break some of its protections and solve their reverse engineering challenges. Automatic deobfuscation using symbolic execution, taint analysis and LLVM.

Lua

• tickbh/luojiawaf_lua - luojia waf openresty Web Application Firewall or API Gateway(应用防火墙/API网关)
• udbg/udbg-script - dynamic binary analysis tools
• KyleBing/rime-wubi86-jidian - 86五笔极点码表 for 鼠须管(macOS)、小狼毫(Windows)、中州韵(Ubuntu) 五笔输入法
• ntop/ntopng - Web-based Traffic and Security Network Traffic Monitoring
• michal-h21/make4ht - Build system for tex4ht
• automayt/ICS-pcap - A collection of ICS/SCADA PCAPs
• w3h/icsmaster - ICS/SCADA Security Resource（整合工控安全相关资源）
• freeioe/freeioe - An edge-computing framework for Industrial Internet of Things 开源的边缘计算网关框架. 讨论群: 291292378

Makefile

• o7-machinehum/ovrdrive - The one and only, exploding USB drive
• IntelLabs/kAFL - A fuzzer for full VM kernel/driver targets
• frida/frida - Clone this repo to build Frida
• riscv/riscv-bitmanip - Working draft of the proposed RISC-V Bitmanipulation extension

OCaml

• mirage/mirage - MirageOS is a library operating system that constructs unikernels
• xapi-project/xen-api - The Xapi Project's XenAPI Server
• airbus-seclab/bincat - Binary code static analyser, with IDA integration. Performs value and taint analysis, type reconstruction, use-after-free and double-free detection

Objective-C

• lennartbublies/ecdsa - ECDSA VHDL Implementation
• Tencent/lemon-cleaner - 腾讯柠檬清理是针对macOS系统专属制定的清理工具。主要功能包括重复文件和相似照片的识别、软件的定制化垃圾扫描、可视化的全盘空间分析、内存释放、浏览器隐私清理以及设备实时状态的监控等。重点聚焦清理功能，对上百款软件提供定制化的清理方案，提供专业的清理建议，帮助用户轻松完成一键式清理。
• didi/DiDiPrism - 小桔棱镜，一款专注移动端操作行为的利器！ A powerful tool (iOS & Android) that focuses on mobile operation behavior!
• benbaker76/Hackintool - The Swiss army knife of vanilla Hackintoshing
• xhzengAIB/MessageDisplayKit - An IM App like WeChat App has to send text, pictures, audio, video, location messaging, managing local address book, share a circle of friends, drifting friends, shake a fun and more interesting features.

Others

• ExpLangcn/NucleiTP - 自动整合全网Nuclei的漏洞POC，实时同步更新最新POC！
• CMEPW/BypassAV - This map lists the essential techniques to bypass anti-virus and EDR
• V33RU/IoTSecurity101 - A Curated list of IoT Security Resources
• imran-parray/Mind-Maps - Mind-Maps of Several Things
• brcyrr/PracticalCyberSecurityResources - This repository contains a curated list of resources I suggest on LinkedIn and Twitter.📝🌝
• gaurangtorvekar/Prenup_Ethereum - This is the first ever prenup on Ethereum blockchain (to the best of my knowledge). You can take this code to write your own prenup too!
• evilcos/darkhandbook - Update by evilcos, for DarkHandBook.io
• slowmist/Blockchain-dark-forest-selfguard-handbook - Blockchain dark forest selfguard handbook. Master these, master the security of your cryptocurrency.
• trickest/resolvers - The most exhaustive list of reliable DNS resolvers.
• trickest/inventory - Asset inventory on public bug bounty programs.
• JPCERTCC/HUILoader-research - HUI Loader analysis research
• JPCERTCC/CobaltStrike-Config - Repository for archiving Cobalt Strike configuration
• JPCERTCC/Lucky-Visitor-Scam-IoC - Automatically update IoC for lucky visitor scam
• SunWeb3Sec/SunWeb3Sec -
• SunWeb3Sec/awesome-foundry - A curated list of awesome of the Foundry development framework.
• SunWeb3Sec/blocksec-ctfs - A curated list of blockchain security Capture the Flag (CTF) competitions
• SunWeb3Sec/DeFiVulnLabsCosmWasm -
• SunWeb3Sec/Kubernetes-security - Kubernetes pentesting, hardening and hunting tools.
• rmlzy/my-ebook - 我收集的电子书, 主要是软件开发方向
• immunefi-team/Web3-Security-Library - Information about web3 security and programming tutorials/tools
• wormhole-foundation/wormhole-networks -
• wormhole-foundation/wormhole-relayer-list -
• akr3ch/BugBountyBooks - A collection of PDF/books about the modern web application security and bug bounty.
• pan-unit42/tweets -
• BushidoUK/Abused-Legitimate-Services - Cloud, CDN, and marketing services leveraged by cybercriminals and APT groups
• BushidoUK/Open-source-Malware - Repository of open source malware here on Github!
• BushidoUK/Open-source-tools-for-CTI - Public Repository of Open Source Tools for Cyber Threat Intelligence Analysts and Researchers
• A-poc/RedTeam-Tools - Tools and Techniques for Red Team / Penetration Testing
• wtsxDev/reverse-engineering - List of awesome reverse engineering resources
• lasq88/LearingMaterials - Different learning materials
• 0voice/Understanding_in_Rust - 【最安全的编程语言】Rust工程师枕边资料，大牛文章，开源框架，官方文档，视频，推荐书籍，学习干货，大牛语录
• 0voice/learning_mind_map - 2021年【思维导图】盒子，C/C++，Golang，Linux，云原生，数据库，DPDK，音视频开发，TCP/IP，数据结构，计算机原理等
• 0voice/linux_environment_tools - 总结linux环境开发工具，包含linux，虚拟机，编译器，编辑器，测试工具，加密工具
• EbookFoundation/free-programming-books - 📚 Freely available programming books
• Ignitetechnologies/BurpSuite-For-Pentester - This cheatsheet is built for the Bug Bounty Hunters and penetration testers in order to help them hunt the vulnerabilities from P4 to P1 solely and completely with "BurpSuite".
• kingToolbox/WindEdit - A high performace text editor for huge file and long line.
• Kc57/Awesome-Pentest - A list of awesome penetration testing tools and resources.
• mbabinski/Sigma-Rules - A repository of my own Sigma detection rules.
• aniruddhachoudhury/Data-Science-Books - Complete end to end Datascience Books for various Application
• smicallef/awesome-osint - 😱 A curated list of amazingly awesome OSINT
• zbezj/HEU_KMS_Activator -
• microsoft/Windows-classic-samples - This repo contains samples that demonstrate the API used in Windows classic desktop applications.
• NagliNagli/BountyTricks -
• Amin-Tgz/awesome-tensorflow-2 - 👉 Tensorflow 2.x resources such as tutorial, blog, code and videos
• mdecrevoisier/Microsoft-eventlog-mindmap - Set of Mindmaps providing a detailed overview of the different #Microsoft auditing capacities for Windows, Exchange, Azure,...
• SanseoLab/ejUnpacker - x64dbg scripts for finding OEP of packers
• newlog/r2_malware_unpacking_training - This repository contains the slides and content for the malware unpacking training given at r2con 2017
• MalwareStudio/Worm-Locker2.0-OPEN-SOURCE- - This is the published source code from the Worm Locker2.0 ransomware. Please open the README file in a zip file for more information.
• MalwareStudio/Ransomware2.0_by_clutter_tech -
• MalwareStudio/RANSOMWARE3.0-SOURCE-CODE - This is my ransomware from my video: https://www.youtube.com/watch?v=niRclD6ewXA&t=11s&ab_channel=CYBERSOLDIER
• MalwareStudio/Ransomware_source_code -
• wietze/HijackLibs - Project for tracking publicly disclosed DLL Hijacking opportunities.
• payloadbox/sql-injection-payload-list - 🎯 SQL Injection Payload List
• anomous/RAD-Studio-11-Patch - RAD Studio 11 Alexandria - Patch/Keygen/Activator
• Zeyad-Azima/Offensive-Resources - A Huge Learning Resources with Labs For Offensive Security Players
• biggerduck/RedTeamNotes - 红队笔记
• dsopas/assessment-mindset - Security Mindmap that could be useful for the infosec community when doing pentest, bug bounty or red-team assessments.
• Puliczek/awesome-list-of-secrets-in-environment-variables - 🦄🔒 Awesome list of secrets in environment variables 🖥️
• Leezj9671/offensiveinterview - 翻译国外的@WebBreacher的安全/渗透测试/红队面试题，有部分参考作用
• WebBreacher/offensiveinterview - Interview questions to screen offensive (red team/pentest) candidates
• hudunkey/Red-Team-links - 2019年红队资源链接，资源不是本人整理出来，来自互联网，因为流传的少，特意在此做个备份，做个分享。
• SecurityRiskAdvisors/VECTR - VECTR is a tool that facilitates tracking of your red and blue team testing activities to measure detection and prevention capabilities across different attack scenarios
• HolyBugx/HolyTips - A Collection of Notes, Checklists, Writeups on Bug Bounty Hunting and Web Application Security.
• inonshk/31-days-of-API-Security-Tips - This challenge is Inon Shkedy's 31 days API Security Tips.
• shieldfy/API-Security-Checklist - Checklist of the most important security countermeasures when designing, testing, and releasing your API
• rootkit-io/awesome-malware-development - Organized list of my malware development resources
• RiccardoAncarani/talks -
• NotPrab/.NET-Obfuscator - Lists of .NET Obfuscator (Free, Freemium, Paid and Open Source )
• h3xduck/awesome-ebpf - A curated list of awesome projects related to eBPF.
• gobysec/Goby - Attack surface mapping
• vysecurity/RedTips - Red Team Tips as posted by @vysecurity on Twitter
• netbiosX/Checklists - Red Teaming & Pentesting checklists for various engagements
• yadox666/The-Hackers-Hardware-Toolkit - The best hacker's gadgets for Red Team pentesters and security researchers.
• bluscreenofjeff/Red-Team-Infrastructure-Wiki - Wiki to collect Red Team infrastructure hardening resources
• yeyintminthuhtut/Awesome-Red-Teaming - List of Awesome Red Teaming Resources
• infosecn1nja/awesome-mitre-attack - A curated list of awesome resources related to Mitre ATT&CK™ Framework
• Kevin-Robertson/InveighZero - .NET IPv4/IPv6 machine-in-the-middle tool for penetration testers
• xforcered/InlineExecute-Assembly - InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module
• l0ss/Grouper2 - Find vulnerabilities in AD Group Policy
• threatexpress/malleable-c2 - Cobalt Strike Malleable C2 Design and Reference Guide
• infosecn1nja/Red-Teaming-Toolkit - This repository contains cutting-edge open-source security tools (OST) for a red teamer and threat hunter.
• fr0gger/awesome-ida-x64-olly-plugin - A curated list of IDA x64DBG, Ghidra and OllyDBG plugins.
• tarun776/Tools - port+dir+param bruteforcing at the same time using ffuf
• im-hanzou/Arbitrium-RAT - Arbitrium is a cross-platform, fully undetectable remote access trojan, to control Android, Windows and Linux and doesn't require any firewall exceptions or port forwarding rules
• 1hack0/Facebook-Bug-Bounty-Write-ups - Hunting Bugs for Fun and Profit
• jaiswalakshansh/Facebook-BugBounty-Writeups - Collection of Facebook Bug Bounty Writeups
• Ignitetechnologies/Credential-Dumping - This cheatsheet is aimed at the Red Teamers to help them understand the fundamentals of Credential Dumping (Sub Technique of Credential Access) with examples. There are multiple ways to perform the same tasks
• vavkamil/awesome-bugbounty-tools - A curated list of various bug bounty tools
• PacktPublishing/Malware-Analysis-Techniques - Malware Analysis Techniques, published by Packt
• hashishrajan/cloud-security-vulnerabilities - List of all the Publicly disclosed vulnerabilities of Public Cloud Provider like Amazon Web Services (AWS), Microsoft Azure, Google Cloud, Oracle Cloud, IBM Cloud etc
• yardenshafir/conference_talks - Slides from various conference talks
• FuzzySecurity/BH-Arsenal-2019 - SilkETW & SilkService
• ramensoftware/windhawk - The customization marketplace for Windows programs: https://windhawk.net/
• Tzaoh/pwning - RE / Binary Exploitation Resources
• bash-c/slides - won't maintain
• b01lers/welcome-to-ctf - A small repo to host b01lers' outline of what CTF is and how to get into it.
• executemalware/Malware-IOCs -
• emadshanab/Nuclei-Templates-Collection - Nuclei Templates Collection
• nmantani/archiver-MOTW-support-comparison -
• onethawt/reverseengineering-reading-list - A list of Reverse Engineering articles, books, and papers
• ethereal-vx/Antivirus-Artifacts - Anti-virus artifacts. Listing APIs hooked by: Avira, BitDefender, F-Secure, MalwareBytes, Norton, TrendMicro, and WebRoot.
• rsmudge/Malleable-C2-Profiles - Malleable C2 is a domain specific language to redefine indicators in Beacon's communication. This repository is a collection of Malleable C2 profiles that you may use. These profiles work with Cobalt Strike 3.x.
• The-DFIR-Report/Sigma-Rules - Rules generated from our investigations.
• mytechnotalent/TOR-Everything - Simple FREE guide to set up TOR stealth and persistence with complete anonymity.
• alphaSeclab/awesome-security-collection - 1000+ Github Security Resource Collection Repos.
• alphaSeclab/awesome-rat - RAT And C&C Resources. 250+ Open Source Projects, 1200+ RAT/C&C blog/video.
• riramar/Web-Attack-Cheat-Sheet - Web Attack Cheat Sheet
• sbousseaden/Slides - Misc Threat Hunting Resources
• ohjeongwook/windows_sdk_data - Windows API listing in JSON format - generated from SDK headers + SDK API documentation
• onethawt/idaplugins-list - A list of IDA Plugins
• microsoft/JigsawDataset - Jigsaw Dataset: Natural language to Python Pandas code
• sherlocksecurity/VMware-CVE-2022-22954 - POC for VMWARE CVE-2022-22954
• Neo23x0/BlueLedger - A list of my personal projects
• Fr0sT-Brutal/awesome-delphi - Archived version of curated list of awesome Delphi frameworks, libraries, resources, and shiny things. Deprecated in favor of awesome-pascal
• rbardini/devcpp-monokai - 🎨 Monokai theme for Dev-C++
• kh4sh3i/Ransomware-Samples - Small collection of Ransomware organized by family.
• killvxk/GDriver - Basic kernel mode/ring0 driver for 64bit Win7, 8, 8.1, 10. Signature scan for SDT, SSDT, SSDTS. Implements process hiding, process protection against read/write access and kills, the ability to forcefully terminate ANY process you want even it's a protected system process like an anti malware solution. The drivers gets its commands from a usermode process.
• HuanGMZzz/windbg-Scanning-ssdt-list - this is a windbg script which can scanning the function name in windows ssdt ( X86 and X64)
• yutewiyof/intro-rev-ida-pro - Введение в реверсинг с нуля, используя IDA PRO. Перевод от Яши
• n1ght-w0lf/WinDbgCheatSheet -
• mic101/windows - windows泄露源码
• Virus-Samples/Malware-Sample-Sources - Malware Sample Sources
• ionescu007/Blackwood-4NT - Blackwood 4NT -- Grand Slam Authentication for Windows NT (10)
• minglinchen/Win-Drv - windows内核安全与驱动开发代码
• egione/Documents -
• shadawck/awesome-endpoint-detection-and-response - Collection of tool you need to have in your Endpoint Detection and Response arsenal
• mstxq17/CVE-2021-1675_RDL_LPE - PrintNightMare LPE提权漏洞的CS 反射加载插件。开箱即用、通过内存加载、混淆加载的驱动名称来ByPass Defender/EDR。
• AndyFul/ConfigureDefender - Utility for configuring Windows 10 built-in Defender antivirus settings.
• infosecn1nja/AD-Attack-Defense - Attack and defend active directory using modern post exploitation adversary tradecraft activity
• ONLYOFFICE/DesktopEditors - An office suite that combines text, spreadsheet and presentation editors allowing to create, view and edit local documents
• Tencent/secguide - 面向开发人员梳理的代码安全指南
• MountCloud/FireKylin - 🔥火麒麟-网络安全应急响应工具(系统痕迹采集)Cybersecurity emergency response tool.
• wwh1004/blog - Wwh的个人博客
• CursedDeobfuscators/AgileResourcesDecrypter - Simple Application Restore Encrypted Resources Made By Agile.Net (CilSecure)
• CursedDeobfuscators/AgileDelegateCleaner - Simple Application Restore Obfuscated Calls Made By Agile.Net (CilSecure)
• ribthegreat99OrN0P/Agile.NET-Deobfuscator-MOVED -
• NotPrab/.NET-Deobfuscator - Lists of .NET Deobfuscator and Unpacker (Open Source)
• TrojanAZhen/BurpSuitePro-2.1 - 什么? 你想用免费的BurpSuitePro版本!!!
• snoopysecurity/awesome-burp-extensions - A curated list of amazingly awesome Burp Extensions
• REMnux/docs - This repository contains the backup of REMnux documentation, which is served from and managed via GitBook.
• chrisdutz/blog -
• UIM-SEC/ransomware-samples - Warning! This repository contains samples of ransomware.
• jorgetstechnology/DeathRansom - A ransomware developed in python, with bypass technics, for educational purposes.
• Explodingstuff/WannaCry - This file contains the active ransomware, WannaCry
• d4rk-d4nph3/Ransomware-Reports - This repo is a collection of Ransomware reports from vendors, researchers, etc.
• ajayrandhawa/Cryptolocker - CryptoLocker is open source files encrypt-er. Crypto is developed in Visual C++. It has features encrypt all file, lock down the system and send keys back to the server. Multi-threaded functionality helps to this tool make encryption faster.
• Hackstar7/WanaCry - WannaCry Ransomware
• awslabs/aws-security-assessment-solution - An AWS tool to help you create a point in time assessment of your AWS account using Prowler and Scout as well as optional AWS developed ransomware checks.
• utkusen/hidden-tear - an open source ransomware honeypot
• ejaz629/peeler - Ransomware dataset, containing dynamic behaviour of more than 60 distinct ransomware families.
• forensiclunch/ETLParser - Binary commandline executable to parse ETL files
• nasbench/EVTX-ETW-Resources - Event Tracing For Windows (ETW) Resources
• zodiacon/syllabi -
• zodiacon/AllTools - All reasonably stable tools
• ExpLife0011/awesome-windows-kernel-security-development - windows kernel security development
• msuhanov/ntfs-samples - NTFS samples
• alphaSeclab/DBI-Stuff - Resources About Dynamic Binary Instrumentation and Dynamic Binary Analysis
• cyber-research/APTMalware - APT Malware Dataset Containing over 3,500 State-Sponsored Malware Samples
• mgeeky/procmon-filters - SysInternals' Process Monitor filters repository - collected from various places and made up by myself. To be used for quick Behavioral analysis of testing specimens. Inspired and based on Lenny Zeltser's collection.
• Neo23x0/sysmon-version-history - An Inofficial Sysmon Version History (Change Log)
• sametsazak/sysmon - Sysmon and wazuh integration with Sigma sysmon rules [updated]
• jsecurity101/Windows-API-To-Sysmon-Events - A repository that maps API calls to Sysmon Event ID's.
• olafhartong/sysmon-cheatsheet - All sysmon event types and their fields explained
• MHaggis/sysmon-dfir - Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.
• SwiftOnSecurity/sysmon-config - Sysmon configuration file template with default high-quality event tracing
• nshalabi/SysmonTools - Utilities for Sysmon
• DavidDikker/endgame - An AWS Pentesting tool that lets you use one-liner commands to backdoor an AWS account's resources with a rogue AWS account - or share the resources with the entire internet 😈
• pandazheng/Threat-Intelligence-Analyst - 威胁情报，恶意样本分析，开源Malware代码收集
• 0x4143/malware-gems - A not so awesome list of malware gems for aspiring malware analysts
• hasherezade/keygenme-v7 - Source code of my KeygenMe V7 challenge
• hasherezade/herpaderping - Process Herpaderping proof of concept, tool, and technical deep dive. Process Herpaderping bypasses security products by obscuring the intentions of a process.
• y11en/FOLIAGE - Experiment on reproducing Obfuscate & Sleep
• hasherezade/pe_recovery_tools - A placeholder repository
• hasherezade/injection - Windows process injection methods
• hasherezade/pesieve_tests - External tests for PE-sieve
• hasherezade/pe-bear-releases - PE-bear (builds only)
• chenerlich/FCL - FCL (Fileless Command Lines) - Known command lines of fileless malicious executions
• shramos/Awesome-Cybersecurity-Datasets - A curated list of amazingly awesome Cybersecurity datasets
• swagkarna/pdfcrack - An Advanced tool to Crack Any Password Protected PDF file. A very user friendly script especially for noob hackers.
• mattnotmax/cyberchef-recipes - A list of cyber-chef recipes and curated links
• Lifka/hacking-resources - Hacking resources and cheat sheets. References, tools, scripts, tutorials, and other resources that help offensive and defensive security professionals.
• notracking/hosts-blocklists - Automatically updated, moderated and optimized lists for blocking ads, trackers, malware and other garbage
• qilingframework/rtfd.io - Qiling Framework Documentation
• RPISEC/Malware - Course materials for Malware Analysis by RPISEC
• nomi-sec/PoC-in-GitHub - 📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
• rshipp/awesome-malware-analysis - Defund the Police.
• petoolse/petools - PE Tools - Portable executable (PE) manipulation toolkit
• umarfarook882/drakvuf_console_beta - Automate Malware Analysis using Drakvuf and Extract IOC from drakvuf log using Drakvuf Console (Log Analysis Toolkit) build on electronjs
• jgru/ansible-drakvuf - Ansible role to install the black-box binary analysis DRAKVUF
• Hack-with-Github/Awesome-Hacking - A collection of various awesome lists for hackers, pentesters and security researchers
• radareorg/awesome-radare2 - A curated list of awesome projects, articles and the other materials powered by Radare2
• ThomasThelen/OllyDbg-Scripts - Unpacking scripts for Ollydbg.
• zoidbergwill/awesome-ebpf - A curated list of awesome projects related to eBPF.
• wcventure/FuzzingPaper - Recent Fuzzing Paper
• strongcourage/awesome-directed-fuzzing - A curated list of awesome directed fuzzing research papers
• madawei2699/awesome-seo - Google SEO Research and Web Traffic Monetization
• tom0li/collection-document - Collection of quality safety articles. Awesome articles.
• secfigo/Awesome-Fuzzing - A curated list of fuzzing resources ( Books, courses - free and paid, videos, tools, tutorials and vulnerable applications to practice on ) for learning Fuzzing and initial phases of Exploit Development like root cause analysis.
• m1ghtym0/browser-pwn - An updated collection of resources targeting browser-exploitation.
• WinMin/awesome-vm-exploit - share some useful archives about vm and qemu escape exploit.
• OsandaMalith/ApiMon - A simple API monitor for Windbg
• nahamsec/Resources-for-Beginner-Bug-Bounty-Hunters - A list of resources for those interested in getting started in bug bounties
• jwx0539/hackingLibrary - ‪APT,‬ ‪Cyber warfare,‬ ‪Penetration testing,‬ ‪Zero-day,Exploiting,‬ ‪Spyware,Malwares evade anti-virus detection,‬ ‪Rookit CYPTER,‬ ‪Antiviruses Bypassing-av,‬ ‪WORMS,Sandbox-Escape,‬ ‪Memory-injection,‬ ‪Ethical,Gray,White,RedTeam‬...
• jivoi/awesome-osint - 😱 A curated list of amazingly awesome OSINT
• lengjibo/ATT-CK-CN - ATT&CK实操
• RedDrip7/APT_Digital_Weapon - Indicators of compromise (IOCs) collected from public resources and categorized by Qi-AnXin.
• kbandla/APTnotes - Various public documents, whitepapers and articles about APT campaigns
• aptnotes/data - APTnotes data
• riscv-non-isa/riscv-asm-manual - RISC-V Assembly Programmer's Manual
• forthespada/CS-Books - 🔥🔥超过1000本的计算机经典书籍、个人笔记资料以及本人在各平台发表文章中所涉及的资源等。书籍资源包括C/C++、Java、Python、Go语言、数据结构与算法、操作系统、后端架构、计算机系统知识、数据库、计算机网络、设计模式、前端、汇编以及校招社招各种面经~
• learn-anything/books - Awesome Books
• fuhmmin/it-ebooks-cn - 计算机电子书pdf整理
• itdevbooks/pdf - 编程电子书，电子书，编程书籍，包括C，C#，Docker，Elasticsearch，Git，Hadoop，HeadFirst，Java，Javascript，jvm，Kafka，Linux，Maven，MongoDB，MyBatis，MySQL，Netty，Nginx，Python，RabbitMQ，Redis，Scala，Solr，Spark，Spring，SpringBoot，SpringCloud，TCPIP，Tomcat，Zookeeper，人工智能，大数据类，并发编程，数据库类，数据挖掘，新面试题，架构设计，算法系列，计算机类，设计模式，软件测试，重构优化，等更多分类
• riscvarchive/riscv-cores-list - RISC-V Cores, SoC platforms and SoCs
• justjavac/free-programming-books-zh_CN - 📚 免费的计算机编程类中文书籍，欢迎投稿
• ramesht007/Secure_Multi_Party_computation - My notes for secure multi party computation. Still in progress.......................
• steedos/awesome-low-code - Awesome Low-Code Application Platforms | 全球低代码平台开发资源大全
• rdragos/awesome-mpc - A curated list of multi party computation resources and links.
• trimstray/the-book-of-secret-knowledge - A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and more.
• ukncsc/zero-trust-architecture - Principles to help you design and deploy a zero trust architecture
• pomerium/awesome-zero-trust - A curated collection of awesome resources for the zero-trust security model.
• caesar0301/awesome-pcaptools - A collection of tools developed by other researchers in the Computer Science area to process network traces. All the right reserved for the original authors.
• redhuntlabs/Awesome-Asset-Discovery - List of Awesome Asset Discovery Resources
• Bypass007/Safety-Project-Collection - 收集一些比较优秀的开源安全项目，以帮助甲方安全从业人员构建企业安全能力。
• alphaSeclab/awesome-reverse-engineering - Reverse Engineering Resources About All Platforms(Windows/Linux/macOS/Android/iOS/IoT) And Every Aspect! (More than 3500 open source tools and 2300 posts&videos)
• JiapengLi/OpenWrt-luci-app-ser2net - Add ser2net service to OpenWrt LuCI.
• Security-Onion-Solutions/security-onion - Security Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management
• blaCCkHatHacEEkr/PENTESTING-BIBLE - Learn ethical hacking.Learn about reconnaissance,windows/linux hacking,attacking web technologies,and pen testing wireless networks.Resources for learning malware analysis and reverse engineering.
• vitalysim/Awesome-Hacking-Resources - A collection of hacking / penetration testing resources to make you better!
• enaqx/awesome-pentest - A collection of awesome penetration testing resources, tools and other shiny things
• amusi/daily-paper-computer-vision - 记录每天整理的计算机视觉/深度学习/机器学习相关方向的论文
• analogdevicesinc/plutosdr-m2k-drivers-win - Windows USB drivers for PlutoSDR and ADALM2000
• smeathers/lede-pi0w-usb - Getting USB Ethernet working on the Pi0w with an install of LEDE
• timvideos/HDMI2USB-numato-opsis-hardware - The Numato Opsis board is the first fully open source HDMI2USB board.
• rpasek/usbip-wsl2-instructions -
• kuba-moo/mt7601u - Linux mac80211-based driver for Mediatek MT7601U USB bgn WiFi dongle
• chris1111/Wireless-USB-Adapter-Clover - Visit BLOG : https://com-chris1111.github.io
• asnyatkov/difi - Windows disk filter driver to demonstrate sector write redirection
• membership/membership.db - SQL database schema boilerplate for user accounts, roles and authentication tokens for use in web apps (PostgreSQL, Microsoft SQL Server, Azure SQL Database, LocalDb, SQLite)
• telerik/kendo-react-kb - A collection of Knowledge base articles for KendoReact.
• xitu/gold-miner - 🥇掘金翻译计划，可能是世界最大最好的英译中技术社区，最懂读者和译者的翻译平台：
• xibosignage/xibo - Xibo Digital Signage
• OpenESignForms/openesignforms - Open eSignForms is the first open source SaaS web contracting platform

PHP

• ijry/uiadmin - UiAdmin是一套渐进式模块化开源后台，采用前后端分离技术，数据交互采用json格式，功能低耦合高内聚；核心模块支持系统设置、权限管理、用户管理、菜单管理、API管理等功能；我们按照统一的API风格，开发了支持spring-boot3.0、Flask、Express、thinkphp6.0、laravel9.0、Hyperf3.0版本的后端实现。
• Processus-Thief/ETWMonitor - Windows notifier tool that detects suspicious connections by monitoring ETW event logs
• zhuifengshaonianhanlu/pikachu - 一个好玩的Web安全-漏洞测试平台
• FOGProject/fogproject - An open source computer cloning & management system
• danielmiessler/SecLists - SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
• gr33ntii/malware-collection -
• wpengine/frost - An experimental block-based WordPress theme for designers, developers, and creators. Brought to you by WP Engine Developer Relations.
• opnsense/core - OPNsense GUI, API and systems backend
• pfsense/pfsense - Main repository for pfSense
• zabbix/zabbix - Real-time monitoring of IT components and services, such as networks, servers, VMs, applications and the cloud.
• poona/APIMiner - API Logger for Windows Executables
• fuzzdb-project/fuzzdb - Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.

Pascal

• rareMaxim/Delphi-Inter-Process-Communication - Автор Зорков Игорь.
• DelphiClubItalia/PKCS7Extractor - PKCS#7 Extractor library for Delphi
• DarkCoderSc/PsyloDbg - User-friendly Microsoft Windows Debugger for Malware Analysts.
• Hendi48/Magicmida - Themida unpacker
• Hildaboo/xorist - Xorist Ransomware Source Code
• CWBudde/ComPort-Library - COM Port Library for Delphi (fork from SourceForge)
• project-jedi/jcl - JEDI Code Library
• project-jedi/tools - Tools used by many projects
• project-jedi/jvcl - JEDI Visual Component Library
• project-jedi/jedi - JEDI common files
• lawrenceamer/0xsp-Mongoose - a unique framework for cybersecurity simulation and red teaming operations, windows auditing for newer vulnerabilities, misconfigurations and privilege escalations attacks, replicate the tactics and techniques of an advanced adversary in a network.
• michaliskambi/modern-pascal-introduction - Modern Object Pascal Introduction for Programmers, in AsciiDoc
• MarcoDelphiBooks/ObjectPascalHandbook104 - Object Pascal Handbook for Delphi 10.4 Sydney demos source code
• PacktPublishing/Fearless-Cross-Platform-Development-with-Delphi - Fearless Cross-Platform Development with Delphi, published by Packt
• PacktPublishing/Delphi-GUI-Programming-with-FireMonkey - Delphi GUI Programming with FireMonkey, published by Packt
• kryslt/KControls - Free components for Delphi and Lazarus, this is the main repository maintained by the original author.
• Safrad/Sx-Library - Library/Framework for Delphi Applications
• Pigrecos/Keras4Delphi - Keras4Delphi is a high-level neural networks API, written in Pascal with Python Binding
• VSoftTechnologies/VSoft.Awaitable - Async/Await for Delphi
• TurboPack/Essentials - Essentials contains 13 native VCL controls for Embarcadero Delphi and C++Builder. The controls include drop-down calendars and calculators, roll-up dialogs, 3-D labels, tiled backgrounds, scrolling messages, menu buttons, and more.
• eversonturossi/delphi -
• beNative/LogViewer - A multi-purpose logviewer
• jackdp/JPLib - A library of general-purpose pascal units needed to compile my projects published on GitHub.
• digao-dalpiaz/DzTalkApp - Delphi non-visual component to communicate between applications
• PacktPublishing/Hands-On-Design-Patterns-with-Delphi - Hands-On-Design-Patterns-with-Delphi, published by Packt
• norgepaul/DelphiKafkaClient - Apache Kafka Client for Delphi
• ezequieljuliano/Security4Delphi - Enables and use of the concept of security in your Delphi applications
• EtheaDev/VCLThemeSelector - Easy and elegant preview/selection of Theme (Light or Dark) for VCL apps
• WouterVanNifterick/delphi-shader - Hundreds of graphical effects, and a library that provides GLSL functionality in pure Delphi code
• beNative/dduce - DDuce library for Delphi
• dokan-dev/dokan-delphi - Dokan Delphi Wrapper
• gmurt/PentireFMX - Firemonkey components for Delphi
• ezequieljuliano/Mailer4Delphi - For sending e-mails of any complexity in Delphi
• JordiCorbilla/atom-table-monitor - ⚛️ Monitoring tool for global atom table and RegisterWindowMessage identifiers
• JackTrapper/scrypt-for-delphi - Scrypt implementation for Delphi
• PacktPublishing/Delphi-Cookbook-Third-Edition - Delphi Cookbook, Third Edition, published by Packt
• MuminjonGuru/Mastering-FireMonkey-Delphi - ✨Embarcadero Delphi - 🔥FireMonkey Sample Applications - Prototypes for inspiration! 🧩
• CleverComponents/Task-Runner - This program serves for Software build automation, executing sequential tasks, including database backup/restore, running SQL scripts, Windows shell commands, Pascal scripts, passing variables through the whole task execution chain, and many more. You can set up a list of global parameters, such as Delphi application path, and use these parameters in tasks. You can even call a separated task chain from another task in the same way as you call Delphi procedure or a function, with passing parameters.
• mikerabat/mrmath - Delphi matrix library
• HemulGM/Components - HGM components for Delphi
• ying32/liblcl - A common cross-platform GUI library, the core uses Lazarus LCL.
• Alexey-T/ATFlatControls - Controls for Delphi/Lazarus, used in CudaText: ATTabs, ATButton, ATListbox, ATScrollbar, ATStatusbar, ATGroups, ATGauge
• EtheaDev/InstantObjects - Pupular OOP-OPF Library for Delphi (from D2010 to 11 Alexandria)
• TurboPack/SysTools - SysTools is a library of utility routines & classes for Embarcadero Delphi and C++Builder.
• TurboPack/AsyncPro - Async Professional is a comprehensive communications toolkit for Embarcadero Delphi and C++Builder.
• pavkam/tzdb - Delphi/FPC Time Zone Database
• ideasawakened/DelphiKB - Delphi reference info
• Wosi/DirectoryWatcher - Watch changes in directories
• exilon/QuickCore - Delphi Core Framework to fast build desktop/mobile/web apps.
• digao-dalpiaz/Dam - Delphi and Lazarus Message Dialogs with Formatted Text
• galfar/imaginglib - Object Pascal image loading, saving and manipulation library.
• jackdp/JPPack - A collection of VCL/LCL components for Delphi/Lazarus - buttons, panels, LinkLabel, ProgressBar, ColorComboBox, ColorListBox, Timer and other
• UweRaabe/PngComponents - PngComponents for Delphi 2009 and higher
• TurboPack/PowerPDF - PowerPdf is a VCL component to create PDF docment visually. Like Forms, you can design PDF document easily on Delphi or C++Builder IDE.
• tonghoangvu/DelphiUCL - The new version of Delphi Universal Component Library
• juliosenha/mail4delphi - Mail4Delphi uses the Indy component to send the email.
• Purik/AIO - Coroutine-based multithreading library for Delphi
• RRUZ/blog - Source code for the posts of my blog https://theroadtodelphi.com/
• RRUZ/delphi-ide-theme-editor - Custom color highlighting for Object Pascal IDE's
• maickonn/AllaKore_Remote - Remote access written in Delphi.
• delphilite/Activator - Delphi Activator for lite/repack setup
• delphilite/DelphiHookUtils - Delphi Hooking Library by Lsuper
• rzaripov1990/ModernListView - [FireMonkey] Modern ListView - Colorizer, Vertical\Horizontal mode, Columns and other
• Delphier/DxAutoInstaller - DevExpress VCL Components Automatic Installer
• ATGH15102AFMLD/Linkbar - Windows desktop toolbar
• RRUZ/delphi-dev-shell-tools - Shell Extension for Delphi and Object Pascal Developers
• tondrej/chakracore-delphi - Delphi and Free Pascal bindings and classes for Microsoft's ChakraCore library
• TurboPack/LockBox3 - LockBox3 is a Delphi and C++Builder library for cryptography.
• Xor-el/CryptoLib4Pascal - Crypto for Modern Object Pascal
• fortesinformatica/fortesreport-ce - The FortesReport is a powerful report generator available as a package of components for Delphi. In FortesReport, the reports are composed of bands that have specific functions in the print stream. You define groupings, sublevels and totals simply by hierarchical relationship between bands. Moreover, the FortesReport has a rich palette of components for text, charts, formulas, bar codes, filters and layout.
• exilon/QuickLogger - Powerful and flexible library for logging on files, console, memory, email, rest, eventlog, syslog, slack, telegram, redis, logstash, elasticsearch, influxdb, graylog, Sentry, Twilio, ide debug messages and throw events for Delphi/Firemonkey/freepascal/.NET (Windows/Linux/OSX/IOS/Android).
• VSoftTechnologies/Delphi-Mocks - A Open Source Mocking framework for Delphi XE2 or later
• synopse/SynPDF - Synopse PDF engine is a fully featured Open Source PDF document creation library for Delphi, embedded in one unit
• fundamentalslib/fundamentals5 - Fundamentals 5 Code Library for FreePascal and Delphi
• cnpack/cnvcl - CnPack VCL Components
• skia4delphi/skia4delphi - Skia4Delphi is a cross-platform 2D graphics API for Delphi platforms based on Google's Skia Graphics Library. It provides a comprehensive 2D API that can be used across mobile, server and desktop models to render images.
• DelphiWorlds/Kastri - Cross-platform library for Delphi
• paolo-rossi/delphi-jose-jwt - Delphi implementation of JOSE (JSON Object Signing and Encryption) and JWT (JSON Web Token)
• ahausladen/JsonDataObjects - JSON parser for Delphi 2009 and newer
• spinettaro/delphi-event-bus - Delphi Event Bus (for short DEB) is an Event Bus framework for Delphi
• viniciussanchez/dataset-serialize - JSON to DataSet and DataSet to JSON converter for Delphi and Lazarus (FPC)
• exilon/QuickLib - Quick development library (AutoMapper, LinQ, IOC Dependency Injection, MemoryCache, Scheduled tasks, Json and Yml Config and Options pattern, Serializers, etc) with crossplatform support for Delphi/Firemonkey (Windows,Linux,OSX/IOS/Android) and freepascal (Windows/Linux).
• Spelt/ZXing.Delphi - ZXing Barcode Scanning object Pascal Library for Delphi VCL and Delphi Firemonkey
• SynEdit/SynEdit - SynEdit main project
• gabr42/OmniThreadLibrary - A simple and powerful multithreading library for Delphi
• rejetto/hfs2 - web based file server
• cnpack/cnwizards - CnPack IDE Wizards
• HashLoad/horse - Fast, opinionated, minimalist web framework for Delphi
• pyscripter/python4delphi - Free components that wrap up Python into Delphi and Lazarus (FPC)
• danieleteti/delphimvcframework - DMVCFramework (for short) is a popular and powerful framework for web solution in Delphi. Supports RESTful and JSON-RPC APIs development.
• salvadordf/CEF4Delphi - CEF4Delphi is an open source project to embed Chromium-based browsers in applications made with Delphi or Lazarus/FPC for Windows, Linux and MacOS.
• Fr0sT-Brutal/awesome-pascal - A curated list of awesome Delphi/FreePascal/(any)Pascal frameworks, libraries, resources, and shiny things. Inspired by awesome-... stuff. Open source and freeware only!
• TurboPack/Abbrevia - Abbrevia is a compression toolkit for Delphi and C++Builder.
• pleriche/FastMM5 - FastMM is a fast replacement memory manager for Embarcadero Delphi applications that scales well across multiple threads and CPU cores, is not prone to memory fragmentation, and supports shared memory without the use of external .DLL files.
• MahdiSafsafi/DDetours - Delphi Detours Library
• Embarcadero/Dev-Cpp - A fast, portable, simple, and free C/C++ IDE
• HeidiSQL/HeidiSQL - A lightweight client for managing MariaDB, MySQL, SQL Server, PostgreSQL, SQLite, Interbase and Firebird, written in Delphi
• HemulGM/LocalizeControls - FMX LocalizeControls (TEdit, TSpinEdit, etc.)
• teodor-krastev/Spectrion - Instrument control and data acquisition software system (Delphi)
• WouterVanNifterick/delphi-GSDK - Control your Logitech devices from a Delphi application
• devlephant/TGraphicWinControl - WinControl with TGraphicControl abilities
• Douglas09/RouteControl - Visando problemas de controle de gerenciamento de formulários abertos no projeto delphi para aplicativos mobile principalmente, decidi implementar algo próximo as rotas existentes hoje em algumas linguagens web.
• SileideCampos88/SmatwatchControllingDevices - Applications for Smartwatch to control many IOT devices.
• sefcom/honeyplc - High-interaction Honeypot for PLCs and Industrial Control Systems
• TextEditorPro/TTextEditor - Text editor control of Text Editor Pro and Firebird Editor Pro.
• TurboPack/VirtualTreeView - Virtual Treeview is a Delphi treeview control built from ground up. Many years of development made it one of the most flexible and advanced tree controls available today. Virtual Treeview starts off with the claim to improve many aspects of existing solutions and introduces some new technologies and principles which were not available before.
• tonghoangvu/UniversalCL - UWP controls for Delphi VCL
• MahdiSafsafi/zControls - zControls
• Steema/TeeGrid-VCL-FMX-Samples - Grid control for Delphi and C++ (VCL and FMX)
• RRUZ/vcl-styles-utils - Extend and improve the Delphi VCL Styles
• JAM-Software/RibbonFramework - Delphi wrapper and standalone Designer for the Windows Ribbon Framework
• JAM-Software/Virtual-TreeView - Virtual Treeview is a Delphi treeview control
• MagicFoundation/Alcinoe - Alcinoe Component Library For Delphi. Full opengl video player, WebRTC delphi wrapper, native ios/android TEdit, Improuved firemonkey controls, Firebase cloud messaging, Android/ios facebook sdk login, Json/Bson Parser, ImageMagick wrapper, MongoDb client And much more
• GooD-NTS/nts-code-suite - NTS Code suite (CodeLibrary and Aero UI controls for Delphi)
• rareMaxim/FluentUI - Delphi Fluent UI
• tranquilit/pltis_uicomponents -
• diversenok/VclEx - Enhanced VCL components
• diversenok/NtTools - Some random system tools for Windows
• diversenok/NtUtilsUI - VCL-based UI components for system tools that use NtUtilsLibrary
• apiUi/apiUi -
• xubzhlin/FMX-UI-Controls - Some Firemonkey UI Controls By Myself
• supersoho/Delphi-DirectUI - Delphi DirectUI Controls
• TurboPack/Orpheus - Orpheus is an award-winning UI toolkit for Embarcadero Delphi & C++Builder
• jhc-systems/DelphiUIAutomation - Delphi classes the wrap the MS UIAutomation library
• bgrabitmap/bgracontrols - 🆗 BGRA Controls is a set of graphical UI elements that you can use with Lazarus LCL applications.
• yangyxd/FMXUI - FMX跨平台基础UI库
• andrea-magni/TFrameStand - TFrameStand and TFormStand components for Delphi FireMonkey (FMX)
• solodyagin/MsnPopup - FreePascal component based on MsnPopup
• 0xsp-SRD/mortar - evasion technique to defeat and divert detection and prevention of security products (AV/EDR/XDR)
• MartinDrab/IRPMon - The goal of the tool is to monitor requests received by selected device objects or kernel drivers. The tool is quite similar to IrpTracker but has several enhancements. It supports 64-bit versions of Windows (no inline hooks are used, only moodifications to driver object structures are performed) and monitors IRP, FastIo, AddDevice, DriverUnload and StartIo requests.
• zyantific/zydis-pascal - Zydis Pascal Bindings
• diversenok/Kernel-Bridge-Delphi-Connector - A library for using user-mode side of Kernel Bridge with Delphi.
• diversenok/NtUtilsLibrary - Delphi library for system programming on Windows using Native API
• diversenok/Suspending-Techniques - Comparing, discussing, and bypassing various techniques for suspending and freezing processes on Windows.
• diversenok/ExecutionMaster - Windows utility for intercepting process creation and assigning standard actions to program startup
• yegor-mialyk/far-plugins - Far Manager Plugins and Libraries
• diversenok/TransactionMaster - A tool for Windows that can make any program work within file-system transactions.
• miracle2k/ntfslink - A set of Windows Shell Extensions, providing extended functionality for creating and using hard links and junction points on NTFS file systems.
• NeftaliDelphi/GLibWMI - GLibWMI is a Delphi library of components, focused on the Administration of Windows Systems. They are based on Windows WMI (Windows Management Instrumentation). GLibWMI es una librería/biblioteca de componentes para Delphi, enfocados a la Administración de Sistemas Windows. Están basados en la WMI de Windows (Windows Management Instrumentation).
• Coldzer0/Cmulator - Cmulator is ( x86 - x64 ) Scriptable Reverse Engineering Sandbox Emulator for shellcode and PE binaries . Based on Unicorn & Zydis Engine & javascript
• neslib/Chet - C Header Translator for Delphi
• EtheaDev/SVGIconImageList - Four advanced components to simplify use of SVG images and SVG icons into ImageList: TSVGIconImage, TSVGIconImageCollection, TSVGIconVirtualImageList, TSVGIconImageList (for VCL and FMX). Choose the preferred engine to render SVG (Delphi Image32, Delphi TSVG, SKIA4Delphi, Direct2D);
• BoscoBecker/Delphi-and-Google-Authenticator - 2-step verification greatly increases the security of your account, especially if your password is stolen. But how about adding this functionality to your Delphi application?
• wendelb/DelphiOTP - OTP (RFC 4226, same as Google is using) for Delphi
• FMXExpress/Cross-Platform-Samples - Delphi FireMonkey demos and examples for Android, IOS, MacOS, Windows, Linux, HTML5
• caowm/DA-His - 一套完整的HIS，基于Delphi RemObjects DataAbstract开发，以Schema为中心
• PassByYou888/ZServer4D - ZServer4D 是一套从商业项目剥离而出的云服务器中间件，可以承载百万级的分布式负载服务，并且支持IoT及内网穿透
• nikitayev/com2tcp_gui -
• ahausladen/PdfiumLib - PDF VCL Control using PDFium

Perl

• htrgouvea/nipe - An engine to make Tor network your default gateway
• mikaku/Monitorix - Monitorix is a free, open source, lightweight system monitoring tool.
• ipfire/ipfire-2.x - IPFire 2.x development tree
• Zimbra/zm-build - zm-build for Zimbra Collaboration Suite, FOSS Edition

PowerShell

• sans-blue-team/DeepBlueCLI -
• mgeeky/ProtectMyTooling - Multi-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts watermarking, IOCs collection & PE Backdooring. You feed it with your implant, it does a lot of sneaky things and spits out obfuscated executable.
• S3cur3Th1sSh1t/NamedPipePTH - Pass the Hash to a named pipe for token Impersonation
• mrhaydendp/RemoveEdge - Removes Microsoft Edge and makes sure it won't come back
• MicrosoftDocs/windows-itpro-docs - This repository is used for Windows client for IT Pro content on Microsoft Learn.
• mandiant/VM-Packages -
• developeer/wsl2-install - Enable and Install WSL2 Ubuntu 20.04 on Windows 10 1909 or above
• JoelGMSec/PSRansom - PowerShell Ransomware Simulator with C2 Server
• blackhillsinfosec/EventLogging - Automation scripts to deploy Windows Event Forwarding, Sysmon, and custom audit policies in an Active Directory environment.
• AutomatedLab/AutomatedLab - AutomatedLab is a provisioning solution and framework that lets you deploy complex labs on HyperV and Azure with simple PowerShell scripts. It supports all Windows operating systems from 2008 R2 to 2022, some Linux distributions and various products like AD, Exchange, PKI, IIS, etc.
• scythe-io/community-threats - A place to share attack chains for testing people, process, and technology with the entire community. The largest, public library of adversary emulation and adversary simulation plans! #ThreatThursday
• d0nkeys/redteam - Red Team Scripts by d0nkeys (ex SnadoTeam)
• Mr-Un1k0d3r/RedTeamPowershellScripts - Various PowerShell scripts that may be useful during red team exercise
• JoelGMSec/AutoRDPwn - The Shadow Attack Framework
• Arvanaghi/SessionGopher - SessionGopher is a PowerShell tool that uses WMI to extract saved session information for remote access tools such as WinSCP, PuTTY, SuperPuTTY, FileZilla, and Microsoft Remote Desktop. It can be run remotely or locally.
• threatexpress/red-team-scripts - A collection of Red Team focused tools, scripts, and notes
• nccgroup/redsnarf - RedSnarf is a pen-testing / red-teaming tool for Windows environments
• BankSecurity/Red_Team - Some scripts useful for red team activities
• leebaird/discover - Custom bash scripts used to automate various penetration testing tasks including recon, scanning, enumeration, and malicious payload creation using Metasploit. For use with Kali Linux.
• Gerenios/AADInternals - AADInternals PowerShell module for administering Azure AD and Office 365
• NetSPI/MicroBurst - A collection of scripts for assessing Microsoft Azure security
• FortyNorthSecurity/Egress-Assess - Egress-Assess is a tool used to test egress data detection capabilities
• Kevin-Robertson/Invoke-TheHash - PowerShell Pass The Hash Utils
• NetSPI/PowerUpSQL - PowerUpSQL: A PowerShell Toolkit for Attacking SQL Server
• HarmJ0y/DAMP - The Discretionary ACL Modification Project: Persistence Through Host-based Security Descriptor Modification
• hlldz/Phant0m - Windows Event Log Killer
• rsmudge/ElevateKit - The Elevate Kit demonstrates how to use third-party privilege escalation attacks with Cobalt Strike's Beacon payload.
• adrecon/ADRecon - ADRecon is a tool which gathers information about the Active Directory and generates a report which can provide a holistic picture of the current state of the target AD environment.
• l0ss/Grouper - A PowerShell script for helping to find vulnerable settings in AD Group Policy. (deprecated, use Grouper2 instead!)
• vletoux/MakeMeEnterpriseAdmin -
• GhostPack/PSPKIAudit - PowerShell toolkit for AD CS auditing based on the PSPKI toolkit.
• BC-SECURITY/Empire - Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers.
• nyxgeek/o365recon - retrieve information via O365 and AzureAD with a valid cred
• mgeeky/AzureRT - AzureRT - A Powershell module implementing various Azure Red Team tactics
• Yamato-Security/WELA - WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）
• mantvydasb/RedTeaming-Tactics-and-Techniques - Red Teaming Tactics and Techniques
• AlsidOfficial/WSUSpendu - Implement WSUSpendu attack
• nettitude/PoshC2 - A proxy aware C2 framework used to aid red teamers with post-exploitation and lateral movement.
• waldo-irc/YouMayPasser - You shall pass
• gtworek/PSBits - Simple (relatively) things allowing you to dig a bit deeper than usual.
• redcanaryco/atomic-red-team - Small and highly portable detection tests based on MITRE's ATT&CK.
• PwnDexter/Invoke-EDRChecker - Checks running processes, process metadata, Dlls loaded into your current process and the each DLLs metadata, common install directories, installed services, the registry and running drivers for the presence of known defensive products such as AV's, EDR's and logging tools.
• alexverboon/PSMDATP - PowerShell Module for managing Microsoft Defender Advanced Threat Protection
• alexverboon/MDATP - Microsoft 365 Defender - Resource Hub
• Azure/Microsoft-Defender-for-Cloud - Welcome to the Microsoft Defender for Cloud community repository
• mandiant/flare-vm -
• netsecninja/DFIR-Lab - PowerShell script to automate most of the install of my DFIR lab VM
• SentineLabs/SentinelLabs_RevCore_Tools - The Windows Malware Analysis Reversing Core Tools
• giMini/Tartarus - Fileless Ransomware Example
• Viralmaniar/Phirautee - A proof of concept crypto virus to spread user awareness about attacks and implications of ransomwares. Phirautee is written purely using PowerShell and does not require any third-party libraries. This tool steals the information, holds an organisation’s data to hostage for payments or permanently encrypts/deletes the organisation data.
• cryps1s/DARKSURGEON - DARKSURGEON is a Windows packer project to empower incident response, digital forensics, malware analysis, and network defense.
• itglueguy/NTFS-Security-Auditing-with-Powershell - ntfs security auditing with powershell
• ToddMaxey/Measure-NTFS-USN-consumption - Powershell script to query the NTFS USN journal to determine if you have a high USN consumption rate.
• peasead/windows-sandbox-to-elastic - Rapidly building a Windows 10 system to use for dynamic malware analysis (sandbox), sending data to Elastic Cloud.
• mgeeky/cobalt-arsenal - My collection of battle-tested Aggressor Scripts for Cobalt Strike 4.0+
• mgeeky/Penetration-Testing-Tools - A collection of more than 170+ tools, scripts, cheatsheets and other loots that I've developed over years for Red Teaming/Pentesting/IT Security audits purposes.
• microsoft/MSTIC-Sysmon - Anything Sysmon related from the MSTIC R&D team
• mattifestation/BHUSA2018_Sysmon - All materials from our Black Hat 2018 "Subverting Sysmon" talk
• AustralianCyberSecurityCentre/windows_event_logging - Windows Event Forwarding subscriptions, configuration files and scripts that assist with implementing ACSC's protect publication, Technical Guidance for Windows Event Logging.
• ion-storm/sysmon-edr - Sysmon EDR POC Build within Powershell to prove ability.
• olafhartong/sysmon-modular - A repository of sysmon configuration modules
• HarmJ0y/PowerUp - This version of PowerUp is now unsupported. See https://github.com/Veil-Framework/PowerTools/tree/master/PowerUp for the most current version.
• itm4n/PrivescCheck - Privilege Escalation Enumeration Script for Windows
• k8gege/K8tools - K8工具合集(内网渗透/提权工具/远程溢出/漏洞利用/扫描工具/密码破解/免杀工具/Exploit/APT/0day/Shellcode/Payload/priviledge/BypassUAC/OverFlow/WebShell/PenTest) Web GetShell Exploit(Struts2/Zimbra/Weblogic/Tomcat/Apache/Jboss/DotNetNuke/zabbix)
• informatici/openhospital - OH - Open Hospital is a free and open-source Electronic Health Record (EHR) software application. This repository is used to build its releases.
• microsoft/winget-pkgs - The Microsoft community Windows Package Manager manifest repository
• BloodHoundAD/BloodHound - Six Degrees of Domain Admin
• mandiant/ThreatPursuit-VM - Threat Pursuit Virtual Machine (VM): A fully customizable, open-sourced Windows-based distribution focused on threat intelligence analysis and hunting designed for intel and malware analysts as well as threat hunters to get up and running quickly.
• mandiant/commando-vm - Complete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based pentesting virtual machine distribution. [email protected]
• damienvanrobaeys/Run-in-Sandbox - Run PS1, VBS, EXE, MSI in Windows Sandbox very quickly just from a right-click
• damienvanrobaeys/Windows_Sandbox_Editor - Generate and manage your windows sandbox
• nbeede/BoomBox - Automatic deployment of Cuckoo Sandbox malware lab using Packer and Vagrant
• Azure/Cloud-Katana - Unlocking Serverless Computing to Assess Security Controls
• microsoft/Windows-Sandbox-Utilities - A public repository for useful developments surrounding Windows Sandbox
• dafthack/MailSniper - MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.). It can be used as a non-administrative user to search their own email, or by an administrator to search the mailboxes of every user in a domain.
• samratashok/nishang - Nishang - Offensive PowerShell for red team, penetration testing and offensive security.

Python

• OpenEthan/SMSBoom - 短信轰炸/短信测压/ | 一个健壮免费的python短信轰炸程序，专门炸坏蛋蛋，百万接口，多线程全自动添加有效接口，支持异步协程百万并发，全免费的短信轰炸工具！！hongkonger开发全网首发！！
• wagga40/Zircolite - A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
• t3l3machus/psudohash - Password list generator that focuses on keywords mutated by commonly used password creation patterns
• SaumyajeetDas/GodGenesis - A Python3 based C2 server to make life of red teamer a bit easier. The payload is capable to bypass all the known antiviruses and endpoints.
• MatrixTM/MHDDoS - Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 56 Methods
• bellingcat/octosuite - Advanced Github OSINT Framework
• t3l3machus/Villain - Villain is a Windows & Linux backdoor generator and multi-session handler that allows users to connect with sibling servers (other machines running Villain) and share their backdoor sessions, handy for working as a team.
• cloud-custodian/cloud-custodian - Rules engine for cloud security, cost optimization, and governance, DSL in yaml for policies to query, filter, and take actions on resources
• tp7309/TTDeDroid - 一键反编译工具(不需要手动安装Python) One key for quickly decompile apk/aar/dex/jar, support by jadx/dex2jar/enjarify.
• LAION-AI/Open-Assistant - OpenAssistant is a chat-based assistant that understands tasks, can interact with third-party systems, and retrieve information dynamically to do so.
• target/strelka - Real-time, container-based file scanning at enterprise scale
• nicolargo/glances - Glances an Eye on your system. A top/htop alternative for GNU/Linux, BSD, Mac OS and Windows operating systems.
• root-tanishq/userefuzz - User-Agent , X-Forwarded-For and Referer SQLI Fuzzer
• Crypto-Cat/CTF - CTF chall write-ups, files, scripts etc (trying to be more organised LOL)
• prodaft/malware-ioc - This repository contains indicators of compromise (IOCs) of our various investigations.
• bitsadmin/wesng - Windows Exploit Suggester - Next Generation
• Orange-Cyberdefense/KeePwn - A python tool to automate KeePass discovery and secret extraction.
• gurnec/btcrecover - An open source Bitcoin wallet password and seed recovery tool designed for the case where you already know most of your password/seed, but need assistance in trying different possible combinations.
• Seb2lyon/BTCscan - Python script to discover BTC strings in files
• efchatz/WPAxFuzz - A full-featured open-source Wi-Fi fuzzer
• Te-k/cobaltstrike - Code and yara rules to detect and analyze Cobalt Strike
• cisagov/Malcolm - Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
• idank/explainshell - match command-line arguments to their help text
• zblurx/acltoolkit - ACL abuse swiss-knife
• wormhole-foundation/wormhole-token-list -
• pan-unit42/public_tools -
• snapattack/bpfdoor-scanner - BPFDoor Scanner - Check for Compromised Hosts
• matthw/malware_analysis -
• mhaskar/DNSKeyGen - A tool to exchange decryption keys for command and control (C2) beacons and implants through DNS records.
• MEhrn00/Ghidra_COFFParser - Ghidra script which fully parses COFF files
• MWR-CyberSec/PXEThief - PXEThief is a set of tooling that can extract passwords from the Operating System Deployment functionality in Microsoft Endpoint Configuration Manager
• Alexey-T/CudaText - Cross-platform text editor, written in Lazarus
• freedomofpress/dangerzone - Take potentially dangerous PDFs, office documents, or images and convert them to safe PDFs
• 0xricksanchez/like-dbg - Fully dockerized Linux kernel debugging environment
• Tencent/CodeAnalysis - Static Code Analysis - 静态代码分析
• privtools/ransomposts - Ransomware groups posts
• kovidgoyal/calibre - The official source code repository for the calibre ebook manager
• ShadowWhisperer/Remove-Edge-Chromium - Uninstall Microsoft Edge silently, through an executable or batch script.
• SigmaHQ/sigma-cli - The Sigma command line interface based on pySigma
• frej/fast-export - A mercurial to git converter using git-fast-import
• fail2ban/fail2ban - Daemon to ban hosts that cause multiple authentication errors
• nalepae/pandarallel - A simple and efficient tool to parallelize Pandas operations on all available CPUs
• klezVirus/SysWhispers3 - SysWhispers on Steroids - AV/EDR evasion via direct system calls.
• Sentinel-One/peafl64 - Static Binary Instrumentation tool for Windows x64 executables
• naksyn/Pyramid - a tool to help operate in EDRs' blind spots
• platformio/platformio-core - A professional collaborative platform for embedded development 👽
• dmitriykuptsov/soho-vpn-over-tls - Routing SOHO traffic through TLS VPN
• tickbh/luojiawaf_server - luojia waf openresty Web Application Firewall or API Gateway(应用防火墙/API网关)
• kiteco/intellij-plugin - Kite IntelliJ plugin
• paranoidninja/CarbonCopy - A tool which creates a spoofed certificate of any online website and signs an Executable for AV Evasion. Works for both Windows and Linux
• OALabs/hashdb - Assortment of hashing algorithms used in malware
• x0rz/EQGRP_Lost_in_Translation - Decrypted content of odd.tar.xz.gpg, swift.tar.xz.gpg and windows.tar.xz.gpg
• sensepost/impersonate - A windows token impersonation tool
• Anof-cyber/APTRS - Automated Penetration Testing Reporting System
• k4yt3x/orbitaldump - A simple multi-threaded distributed SSH brute-forcing tool written in Python
• wkentaro/gdown - Download a large file from Google Drive (curl/wget fails because of the security notice).
• x64dbg/x64dbgida - Official x64dbg plugin for IDA Pro.
• OALabs/PyIATRebuild - Automatically rebuild Import Address Table for dumped PE file. With python bindings!
• google/paranoid_crypto - Paranoid's library contains implementations of checks for well known weaknesses on cryptographic artifacts.
• hasherezade/mal_unpack_py - Python wrappers for mal_unpack
• vxunderground/ThreatIntelligenceDiscordBot - Gets updates from various clearnet domains and ransomware threat actor domains
• punk-security/dnsReaper - dnsReaper - subdomain takeover tool for attackers, bug bounty hunters and the blue team!
• redballoonsecurity/ofrak - OFRAK: unpack, modify, and repack binaries.
• microsoft/WSL - Issues found on WSL
• qsecure-labs/overlord - Overlord - Red Teaming Infrastructure Automation
• GhostManager/Ghostwriter - The SpecterOps project management and reporting engine
• loseys/BlackMamba - C2/post-exploitation framework
• TryCatchHCF/DumpsterFire - "Security Incidents In A Box!" A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue- & Red Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.
• p0dalirius/windows-coerced-authentication-methods - A list of methods to coerce a windows machine to authenticate to an attacker-controlled machine through a Remote Procedure Call (RPC) with various protocols.
• hasherezade/pe2pic - Small visualizator for PE files
• Ciphey/Ciphey - ⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡
• KasperskyLab/Apihashes - IDA Pro plugin for recognizing known hashes of API function names
• KasperskyLab/TinyCheck - TinyCheck allows you to easily capture network communications from a smartphone or any device which can be associated to a Wi-Fi access point in order to quickly analyze them. This can be used to check if any suspect or malicious communication is outgoing from a smartphone, by using heuristics or specific Indicators of Compromise (IoCs). In order to make it working, you need a computer with a Debian-like operating system and two Wi-Fi interfaces. The best choice is to use a Raspberry Pi (2+) a Wi-Fi dongle
• Bashfuscator/Bashfuscator - A fully configurable and extendable Bash obfuscation framework. This tool is intended to help both red team and blue team.
• GreatSCT/GreatSCT - The project is called Great SCT (Great Scott). Great SCT is an open source project to generate application white list bypasses. This tool is intended for BOTH red and blue team.
• bigb0sss/RedTeam-OffensiveSecurity - Tools & Interesting Things for RedTeam Ops
• lengjibo/RedTeamTools - 记录自己编写、修改的部分工具
• TryCatchHCF/Cloakify - CloakifyFactory - Data Exfiltration & Infiltration In Plain Sight; Convert any filetype into list of everyday strings, using Text-Based Steganography; Evade DLP/MLS Devices, Defeat Data Whitelisting Controls, Social Engineering of Analysts, Evade AV Detection
• threat9/routersploit - Exploitation Framework for Embedded Devices
• ztgrace/changeme - A default credential scanner.
• ihebski/DefaultCreds-cheat-sheet - One place for all the default credentials to assist the Blue/Red teamers activities on finding devices with default password 🛡️
• Trusted-AI/adversarial-robustness-toolbox - Adversarial Robustness Toolbox (ART) - Python Library for Machine Learning Security - Evasion, Poisoning, Extraction, Inference - Red and Blue Teams
• threatexpress/cs2modrewrite - Convert Cobalt Strike profiles to modrewrite scripts
• endgameinc/RTA -
• uber-common/metta - An information security preparedness tool to do adversarial simulation.
• dirkjanm/ROADtools - A collection of Azure AD tools for offensive and defensive security purposes
• Azure/Stormspotter - Azure Red Team tool for graphing Azure and Azure Active Directory objects
• fox-it/adconnectdump - Dump Azure AD Connect credentials for Azure AD and Active Directory
• andresriancho/enumerate-iam - Enumerate the permissions associated with AWS credential set
• RhinoSecurityLabs/pacu - The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.
• Porchetta-Industries/CrackMapExec - A swiss army knife for pentesting networks
• blackarrowsec/mssqlproxy - mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse
• Mr-Un1k0d3r/PowerLessShell - Run PowerShell command without invoking powershell.exe
• lgandx/Responder - Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.
• antonioCoco/SharPyShell - SharPyShell - tiny and obfuscated ASP.NET webshell for C# web applications
• sensepost/reGeorg - The successor to reDuh, pwn a bastion webserver and create SOCKS proxies through the DMZ. Pivot and pwn.
• blackarrowsec/pivotnacci - A tool to make socks connections through HTTP agents
• nccgroup/ABPTTS - TCP tunneling over HTTP/HTTPS for web application servers
• skelsec/pypykatz - Mimikatz implementation in pure Python
• AlessandroZ/LaZagne - Credentials recovery project
• outflanknl/RedELK - Red Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.
• 0xZDH/redirect.rules - Quick and dirty dynamic redirect.rules generator
• mdsecactivebreach/Chameleon - Chameleon: A tool for evading Proxy categorisation
• mgeeky/RedWarden - Cobalt Strike C2 Reverse proxy that fends off Blue Teams, AVs, EDRs, scanners through packet inspection and malleable profile correlation
• threatexpress/domainhunter - Checks expired domains for categorization/reputation and Archive.org history to determine good candidates for phishing and C2 domain names
• rvrsh3ll/FindFrontableDomains - Search for potential frontable domains
• n1nj4sec/pupy - Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) C2 and post-exploitation framework written in python and C
• its-a-feature/Mythic - A collaborative, multi-platform, red teaming framework
• mandiant/PwnAuth -
• therealsaumil/emux - EMUX Firmware Emulation Framework (formerly ARMX)
• sevagas/macro_pack - macro_pack is a tool by @EmericNasi used to automatize obfuscation and generation of Office documents, VB scripts, shortcuts, and other formats for pentest, demo, and social engineering assessments. The goal of macro_pack is to simplify exploitation, antimalware bypass, and automatize the process from malicious macro and script generation to final document generation. It also provides a lot of helpful features useful for redteam or security research.
• bats3c/darkarmour - Windows AV Evasion
• xforcered/InvisibilityCloak - Proof-of-concept obfuscation toolkit for C# post-exploitation tools
• 9emin1/charlotte - c++ fully undetected shellcode launcher ;)
• D00MFist/Mystikal - macOS Initial Access Payload Generator
• byt3bl33d3r/SprayingToolkit - Scripts to make password spraying attacks against Lync/S4B, OWA & O365 a lot quicker, less painful and more efficient
• vysecurity/LinkedInt - LinkedIn Recon Tool
• BishopFox/spoofcheck - Simple script that checks a domain for email protections
• rbsec/dnscan -
• superhedgy/AttackSurfaceMapper - AttackSurfaceMapper is a tool that aims to automate the reconnaissance process.
• opsdisk/pagodo - pagodo (Passive Google Dork) - Automate Google Hacking Database scraping and searching
• byt3bl33d3r/WitnessMe - Web Inventory tool, takes screenshots of webpages using Pyppeteer (headless Chrome/Chromium) and provides some extra bells & whistles to make life easier.
• initstring/linkedin2username - OSINT Tool: Generate username lists for companies on LinkedIn
• sham00n/buster - An advanced tool for email reconnaissance
• lanmaster53/recon-ng - Open Source Intelligence gathering tool aimed at reducing the time spent harvesting information from open sources.
• initstring/cloud_enum - Multi-cloud OSINT tool. Enumerate public resources in AWS, Azure, and Google Cloud.
• sa7mon/S3Scanner - Scan for open S3 buckets and dump the contents
• Z4nzu/hackingtool - ALL IN ONE Hacking Tool For Hackers
• apprenticeharper/DeDRM_tools - DeDRM tools for ebooks
• GamehunterKaan/AutoPWN-Suite - AutoPWN Suite is a project for scanning vulnerabilities and exploiting systems automatically.
• sshuttle/sshuttle - Transparent proxy server that works as a poor man's VPN. Forwards over ssh. Doesn't require admin. Works with Linux and MacOS. Supports DNS tunneling.
• Nefcore/CRLFsuite - The most powerful CRLF injection (HTTP Response Splitting) scanner.
• xdavidhu/awesome-google-vrp-writeups - 🐛 A list of writeups from the Google VRP Bug Bounty program
• user1342/DroidDetective - A machine learning malware analysis framework for Android apps.
• tropChaud/Categorized-Adversary-TTPs - Merge of two major cyber adversary datasets, MITRE ATT&CK and ETDA/ThaiCERT Threat Actor Cards, enabling victim/motivation-adversary-technique pivoting.
• synacktiv/canon-mf644 -
• samet-g/tornado - Anonymously Reverse Shell over Tor Network using Hidden services without Portforwarding.
• alex-cart/LEAF - Linux Evidence Acquisition Framework
• techgaun/github-dorks - Find leaked secrets via github search
• horizon3ai/CVE-2022-22972 -
• cckuailong/pocsploit - a lightweight, flexible and novel open source poc verification framework
• RhinoSecurityLabs/CVEs - A collection of proof-of-concept exploit scripts written by the team at Rhino Security Labs for various CVEs.
• Coalfire-Research/WinAPRS-Exploits - A collection of exploits, shellcode, and tools related to CVE-2022-24702
• binref/refinery - High Octane Triage Analysis
• jupyter/terminado - Terminals served by tornado websockets
• jupyter/jupyter - Jupyter metapackage for installation, docs and chat
• fortra/impacket - Impacket is a collection of Python classes for working with network protocols.
• MycroftAI/mycroft-core - Mycroft Core, the Mycroft Artificial Intelligence platform.
• ergrelet/unlicense - Dynamic unpacker and import fixer for Themida/WinLicense 2.x and 3.x.
• mhaskar/Octopus - Open source pre-operation C2 server based on python and powershell
• xepor/xepor - Xepor, a web routing framework for reverse engineers and security researchers, brings the best of mitmproxy & Flask
• inode-/zyxel_password_decrypter - Zyxel password decrypter
• nccgroup/ScoutSuite - Multi-Cloud Security Auditing Tool
• e-m-b-a/embark - EMBArk - The firmware security scanning environment
• polakow/CVE-2022-21907 - A REAL DoS exploit for CVE-2022-21907
• dievus/msImpersonate - msImpersonate - User account impersonation written in pure Python3
• smicallef/spiderfoot - SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.
• stackrox/kernel-packer - 📦 Crawl and repackage kernel headers for collector
• smarttang/w3a_SOC - 元豚科技 - 基于日志安全分析做切入，做最好用的「云原生安全运维工作台」
• cyberbutler/RedDrop - RedDrop is a quick and easy web server for capturing and processing encoded and encrypted payloads and tar archives.
• GrrrDog/weird_proxies - Reverse proxies cheatsheet
• horizon3ai/CVE-2021-38647 - Proof on Concept Exploit for CVE-2021-38647 (OMIGOD)
• alexforencich/verilog-axis - Verilog AXI stream components for FPGA implementation
• TheGeekHT/Loki.Rat - Loki.Rat is a fork of the Ares RAT, it integrates new modules, like recording , lockscreen , and locate options. Loki.Rat is a Python Remote Access Tool.
• 0xInfection/Awesome-WAF - 🔥 Web-application firewalls (WAFs) from security standpoint.
• jaysonlong/webvideo-downloader - Web video downloader for Bilibili, iQIYI, Tencent Video, MGTV and WeTV. 网站视频下载器，主要支持Bilibili、爱奇艺、腾讯视频、芒果TV、WeTV、愛奇藝台灣站。
• elastic/detection-rules - Rules for Elastic Security's detection engine
• FortyNorthSecurity/C2concealer - C2concealer is a command line tool that generates randomized C2 malleable profiles for use in Cobalt Strike.
• bluscreenofjeff/Malleable-C2-Randomizer - A script to randomize Cobalt Strike Malleable C2 profiles and reduce the chances of flagging signature-based detection controls
• cdong1012/IDAPython-Malware-Scripts -
• edgedb/edgedb - A graph-relational database with declarative schema, built-in migration system, and a next-generation query language
• bloomberg/memray - Memray is a memory profiler for Python
• arthaud/git-dumper - A tool to dump a git repository from a website
• mandiant/thiri-notebook - The Threat Hunting In Rapid Iterations (THIRI) Jupyter notebook is designed as a research aide to let you rapidly prototype threat hunting rules.
• offsecginger/koadic - zerosum0x0's Koadic
• guelfoweb/knock - Knock Subdomain Scan
• JannisKirschner/SymbolicExecutionDemystified - Slides and Material for "SymbolicExecutionDemystified" Presentation @ Insomni'Hack 2022
• corelan/mona - Corelan Repository for mona.py
• corelan/windbglib - Public repository for windbglib, a wrapper around pykd.pyd (for Windbg), used by mona.py
• tf-encrypted/tf-encrypted - A Framework for Encrypted Machine Learning in TensorFlow
• facebookresearch/minihack - MiniHack the Planet: A Sandbox for Open-Ended Reinforcement Learning Research
• facebookresearch/fbpcp - FBPCP (Facebook Private Computation Platform) is a secure, privacy safe and scalable architecture to deploy MPC (Multi Party Computation) applications in a distributed way on virtual private clouds. FBPCF (Facebook Private Computation Framework) is for scaling MPC computation up via threading, while FBPCP is for scaling MPC computation out via Private Scaling architecture.
• facebookresearch/beanmachine - A library that allows for inference on probabilistic models
• hpcaitech/ColossalAI - Making big AI models cheaper, easier, and scalable
• eset/ipyida - IPython console integration for IDA Pro
• SigmaHQ/sigma - Main Rule Repository
• Neo23x0/Loki - Loki - Simple IOC and Incident Response Scanner
• aliyunav/Finger - A tool for recognizing function symbol
• beremiz/beremiz -
• bleachbit/bleachbit - BleachBit system cleaner for Windows and Linux
• Tencent/TPAT - TensorRT Plugin Autogen Tool
• hdbreaker/RicardoNarvaja_ExploitingWithIDAPRO_Desde0 - Nuevo Curso Completo de Exploiting con IDA Pro pro Ricardo Narvaja
• williballenthin/ida-netnode - Humane API for storing and accessing persistent data in IDA Pro databases
• gaasedelen/patching - An Interactive Binary Patching Plugin for IDA Pro
• williballenthin/idawilli - IDA Pro resources, scripts, and configurations
• mandiant/FIDL - A sane API for IDA Pro's decompiler. Useful for malware RE and vulnerability research
• nologic/idaref - IDA Pro Instruction Reference Plugin
• IDArlingTeam/IDArling - Collaborative Reverse Engineering plugin for IDA Pro & Hex-Rays
• danigargu/heap-viewer - IDA Pro plugin to examine the glibc heap, focused on exploit development
• anatolikalysch/VMAttack - VMAttack PlugIn for IDA Pro
• polymorf/findcrypt-yara - IDA pro plugin to find crypto constants (and more)
• zyantific/IDASkins - Advanced skinning plugin for IDA Pro
• 0xgalz/Virtuailor - IDAPython tool for creating automatic C++ virtual tables in IDA Pro
• keystone-engine/keypatch - Multi-architecture assembler for IDA Pro. Powered by Keystone Engine.
• igogo-x86/HexRaysPyTools - IDA Pro plugin which improves work with HexRays decompiler and helps in process of reconstruction structures and classes
• idapython/src - IDAPython project for Hex-Ray's IDA Pro
• mandiant/flare-ida - IDA Pro utilities from FLARE team
• getsentry/sentry - Developer-first error tracking and performance monitoring
• softsys4ai/athena - Athena: A Framework for Defending Machine Learning Systems Against Adversarial Attacks
• jklepsercyber/defender-detectionhistory-parser - A parser of Windows Defender's DetectionHistory forensic artifact, containing substantial info about quarantined files and executables.
• fierceoj/ShonyDanza - A customizable, easy-to-navigate tool for researching, pen testing, and defending with the power of Shodan.
• mvelazc0/Oriana - Oriana is a threat hunting tool that leverages a subset of Windows events to build relationships, calculate totals and run analytics. The results are presented in a Web layer to help defenders identify outliers and suspicious behavior on corporate environments.
• ethanmoyer/SubseqML -
• FirmWire/FirmWire - FirmWire is a full-system baseband firmware emulation platform for fuzzing, debugging, and root-cause analysis of smartphone baseband firmwares
• jonaslejon/malicious-pdf - 💀 Generate a bunch of malicious pdf files with phone-home functionality. Can be used with Burp Collaborator or Interact.sh
• Mr-xn/BurpSuite-collections - 有关burpsuite的插件(非商店),文章以及使用技巧的收集(此项目不再提供burpsuite破解文件,如需要请在博客mrxn.net下载)---Collection of burpsuite plugins (non-stores), articles and tips for using Burpsuite, no crack version file
• mandiant/flare-emu -
• mandiant/capa - The FLARE team's open-source tool to identify capabilities in executable files.
• mandiant/speakeasy - Windows kernel and user mode emulation.
• mandiant/flare-fakenet-ng - [Suspended] FakeNet-NG - Next Generation Dynamic Network Analysis Tool
• mdshw5/pyfaidx - Efficient pythonic random access to fasta subsequences
• ahma-hub/analysis - The current repository contains all the scripts needed to reproduce the results published in the paper: "Obfuscation Revealed: Electromagnetic obfuscated malware classification".
• jimmy-ly00/Ransomware-PoC - A simple, fully python ransomware PoC using AES-CTR and RSA. Supports Windows, Linux and macOS
• dmdhrumilmistry/pyhtools - A Python Hacking Library consisting of network scanner, arp spoofer and detector, dns spoofer, code injector, packet sniffer, network jammer, email sender, downloader, wireless password harvester credential harvester, keylogger, download&execute, ransomware, data harvestors, etc.
• vasco2016/ransomware - Seeing how easy it is to create ransomware.
• Concinnity-Risks/RansomCoinPublic - A DFIR tool to extract cryptocoin addresses and other indicators of compromise from binaries.
• jg-fisher/python-ransomware - Basic ransomware proof of concept with Python 3.7.
• cy4nguy/Python-Ransomware - Complete Python RansomeWare Source Code With Full Decoumetions.
• roothaxor/Ransom - Various codes related to Ransomware Developement
• YJesus/AntiRansom - Fighting against ransomware using honeypots
• NullArray/Cypher - Pythonic ransomware proof of concept.
• captainGeech42/ransomwatch - Ransomware leak site monitoring
• HugoLB0/Ransom0 - Ransom0 is a open source ransomware made with Python, designed to find and encrypt user data.
• ncorbuk/Python-Ransomware - Python Ransomware Tutorial - YouTube tutorial explaining code + showcasing the ransomware with victim/target roles
• ecstatic-nobel/OSweep - Don't Just Search OSINT. Sweep It.
• utkusen/jeopardize - a low(zero) cost threat intelligence&response tool against phishing domains
• sebmarchand/pyetw -
• JPCERTCC/LogonTracer - Investigate malicious Windows logon by visualizing and analyzing Windows event log
• fireeye/pywintrace - ETW Python Library
• Heurs/parseNTFS - Simple NTFS crawler.
• yampelo/beagle - Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.
• harelsegev/INDXRipper - Carve file metadata from NTFS index ($I30) attributes
• msuhanov/dfir_ntfs - An NTFS/FAT parser for digital forensics & incident response
• evilsocket/opensnitch - OpenSnitch is a GNU/Linux port of the Little Snitch application firewall
• evilsocket/ergo-pe-av - 🧠 🦠 An artificial neural network and API to detect Windows malware, based on Ergo and LIEF.
• CERT-Polska/karton - Distributed malware processing framework based on Python, Redis and S3.
• joxeankoret/pigaios - A tool for matching and diffing source codes directly against binaries.
• joxeankoret/diaphora - Diaphora, the most advanced Free and Open Source program diffing tool.
• joxeankoret/cosa-nostra - Cosa Nostra, a FOSS graph based malware clusterization toolkit.
• mkorman90/VolatilityBot - VolatilityBot – An automated memory analyzer for malware samples and memory dumps
• pylyf/NetWorm - Python network worm that spreads on the local network and gives the attacker control of these machines.
• A3sal0n/FalconGate - A smart gateway to stop cyber criminals - Sponsored by Falcon Guard
• Dump-GUY/Malware-analysis-and-Reverse-engineering - Some of my publicly available Malware analysis and Reverse engineering.
• jymcheong/SysmonResources - Consolidation of various resources related to Microsoft Sysmon & sample data/log
• mkorman90/sysmon-config-bypass-finder - Detect possible sysmon logging bypasses given a specific configuration
• lucky-luk3/Grafiki - Threat Hunting tool about Sysmon and graphs
• yarox24/attack_monitor - Endpoint detection & Malware analysis software
• KrispyCamel4u/SysMonTask - Linux system monitor with the compactness and usefulness of windows task manager to allow higher control and monitoring.
• OTRF/ThreatHunter-Playbook - A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
• justfoxing/ghidra_bridge - Python 3 bridge to Ghidra's Python scripting
• skelsec/minidump - Python library to parse and read Microsoft minidump file format
• blackberry/pe_tree - Python module for viewing Portable Executable (PE) files in a tree-view using pefile and PyQt5. Can also be used with IDA Pro and Rekall to dump in-memory PE files and reconstruct imports.
• scottrogowski/code2flow - Pretty good call graphs for dynamic languages
• angr/angr - A powerful and user-friendly binary analysis platform!
• Phype/telnet-iot-honeypot - Python telnet honeypot for catching botnet binaries
• aaaddress1/shellDev.py - tool for building windows shellcode in C by MinGW
• G1ft3dC0d3/MsfMania - Python AV Evasion Tools
• naveednajam/Little-Snitch---Rule-Groups - This repo provide rule groups for Little Snitch based on unified host list to block ads, malware, fake news and porn
• eset/malware-research - Code written as part of our various malware investigations
• phage-nz/ph0neutria - ph0neutria is a malware zoo builder that sources samples straight from the wild. Everything is stored in Viper for ease of access and manageability.
• ANSSI-FR/polichombr - Collaborative malware analysis framework
• diogo-fernan/malsub - A Python RESTful API framework for online malware analysis and threat intelligence services.
• deadPix3l/CryptSky - A simple, fully python ransomware PoC
• malicialab/avclass - AVClass malware labeling tool
• monnappa22/Limon - Limon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time indicators of Linux malware. It allows one to inspect Linux malware before execution, during execution, and after execution (post-mortem analysis) by performing static, dynamic and memory analysis using open source tools
• JPCERTCC/MalConfScan - Volatility plugin for extracts configuration data of known malware
• BreakingMalware/AVulnerabilityChecker - Tool to check if your computer is likely to be vulnerable to exploitable constant Read-Write-Execute (RWX) addresses (AVs vulnerability)
• hasherezade/shellconv - Small tool for disassembling shellcode (using objdump)
• hasherezade/malware_analysis - Various snippets created during malware analysis
• hasherezade/crypto_utils - Set of my small utils related to cryptography, encoding, decoding etc
• hasherezade/password_scrambler - Password scrambler - a deterministic password re-generator (alternative to a password manager)
• hasherezade/ida_ifl - IFL - Interactive Functions List (plugin for IDA Pro)
• danielplohmann/apiscout - This project aims at simplifying Windows API import recovery on arbitrary memory dumps
• nikdon/pyEntropy - Entropy for Python
• raphaelvallat/antropy - AntroPy: entropy and complexity of (EEG) time-series in Python
• Plazmaz/leaky-repo - Benchmarking repo for secrets scanning
• sithis993/Crypter - Crypter - Python3 based builder and ransomware compiled to Windows executable using PyInstaller
• felixweyne/imaginaryC2 - Imaginary C2 is a python tool which aims to help in the behavioral (network) analysis of malware. Imaginary C2 hosts a HTTP server which captures HTTP requests towards selectively chosen domains/IPs. Additionally, the tool aims to make it easy to replay captured Command-and-Control responses/served payloads.
• secrary/SSMA - SSMA - Simple Static Malware Analyzer [This project is not maintained anymore by me]
• JPCERTCC/aa-tools - Artifact analysis tools by JPCERT/CC Analysis Center
• tarcisio-marinho/RSB-Framework - Windows/Linux - ReverseShellBackdoor Framework
• tarcisio-marinho/GonnaCry - A Linux Ransomware
• baderj/domain_generation_algorithms - Some results of my DGA reversing efforts
• misterch0c/malSploitBase - Malware exploits
• rek7/fireELF - fireELF - Fileless Linux Malware Framework
• Ch0pin/EternalBlue - Handy script to automate the attack
• Ch0pin/medusa - Binary instrumentation framework based on FRIDA
• mandiant/stringsifter - A machine learning tool that ranks strings based on their relevance for malware analysis.
• endgameinc/gym-malware -
• mitre/multiscanner - Modular file scanning/analysis framework
• swagkarna/Hande-Stealer - Powerful Discord Stealer written in python
• virt-manager/virt-manager - Desktop tool for managing virtual machines via libvirt
• iphelix/dnschef - DNSChef - DNS proxy for Penetration Testers and Malware Analysts
• stormshadow07/HackTheWorld - An Python Script For Generating Payloads that Bypasses All Antivirus so far .
• certtools/intelmq - IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.
• certsocietegenerale/FIR - Fast Incident Response
• certsocietegenerale/fame - FAME Automates Malware Evaluation
• eliasgranderubio/dagda - a tool to perform static analysis of known vulnerabilities, trojans, viruses, malware & other malicious threats in docker images/containers and to monitor the docker daemon and running docker containers for detecting anomalous activities
• Neo23x0/yarGen - yarGen is a generator for YARA rules
• tomchop/malcom - Malcom - Malware Communications Analyzer
• Endermanch/MalwareDatabase - This repository is one of a few malware collections on the GitHub.
• D4Vinci/Dr0p1t-Framework - A framework that create an advanced stealthy dropper that bypass most AVs and have a lot of tricks
• airbnb/binaryalert - BinaryAlert: Serverless, Real-time & Retroactive Malware Detection.
• aptnotes/tools - Tools to interact with APTnotes reporting/index.
• alexandreborges/malwoverview - Malwoverview is a first response tool used for threat hunting and offers intel information from Virus Total, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, InQuest and it is able to scan Android devices against VT.
• jekil/awesome-hacking - Awesome hacking is an awesome collection of hacking tools.
• qilingframework/qiling - A True Instrumentable Binary Emulation Framework
• androguard/androguard - Reverse engineering and pentesting for Android applications
• bee-san/pyWhat - 🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙‍♀️
• wifiphisher/wifiphisher - The Rogue Access Point Framework
• StevenBlack/hosts - 🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.
• Tina-Rezaei/A-learning-model-to-detect-maliciousness-of-portable-executable-using-integrated-feature-set -
• toughie88/malware-detection-machine-learning-approach - python program to detect Portable_Executable files as either malicious or legitimate by trying out 5 different classification algorithms and choosing the best one for prediction by comparing their results.
• sashs/filebytes - Library to read and edit files in the following formats: Executable and Linking Format (ELF), Portable Executable (PE), MachO and OAT (Android Runtime)
• erocarrera/pefile - pefile is a Python module to read and work with PE (Portable Executable) files
• NTFSparse/ntfs_parse - NTFS parser, plus linking capabilites between MFT LogFile and UsnJrnl
• stamparm/identYwaf - Blind WAF identification tool
• xcp-ng/xcp - Entry point for issues and wiki. Also contains some scripts and sources.
• tklengyel/volatility3 - Volatility 3.0 development
• google/clusterfuzz - Scalable fuzzing infrastructure.
• volatilityfoundation/volatility3 - Volatility 3.0 development
• Tencent/HaboMalHunter - HaboMalHunter is a sub-project of Habo Malware Analysis System (https://habo.qq.com), which can be used for automated malware analysis and security assessment on the Linux system.
• google/rekall - Rekall Memory Forensic Framework
• intelowlproject/IntelOwl - Intel Owl: analyze files, domains, IPs in multiple ways from a single API at scale
• maguowei/starred - creating your own Awesome List by GitHub stars!
• cool-RR/PySnooper - Never use print for debugging again
• Wenzel/pyvmidbg - LibVMI-based debug server, implemented in Python. Building a guest aware, stealth and agentless full-system debugger
• ChrisTheCoolHut/PinCTF - Using Intel's PIN tool to solve CTF problems
• pwndbg/pwndbg - Exploit Development and Reverse Engineering with GDB Made Easy
• OWASP/owasp-mastg - The Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes the technical processes for verifying the controls listed in the OWASP Mobile Application Security Verification Standard (MASVS).
• naivenom/reversing-list - Reversing list
• 0xchase/r2taint - A WIP plugin for radare2 that integrates the taint analysis capabilities of the Binary Analysis Platform (BAP)
• NSSL-SJTU/SaTC - A prototype of Shared-keywords aware Taint Checking, a novel static analysis approach that tracks the data flow of the user input between front-end and back-end to precisely detect security vulnerabilities.
• trailofbits/polytracker - An LLVM-based instrumentation tool for universal taint tracking, dataflow analysis, and tracing.
• airbus-seclab/gustave - GUSTAVE is a fuzzing platform for embedded OS kernels. It is based on QEMU and AFL (and all of its forkserver siblings). It allows to fuzz OS kernels like simple applications.
• c3rb3ru5d3d53c/karton-unpacker - A modular Karton Framework service that unpacks common packers like UPX and others using the Qiling Framework.
• fkie-cad/RoAMer - Robust Automated Malware Unpacker
• unipacker/unipacker - Automatic and platform-independent unpacker for Windows binaries based on emulation
• DavidKorczynski/RePEconstruct -
• hatching/vmcloak - Automated Virtual Machine Generation and Cloaking for Cuckoo Sandbox.
• kevoreilly/CAPEv2 - Malware Configuration And Payload Extraction
• ucsb-seclab/packware - Effects of packers on machine-learning-based malware classifiers that use only static analysis
• MozillaSecurity/grizzly - A cross-platform browser fuzzing framework
• GNS3/gns3-server - GNS3 server
• GNS3/gns3-gui - GNS3 Graphical Network Simulator
• openbmc/openbmc - OpenBMC Distribution
• google/nogotofail - An on-path blackbox network traffic security testing tool
• sqlmapproject/sqlmap - Automatic SQL injection and database takeover tool
• stamparm/maltrail - Malicious traffic detection system
• arindas/mac-on-linux-with-qemu - Runs macOS on linux with qemu.
• isard-vdi/isard - Isard VDI. Open Source KVM Virtual Desktops based on KVM Linux and dockers. Please use https://gitlab.com/isard/isardvdi
• doomedraven/VirusTotalApi - VirusTotal Full api
• doomedraven/Tools - Combination of different utilities, have fun!
• VulnTotal-Team/IoT-vulhub - IoT固件漏洞复现环境
• nongiach/arm_now - arm_now is a qemu powered tool that allows instant setup of virtual machines on arm cpu, mips, powerpc, nios2, x86 and more, for reverse, exploit, fuzzing and programming purpose.
• kholia/OSX-KVM - Run macOS on QEMU/KVM. With OpenCore + Big Sur + Monterey + Ventura support now! Only commercial (paid) support is available now to avoid spammy issues. No Mac system is required.
• huang-zhen/Talos - Security Workaround for Rapid Response (SWRR) rapidly mitigates software vulnerabilities by preventing vulnerable code from being executed. Talos is a software tool that automatically generates and instruments SWRRs into target applications using static program analysis.
• 0x4D31/honeyLambda - honeyλ - a simple, serverless application designed to create and monitor fake HTTP endpoints (i.e. URL honeytokens) automatically, on top of AWS Lambda and Amazon API Gateway
• torokernel/qprofiler - This repo contains the code of qprofiler which is a tool to profile a guest running on qemu without the need of instrumentation
• jhftss/IDA2Obj - Static Binary Instrumentation
• trailofbits/blight - A framework for instrumenting build tools
• uber-common/opentracing-python-instrumentation - A collection of Python instrumentation tools for the OpenTracing API
• jwilk/python-afl - American Fuzzy Lop fork server and instrumentation for pure-Python code
• zeropointdynamics/zelos - A comprehensive binary emulation and instrumentation platform.
• sensepost/objection - 📱 objection - runtime mobile exploration
• ctxis/CAPE - Malware Configuration And Payload Extraction
• GoSecure/malboxes - Builds malware analysis Windows VMs so that you don't have to.
• volatilityfoundation/volatility - An advanced memory forensics framework
• mandiant/flare-floss - FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
• mitre/caldera - Automated Adversary Emulation Platform
• NHPT/FireEyeGoldCrystal - 一个GitHub监控和信息收集工具，支持监控和收集CVE、免杀、漏洞利用等内置关键字和自定义关键字。
• riga/law - Build large-scale task workflows: luigi + job submission + remote targets + environment sandboxing using Docker/Singularity
• Ryuchen/Panda-Sandbox - 这是一个基于 Cuckoo 开源版本的沙箱的修订版本, 该版本完全为了适配国内软件环境所打造
• ocatak/malware_api_class - Malware dataset for security researchers, data scientists. Public malware dataset generated by Cuckoo Sandbox based on Windows OS API calls analysis for cyber security researchers
• cssaheel/dissectors - This project is part of improving Cuckoo Sandbox, for more information https://honeynet.org/gsoc/slot3 I will use Scapy to write protocols dissectors for: TCP, UDP, ICMP, DNS, HTTP, FTP, IRC, SMB, SIP, TELNET, SSH, IMAP, POP and H.323
• NavyTitanium/Fake-Sandbox-Artifacts - This script allows you to create various artifacts on a bare-metal Windows computer in an attempt to trick malwares that looks for VM or analysis tools
• danieluhricek/LiSa - Sandbox for automated Linux malware analysis.
• cryptolok/MorphAES - IDPS & SandBox & AntiVirus STEALTH KILLER. MorphAES is the world's first polymorphic shellcode engine, with metamorphic properties and capability to bypass sandboxes, which makes it undetectable for an IDPS, it's cross-platform as well and library-independent.
• RobbieHan/gistandard - SandBox轻量级办公管理系统（gistandard乙方版本）
• idanr1986/cuckoo-droid - CuckooDroid - Automated Android Malware Analysis with Cuckoo Sandbox.
• nsmfoo/antivmdetection - Script to create templates to use with VirtualBox to make vm detection harder
• F-Secure/see - Sandboxed Execution Environment
• Rurik/Noriben - Noriben - Portable, Simple, Malware Analysis Sandbox
• imcaspar/gpt2-ml - GPT2 for Multiple Languages, including pretrained models. GPT2 多语言支持, 15亿参数中文预训练模型
• Morizeyao/GPT2-Chinese - Chinese version of GPT2 training code, using BERT tokenizer.
• huggingface/transformers - 🤗 Transformers: State-of-the-art Machine Learning for Pytorch, TensorFlow, and JAX.
• python-openxml/python-docx - Create and modify Word documents with Python
• achillean/shodan-python - The official Python library for Shodan
• sherlock-project/sherlock - 🔎 Hunt down social media accounts by username across social networks
• pwnlandia/mhn - Modern Honey Network
• mushorg/snare - Super Next generation Advanced Reactive honEypot
• CERT-Polska/drakvuf-sandbox - DRAKVUF Sandbox - automated hypervisor-level malware analysis system
• gento/dionaea - dionaea low interaction honeypot (forked from dionaea.carnivore.it)
• DinoTools/dionaea - Home of the dionaea honeypot
• netbox-community/netbox - The premiere source of truth powering network automation. Open source under Apache 2. Public demo: https://demo.netbox.dev
• HXSecurity/DongTai - DongTai is an interactive application security testing(IAST) product that supports the detection of OWASP WEB TOP 10 vulnerabilities, multi-request related vulnerabilities (including logic vulnerabilities, unauthorized access vulnerabilities, etc.), third-party component vulnerabilities, etc.
• ahmedkhlief/APT-Hunter - APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
• blackorbird/APT_REPORT - Interesting APT Report Collection And Some Special IOC
• ytisf/theZoo - A repository of LIVE malwares for your own joy and pleasure. theZoo is a project created to make the possibility of malware analysis open and available to the public.
• paralax/awesome-honeypots - an awesome list of honeypot resources
• ReFirmLabs/binwalk - Firmware Analysis Tool
• Azure/counterfit - a CLI that provides a generic automation layer for assessing the security of ML models
• fighting41love/funNLP - 中英文敏感词、语言检测、中外手机/电话归属地/运营商查询、名字推断性别、手机号抽取、身份证抽取、邮箱抽取、中日文人名库、中文缩写库、拆字词典、词汇情感值、停用词、反动词表、暴恐词表、繁简体转换、英文模拟中文发音、汪峰歌词生成器、职业名称词库、同义词库、反义词库、否定词库、汽车品牌词库、汽车零件词库、连续英文切割、各种中文词向量、公司名字大全、古诗词库、IT词库、财经词库、成语词库、地名词库、历史名人词库、诗词词库、医学词库、饮食词库、法律词库、汽车词库、动物词库、中文聊天语料、中文谣言数据、百度中文问答数据集、句子相似度匹配算法集合、bert资源、文本生成&摘要相关工具、cocoNLP信息抽取工具、国内电话号码正则匹配、清华大学XLORE:中英文跨语言百科知识图谱、清华大学人工智能技术系列报告、自然语言生成、NLU太难了系列、自动对联数据及机器人、用户名黑名单列表、罪名法务名词及分类模型、微信公众号语料、cs224n深度学习自然语言处理课程、中文手写汉字识别、中文自然语言处理 语料/数据集、变量命名神器、分词语料库+代码、任务型对话英文数据集、ASR 语音数据集 + 基于深度学习的中文语音识别系统、笑声检测器
• django-oscar/django-oscar - Domain-driven e-commerce for Django
• saleor/saleor - Saleor Core: the high performance, composable, headless commerce API.
• ungoogled-software/ungoogled-chromium - Google Chromium, sans integration with Google
• chipsec/chipsec - Platform Security Assessment Framework
• athenarc/smpc-analytics - 📊 Privacy Preserving Medical Data Analytics using Secure Multi Party Computation. An End-To-End Use Case. A. Giannopoulos, D. Mouris M.Sc. thesis at the University of Athens, Greece.
• ojroques/garbled-circuit - A two-party secure function evaluation using Yao's garbled circuit protocol
• FederatedAI/FATE - An Industrial Grade Federated Learning Framework
• facebookresearch/CrypTen - A framework for Privacy Preserving Machine Learning
• frappe/erpnext - Free and Open Source Enterprise Resource Planning (ERP)
• frappe/frappe - Low code web framework for real world applications, in Python and Javascript
• multiparty/conclave - Query compiler for secure multi-party computation.
• lschoe/mpyc - MPyC: Multiparty Computation in Python
• jbittel/django-mama-cas - A Django Central Authentication Service (CAS) single sign-on server
• simple-login/app - The SimpleLogin back-end
• ivre/ivre - Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, collect and analyse network intelligence from your sensors, and much more!
• saltstack/salt - Software to automate the management and configuration of any infrastructure or application at scale. Get access to the Salt software package repository here:
• secdev/scapy - Scapy: the Python-based interactive packet manipulation program & library. Supports Python 2 & Python 3.
• w3h/isf - ISF(Industrial Security Exploitation Framework) is a exploitation framework based on Python.
• hslatman/awesome-industrial-control-system-security - A curated list of resources related to Industrial Control System (ICS) security.
• mushorg/conpot - ICS/SCADA honeypot
• scipag/btle-sniffer - Passively scan for Bluetooth Low Energy devices and attempt to fingerprint them
• al0ne/Vxscan - python3写的综合扫描工具，主要用来存活验证，敏感文件探测(目录扫描/js泄露接口/html注释泄露)，WAF/CDN识别，端口扫描，指纹/服务识别，操作系统识别，POC扫描，SQL注入，绕过CDN，查询旁站等功能，主要用来甲方自测或乙方授权测试，请勿用来搞破坏。
• EnableSecurity/wafw00f - WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.
• MJL85/natlas - natlas - Network Discovery and Auto-Diagramming
• depthsecurity/armory - Armory is a tool meant to take in a lot of external and discovery data from a lot of tools, add it to a database and correlate all of related information.
• chrismaddalena/ODIN - Automated network asset, email, and social media profile discovery and cataloguing.
• GoVanguard/legion - Legion is an open source, easy-to-use, super-extensible and semi-automated network penetration testing tool that aids in discovery, reconnaissance and exploitation of information systems.
• ydkhatri/mac_apt - macOS (& ios) Artifact Parsing Tool
• rahulvigneswaran/Intrusion-Detection-Systems - This is the repo of the research paper, "Evaluating Shallow and Deep Neural Networks for Network Intrusion Detection Systems in Cyber Security".
• home-assistant/core - 🏡 Open source home automation that puts local control and privacy first.
• thingsboard/thingsboard-gateway - Open-source IoT Gateway - integrates devices connected to legacy and third-party systems with ThingsBoard IoT Platform using Modbus, CAN bus, BACnet, BLE, OPC-UA, MQTT, ODBC and REST protocols
• jopohl/urh - Universal Radio Hacker: Investigate Wireless Protocols Like A Boss
• 0xInfection/TIDoS-Framework - The Offensive Manual Web Application Penetration Testing Framework.
• SECFORCE/sparta - Network Infrastructure Penetration Testing Tool
• trustedsec/ptf - The Penetration Testers Framework (PTF) is a way for modular support for up-to-date tools.
• aboul3la/Sublist3r - Fast subdomains enumeration tool for penetration testers
• Manisso/fsociety - fsociety Hacking Tools Pack – A Penetration Testing Framework
• mitmproxy/mitmproxy - An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
• greatscottgadgets/Facedancer - modern FaceDancer core for multiple devices-- including GreatFET
• novnc/websockify - Websockify is a WebSocket to TCP proxy/bridge. This allows a browser to connect to any application/server/service.
• restran/web-proxy - ⛺️ A reverse proxy for web site based on Tornado
• aploium/zmirror - The next-gen reverse proxy for full site mirroring
• bslatkin/mirrorrr - Web proxy for App Engine
• elliottzheng/CopyTranslator - The Project had moved to elsewhere. Please go to|项目已迁移至别处，请到

QMake

• horsicq/XPEViewer - PE file viewer/editor for Windows, Linux and MacOS.
• horsicq/xntsv - XNTSV program for detailed viewing of system structures for Windows.

Rich Text Format

• TheParmak/conti-leaks-englished - Google and deepl translated conti leaks, which is shared by a member of the conti ransomware group.
• decalage2/oletools - oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.

Ruby

• Hackplayers/evil-winrm - The ultimate WinRM shell for hacking/pentesting
• pedrib/PoC - Advisories, proof of concept files and exploits that have been made public by @pedrib.
• rapid7/metasploit-framework - Metasploit Framework
• hashicorp/vagrant - Vagrant is a tool for building and distributing development environments.
• sensu-plugins/sensu-plugins-disk-checks - This plugin provides native disk instrumentation for monitoring and metrics collection, including: health, usage, and various metrics.
• dry-rb/dry-monitor - Monitoring and instrumentation APIs

Rust

• WithSecureLabs/tau-engine - A document tagging library
• Yamato-Security/RustyBlue - RustyBlue is a rust implementation of DeepblueCLI, a forensics log analyzer for finding evidence of compromise from windows event logs.
• bolinfest/opensnoop-native - opensnoop in pure C using eBPF
• tlspuffin/tlspuffin - A symbolic-model-guided fuzzer for TLS
• trailofbits/rust-wolfssl - Bindings for the wolfSSL library
• PoignardAzur/masonry-rs - Rust UI design toolkit.
• dbpunk-labs/db3 - DB3: open-source decentralized firebase firestore alternative
• tweedegolf/101-rs - A Rust university course
• Kudaes/RustChain - Hide memory artifacts using ROP and hardware breakpoints.
• analysis-tools-dev/static-analysis - ⚙️ A curated list of static analysis (SAST) tools and linters for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality.
• google/comprehensive-rust - This is the Rust course used by the Android team at Google. It provides you the material to quickly teach Rust to everyone.
• occlum/ngo - Next-Gen Occlum, a work-in-progress fork of Occlum that is optimized for the next-generation of Intel SGX (on Xeon SP processors)
• occlum/occlum - Occlum is a memory-safe, multi-process library OS for Intel SGX
• MirrorX-Desktop/MirrorX - Remote control tool for enterprise, teams and individuals. Build fast and security remote control network with fully control in a short time.
• cea-sec/usbsas - Tool and framework for securely reading untrusted USB mass storage devices.
• OPENCYBER-FR/RustHound - Active Directory data collector for BloodHound written in Rust. 🦀
• TheAlgorithms/Rust - All Algorithms implemented in Rust
• bytecodealliance/wasmtime - A fast and secure runtime for WebAssembly
• SitinCloud/Owlyshield - Owlyshield is an AI antivirus engine written in Rust.
• WithSecureLabs/chainsaw - Rapidly Search and Hunt through Windows Forensic Artefacts
• trickster0/OffensiveRust - Rust Weaponization for Red Team Engagements.
• skerkour/black-hat-rust - Applied offensive security with Rust - https://kerkour.com/black-hat-rust
• RustScan/RustScan - 🤖 The Modern Port Scanner 🤖
• gamozolabs/mempeek - A command line tool that resembles a debugger as well as Cheat Engine, to search for values in memory
• Yamato-Security/hayabusa - Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
• ergrelet/resym - Cross-platform tool that allows browsing and extracting C and C++ type declarations from PDB files.
• pkolaczk/fclones - Efficient Duplicate File Finder
• solana-labs/solana - Web-Scale Blockchain for fast, secure, scalable, decentralized apps and marketplaces.
• bet4it/udbserver - Unicorn Emulator Debug Server - Written in Rust, with bindings for C, Go, Java and Python
• HuskyHacks/RustyTokenManipulation - just manipulatin these here tokens yes sir nothing weird
• shadow/shadow - Shadow is a discrete-event network simulator that directly executes real application code, enabling you to simulate distributed systems with thousands of network-connected processes in realistic and scalable private network experiments using your laptop, desktop, or server running Linux.
• WhiteBeamSec/WhiteBeam - WhiteBeam: Transparent endpoint security
• evilsocket/medusa - A fast and secure multi protocol honeypot.
• rustdesk/rustdesk - Open source virtual / remote desktop infrastructure for everyone! The open source TeamViewer alternative. Display and control your PC and Android devices from anywhere at anytime.
• Wenzel/libmicrovmi - A cross-platform unified Virtual Machine Introspection API library
• grapl-security/grapl - Graph platform for Detection and Response
• analysis-tools-dev/dynamic-analysis - ⚙️ A curated list of dynamic analysis tools and linters for all programming languages, binaries, and more.
• cloud-hypervisor/cloud-hypervisor - A Virtual Machine Monitor for modern Cloud workloads. Features include CPU, memory and device hotplug, support for running Windows and Linux guests, device offload with vhost-user and a minimal compact footprint. Written in Rust with a strong focus on security.
• kata-containers/kata-containers - Kata Containers is an open source project and community working to build a standard implementation of lightweight Virtual Machines (VMs) that feel and perform like containers, but provide the workload isolation and security advantages of VMs. https://katacontainers.io/
• firecracker-microvm/firecracker - Secure and fast microVMs for serverless computing.
• bruno-anjos/PseudoTex - PseudoTex is a transpiler that translates pseudocode into its LaTex representation
• facebook/relay - Relay is a JavaScript framework for building data-driven React applications.

SCSS

• Hacker0x01/hacker101 - Source code for Hacker101.com - a free online web and mobile security class.
• drycc/workflow - The developer and operations friendly Kubernetes toolbox

SaltStack

• saltstack/salt-winrepo-ng - Jinja templated winrepo
• REMnux/salt-states - This repository maintains the SaltStack state files for the REMnux distro.

Scala

• delta-io/delta - An open-source storage framework that enables building a Lakehouse architecture with compute engines including Spark, PrestoDB, Flink, Trino, and Hive and APIs
• OpenXiangShan/XiangShan - Open-source high-performance RISC-V processor

Shell

• brendangregg/perf-tools - Performance analysis tools based on Linux perf_events (aka perf) and ftrace
• urbanadventurer/Android-PIN-Bruteforce - Unlock an Android phone (or device) by bruteforcing the lockscreen PIN. Turn your Kali Nethunter phone into a bruteforce PIN cracker for Android devices! (no root, no adb)
• Kitsun3Sec/Pentest-Cheat-Sheets - A collection of snippets of codes and commands to make your life easier!
• tastytea/hashboot - [mirror] Check integrity of files in /boot
• robcowart/elastiflow - Network flow analytics (Netflow, sFlow and IPFIX) with the Elastic Stack
• ffffffff0x/f8x - 红/蓝队环境自动化部署工具 | Red/Blue team environment automation deployment tool
• koutto/pi-pwnbox-rogueap - Homemade Pwnbox 🚀 / Rogue AP 📡 based on Raspberry Pi — WiFi Hacking Cheatsheets + MindMap 💡
• shr3ddersec/Shr3dKit - Red Team Tool Kit
• SecurityRiskAdvisors/RedTeamSIEM - Repository of resources for configuring a Red Team SIEM using Elastic
• six2dez/OneListForAll - Rockyou for web fuzzing
• stuxnet999/MemLabs - Educational, CTF-styled labs for individuals interested in Memory Forensics
• e-m-b-a/emba - EMBA - The firmware security analyzer
• GJDuck/e9syscall - A system call interception tool
• urbanware-org/wideredist - Windows Defender definition update tool for local network clients without internet access
• REMnux/website-source - This repository contains the source code of the REMnux.org website.
• REMnux/remnux.github.io - This is the published version of the https://REMnux.org website, generated using Hugo from the source files in the REMnux/website-source repository.
• netsecninja/LabNet - LabNet is a collection of scripts and configurations I use to switch networking options in my malware lab
• Err0r-ICA/Ransomware - Ransomwares Collection. Don't Run Them on Your Device.
• noloader/Build-Scripts - Collection of build scripts useful when testing on downlevel, abandonware and ransomware clients
• jdsecurity/CryptoTrooper - The world's first Linux white-box ransomware
• mitchellkrogza/Badd-Boyz-Hosts - A hosts file for use on any operating system to block bad domains out of your servers or devices.
• mitchellkrogza/The-Big-List-of-Hacked-Malware-Web-Sites - This repository contains a list of all web sites I come across that are either hacked with or purposefully hosting malware, ransomware, viruses or trojans.
• maravento/blackweb - Domains Blocklist for Squid-Cache
• hectorm/hblock - Improve your security and privacy by blocking ads, tracking and malware domains.
• mitchellkrogza/nginx-ultimate-bad-bot-blocker - Nginx Block Bad Bots, Spam Referrer Blocker, Vulnerability Scanners, User-Agents, Malware, Adware, Ransomware, Malicious Sites, with anti-DDOS, Wordpress Theme Detector Blocking and Fail2Ban Jail for Repeat Offenders
• weaveworks/tcptracer-bpf - eBPF program using kprobes to trace TCP events without run-time compilation dependencies
• aforensics/HiddenVM - HiddenVM — Use any desktop OS without leaving a trace.
• msuhanov/Linux-write-blocker - The kernel patch and userspace tools to enable Linux software write blocking
• firmadyne/firmadyne - Platform for emulation and dynamic analysis of Linux-based firmware
• AdroitAdorKhan/EnergizedProtection - A merged collection of hosts from reputable sources. #StayEnergized!
• activecm/BeaKer - Beacon Kibana Executable Report. Aggregates Sysmon Network Events With Elasticsearch and Kibana
• horsicq/build_tools -
• Ultimate-Hosts-Blacklist/Ultimate.Hosts.Blacklist - The Ultimate Unified Hosts file for protecting your network, computer, smartphones and Wi-Fi devices against millions of bad web sites. Protect your children and family from gaining access to bad web sites and protect your devices and pc from being infected with Malware or Ransomware.
• rfxn/linux-malware-detect - Linux Malware Detection (LMD)
• EnergizedProtection/block - Let's make an annoyance free, better open internet, altogether!
• l3af-project/l3af-arch - L3AF Architecture Documentation and Discussion
• google/oss-fuzz - OSS-Fuzz - continuous fuzzing for open source software.
• stayliv3/embedded-device-lab - embedded-device-lab是一个利用qemu模拟真实世界中物联网漏洞的测试环境。由于物联网架构的特殊性，调试分析漏洞通常需要使用qemu模拟执行不同架构的可执行文件。而各种搭建环境，交叉编译是一件费事费力，令人忧伤的工作。 embedded-device-lab利用docker-compose，将各种漏洞调试环境一键化。简单使用两条命令，就可以直接使用gdb或者IDA动态分析相关漏洞。
• vusec/pandacap - A framework for streamlining the capture of PANDA execution traces.
• cardi/qemu-windows-10 - running a windows 10 guest on a linux host with pci passthrough
• ipaqmaster/vfio - A script for easy pci and usb passthrough along with disks, iso's and other useful flags for quick tinkering with less of a headache. I use it for VM gaming and other PCI/LiveCD/PXE/VM/RawImage testing given the script's accessibility.
• kaorimatz/packer-templates - Packer templates for Vagrant base boxes
• fsquillace/junest - The lightweight Arch Linux based distro that runs, without root privileges, upon any Linux distro
• quickemu-project/quickemu - Quickly create and run optimised Windows, macOS and Linux desktop virtual machines.
• foxlet/macOS-Simple-KVM - Tools to set up a quick macOS VM in QEMU, accelerated by KVM.
• pigmonkey/firewarden - Open a file via the specified application within a private Firejail sandbox.
• violentlydave/mkhtaccess_red - Auto-generate an HTaccess for payload delivery -- automatically pulls ips/nets/etc from known sandbox companies/sources that have been seen before, and redirects them to a benign payload.
• cryptolok/CryKeX - Linux Memory Cryptographic Keys Extractor
• NVIDIA/enroot - A simple yet powerful tool to turn traditional container/OS images into unprivileged sandboxes.
• influxdata/sandbox - A sandbox for the full TICK stack
• mviereck/x11docker - Run GUI applications and desktops in docker and podman containers. Focus on security.
• hwdsl2/setup-ipsec-vpn - Scripts to build your own IPsec VPN server, with IPsec/L2TP, Cisco IPsec and IKEv2
• bblanchon/pdfium-binaries - 📰 Binary distribution of PDFium
• ant-thomas/zsgx1hacks - Hacks for ZS-GX1 IP Camera and various Goke GK7102 based IP Cameras
• nvm-sh/nvm - Node Version Manager - POSIX-compliant bash script to manage multiple active node.js versions
• ONLYOFFICE/DocumentServer - ONLYOFFICE Document Server is an online office suite comprising viewers and editors for texts, spreadsheets and presentations, fully compatible with Office Open XML formats: .docx, .xlsx, .pptx and enabling collaborative editing in real time.
• ONLYOFFICE/Docker-DocumentServer - ONLYOFFICE Document Server is an online office suite comprising viewers and editors for texts, spreadsheets and presentations, fully compatible with Office Open XML formats: .docx, .xlsx, .pptx and enabling collaborative editing in real time.
• seantap1/ngx_google_deployment - One-key Install Proxy for Google by Nginx

Smarty

• threatexpress/threatbox - ThreatBox is a standard and controlled Linux based attack platform. I've used a version of this for years. It started as a collection of scripts, lived as a rolling virtual machine, existed as code to build a Linux ISO, and has now been converted to a set of ansible playbooks. Why Ansible? Why not? This seemed a natural evolution.

Solidity

• AmazingAng/WTF-Solidity - 我最近在重新学solidity，巩固一下细节，也写一个“WTF Solidity极简入门”，供小白们使用，每周更新1-3讲。官网: https://wtf.academy
• SunWeb3Sec/DeFiLabs - On-chain test DeFi using Foundry
• SunWeb3Sec/WTF-Solidity - 我最近在重新学solidity，巩固一下细节，也写一个“WTF Solidity极简入门”，供小白们使用，每周更新1-3讲。官网: https://wtf.academy
• SunWeb3Sec/DeFiVulnLabs - To learn common smart contract vulnerabilities using Foundry!
• SunWeb3Sec/DeFiHackLabs - Reproduce DeFi hacked incidents using Foundry.
• immunefi-team/The-Dark-Forest-EP0-POC -
• immunefi-team/timebound-bbp -
• immunefi-team/community-challenges -
• immunefi-team/polygon-transferwithsig -
• wormhole-foundation/example-wormhole-lending - Wormhole Dapp Integration for Cross Chain Borrow/Lending
• wormhole-foundation/wormhole-circle-integration -
• wormhole-foundation/example-circle-relayer -
• wormhole-foundation/xdapp-book - How to get started building cross chain applications
• wormhole-foundation/trustless-generic-relayer - fr fr
• wormhole-foundation/example-token-bridge-relayer -

Swift

• Dashlane/apple-apps - 🍎 Apple applications sources
• vector-im/element-ios - A glossy Matrix collaboration client for iOS
• exelban/stats - macOS system monitor in your menu bar
• Frugghi/SwiftLCS - Swift implementation of the longest common subsequence (LCS) algorithm.
• PraneetNeuro/Project-Mendacius - A GUI based virtualisation tool for running Linux on macOS Big Sur (x86 or arm64)
• wireapp/wire-ios - 📱 Wire for iOS (iPhone and iPad)
• ProtonVPN/ios-app - Superseded by https://github.com/ProtonVPN/ios-mac-app

SystemVerilog

• pulp-platform/snitch - Lean but mean RISC-V system!
• pulp-platform/axi - AXI SystemVerilog synthesizable IP modules and verification infrastructure for high-performance on-chip communication
• ufrisk/pcileech-fpga - FPGA modules used together with the PCILeech Direct Memory Access (DMA) Attack Software
• ljhsiun2/EllipticCurves_SystemVerilog - Elgamal's over Elliptic Curves
• hdl-util/hdmi - Send video/audio over HDMI on an FPGA
• syntacore/scr1 - SCR1 is a high-quality open-source RISC-V MCU core in Verilog

Tcl

• fpgadeveloper/fpga-drive-aximm-pcie - Example designs for FPGA Drive FMC
• Digilent/vivado-boards -

TeX

• sysprog21/lkmpg - The Linux Kernel Module Programming Guide (updated for 5.x kernels)
• riscv/riscv-isa-manual - RISC-V Instruction Set Manual
• jameslzhu/riscv-card - An unofficial assembly reference for RISC-V.
• KastnerRG/pp4fpgas - Parallel Programming for FPGAs -- An open-source high-level synthesis book

TypeScript

• DouyinFE/semi-design - 🚀A modern, comprehensive, flexible design system and React UI library. 🎨 Provide more than 2,300+ Design Tokens and powerful DSM tools, easy to build your own design system. Make Semi Design to Any Design
• salarcode/SmartProxy - Firefox/Chrome browser extension. SmartProxy will automatically enable/disable proxy for the sites you visit, based on customizable patterns.
• wormhole-foundation/wormhole-examples - Examples for Wormhole
• wormhole-foundation/example-wormhole-nativeswap - Multi-chain native-to-native token swap using existing DEXes.
• wormhole-foundation/wormhole-icco - Example Wormhole ICCO
• hippospace/aptos-coin-list -
• wormhole-foundation/example-aptos-relayer -
• wormhole-foundation/wormhole-dashboard - We could have named this vigilant-giggle. It's surprisingly not far off.
• wormhole-foundation/example-token-bridge-ui - A development bridge UI for testing cross-chain transfers over Wormhole
• wormhole-foundation/example-nativeswap-usdc - NativeSwap using Circle Bridge in Testnet
• wormhole-foundation/usdcdemo-web -
• wormhole-foundation/wormhole-scaffolding - Starter apps with Wormhole integration
• wormhole-foundation/wormhole-monitor - The eagle-eyed observer. The meta-watcher.
• wormhole-foundation/relayer-engine -
• wormhole-foundation/wormhole - A reference implementation for the Wormhole blockchain interoperability protocol.
• upscayl/upscayl - 🆙 Upscayl - Free and Open Source AI Image Upscaler for Linux, MacOS and Windows built with Linux-First philosophy.
• hotwired/stimulus - A modest JavaScript framework for the HTML you already have
• Eugeny/tabby - A terminal for a more modern age
• cisagov/RedEye - RedEye is a visual analytic tool supporting Red & Blue Team operations
• bitwarden/clients - Bitwarden client applications (web, browser extension, desktop, and cli)
• bitwarden/desktop - The desktop vault (Windows, macOS, & Linux).
• withastro/astro - Build faster websites with Astro's next-gen island architecture 🏝✨
• toeverything/AFFiNE - There can be more than Notion and Miro. AFFiNE is a next-gen knowledge base that brings planning, sorting and creating all together. Privacy first, open-source, customizable and ready to use.
• facebook/docusaurus - Easy to maintain open source documentation websites.
• LasCC/Hack-Tools - The all-in-one Red Team extension for Web Pentester 🛠
• supabase/supabase - The open source Firebase alternative. Follow to stay updated about our public Beta.
• bluesky-social/atproto - Social networking technology created by Bluesky
• vector-im/element-web - A glossy Matrix collaboration client for the web.
• grafana/grafana - The open and composable observability and data visualization platform. Visualize metrics, logs, and traces from multiple sources like Prometheus, Loki, Elasticsearch, InfluxDB, Postgres and many more.
• meetqy/acss-dnd - 一款基于原子类 css 特性的 web 拖拽式编辑器(An web dnd editor on atomic css features)
• nowsecure/r2frida - Radare2 and Frida better together.
• HospitalRun/hospitalrun-frontend - Frontend for HospitalRun
• balena-io/etcher - Flash OS images to SD cards & USB drives, safely and easily.
• niklasvh/html2canvas - Screenshots with JavaScript
• edp963/davinci - Davinci is a DVsaaS (Data Visualization as a Service) Platform
• brick-design/brick-design - 低代码框架，支持流式布局与自由布局拖拽编排，可视化拖拽、随意嵌套组合、实时渲染、实时辅助线展示、自由布局支持辅助对齐、支持自动吸附、实时组件间距展示、实时拖拽排序、状态域管理，可视化属性配置、可视化样式配置、多设备适配展示，支持逻辑渲染、模板字符变量、表达式、自定义方法、自定义状态
• baidu/amis - 前端低代码框架，通过 JSON 配置就能生成各种页面。
• casbin/casbin-editor - Web-based model & policy editor for Casbin
• casbin/node-casbin - An authorization library that supports access control models like ACL, RBAC, ABAC in Node.js and Browser
• graphql-editor/graphql-editor - 📺 Visual Editor & GraphQL IDE. Draw GraphQL schemas using visual 🔷 nodes and explore GraphQL API with beautiful UI. Even 🐒 can do that!
• fingerprintjs/fingerprintjs - Browser fingerprinting library. Compared to Fingerprint Pro has limited accuracy (40 - 60%), but is fully open source.
• threema-ch/threema-web - The Threema Web application.
• serialport/node-serialport - Access serial ports with JavaScript. Linux, OSX and Windows. Welcome your robotic JavaScript overlords. Better yet, program them!
• ProtonMail/WebClients - Monorepo hosting the proton web clients
• TankerHQ/sdk-js - Tanker client-side encryption SDK for JavaScript
• tutao/tutanota - Tutanota is an email service with a strong focus on security and privacy that lets you encrypt emails, contacts and calendar entries on all your devices.
• standardnotes/app - End-to-end encrypted notes app. Write fearlessly. For issues, visit https://standardnotes.com/forum or https://standardnotes.com/help.
• laurent22/joplin - Joplin - an open source note taking and to-do application with synchronisation capabilities for Windows, macOS, Linux, Android and iOS.
• apollographql/apollo-server - 🌍  Spec-compliant and production ready JavaScript GraphQL server that lets you develop in a schema-first way. Built for Express, Connect, Hapi, Koa, and more.
• hasura/ra-data-hasura - react-admin data provider for Hasura GraphQL Engine
• graphql/graphiql - GraphiQL & the GraphQL LSP Reference Ecosystem for building browser & IDE tools.
• apollographql/apollo-client - 🚀  A fully-featured, production ready caching GraphQL client for every UI framework and GraphQL server.
• hasura/graphql-engine - Blazing fast, instant realtime GraphQL APIs on your DB with fine grained access control, also trigger webhooks on database events.
• kriasoft/relay-starter-kit - 💥 Monorepo template (seed project) pre-configured with GraphQL API, PostgreSQL, React, Relay, Material UI.
• storybookjs/storybook - Storybook is a frontend workshop for building UI components and pages in isolation. Made for UI development, testing, and documentation.
• syncfusion/ej2-react-samples - Essential JS 2 demo samples for React. http://ej2.syncfusion.com/react/demos
• syncfusion/ej2-react-ui-components - Syncfusion React UI components library offer more than 50+ cross-browser, responsive, and lightweight react UI controls for building modern web applications.
• electrode-io/electrode-native - A platform to ease integration&delivery of React Native apps in existing mobile applications
• rsuite/rsuite - 🧱 A suite of React components .
• react-navigation/react-navigation - Routing and navigation for your React Native apps
• react-bootstrap/react-bootstrap - Bootstrap components built with React
• ionic-team/ionic-framework - A powerful cross-platform UI toolkit for building native-quality iOS, Android, and Progressive Web Apps with HTML, CSS, and JavaScript.
• marmelab/react-admin - A frontend Framework for building B2B applications running in the browser on top of REST/GraphQL APIs, using ES6, React and Material Design
• burtonator/polar-bookshelf - Polar is a personal knowledge repository for PDF and web content supporting incremental reading and document annotation.
• outline/outline - The fastest knowledge base for growing teams. Beautiful, realtime collaborative, feature packed, and markdown compatible.
• kriasoft/react-starter-kit - The web's most popular Jamstack front-end template (boilerplate) for building web applications with React
• alibaba/GGEditor - A visual graph editor based on G6 and React
• alibaba/BizCharts - Powerful data visualization library based on G2 and React.
• alibaba/ice - 🚀 ice.js: The Progressive App Framework Based On React（基于 React 的渐进式应用框架）
• chimurai/http-proxy-middleware - ⚡ The one-liner node.js http-proxy middleware for connect, express, next.js and more
• telerik/kendo-react-finance-portfolio - React Stock Watchlist App
• CopyTranslator/CopyTranslator - Foreign language reading and translation assistant based on copy and translate.

VBA

• BC-SECURITY/Offensive-VBA-and-XLS-Entanglement -
• itm4n/VBA-RunPE - A VBA implementation of the RunPE technique or how to bypass application whitelisting.

VBScript

• Da2dalus/The-MALWARE-Repo - A repository full of malware samples.

VHDL

• cassuto/SM4-FPGA - SM4 is a block encryption algorithm
• VLSI-EDA/PoC - IP Core Library - Published and maintained by the Chair for VLSI Design, Diagnostics and Architecture, Faculty of Computer Science, Technische Universität Dresden, Germany
• progranism/Open-Source-FPGA-Bitcoin-Miner - A completely open source implementation of a Bitcoin Miner for Altera and Xilinx FPGAs. This project hopes to promote the free and open development of FPGA based mining solutions and secure the future of the Bitcoin project as a whole. A binary release is currently available for the Terasic DE2-115 Development Board, and there are compile-able projects for numerous boards.

Vala

• muriloventuroso/easyssh - The SSH connection manager to make your life easier.

Verilog

• tillitis/tillitis-key1 - Board designs, FPGA verilog, firmware for TKey, the flexible and open USB security key 🔑
• olofk/serv - SERV - The SErial RISC-V CPU
• kamarajvlsi/ECC-Entity-Authentication - The proposed ECC processor performs single point multiplication of 256-bit in 1.2062ms with a maximum clock frequency of 192.5MHz, which provides 212.23kbps throughput and occupies 8.23k slices in Virtex-7 FPGA. Incorporating a pipeline in scalar multiplication improves the maximum clock frequency up to 15.12%, which reduces time consumption by 22.36%, which in turn increases the throughput by 22.36%.
• yossibodek/ecc_enc_dec - Encoder decoder- design, verification and synthesis project
• iMohannad/ECC_scalar_multiplication - A hardware implementation of Scalar Multiplication on ECC
• xurubin/ECProcessor - Elliptic curve cryptography coprocessor on FPGA
• cryptocactus/EllipticCurveProcessor - Verilog code for an Elliptic Curve Processor.
• liuguangxi/ec_sec2 - Elliptic curve for SEC 2 Verilog IP core
• n-elhamawy/ueca-based-eceg - An open-source area-optimized Elliptic Curve Elgamal Cryptosystem in Hardware
• Liror/ECEG - Small research unrolled verilog implementation of an Elliptic Curve ElGamal cryptosystem
• betrusted-io/gateware - IP submodules, formatted for easier CI integration
• pansygrass/ecc - Verilog for a SECDED Hsaio ECC and a DEC ECC. Power, delay, and area are compared for Berkeley MASIC EEW241B - Advanced Digital Integrated Circuits.
• ZipCPU/wb2axip - Bus bridges and other odds and ends
• ZipCPU/zipcpu - A small, light weight, RISC CPU soft core
• freecores/verilog_fixed_point_math_library - Fixed Point Math Library for Verilog
• alexforencich/verilog-pcie - Verilog PCI express components
• corundum/corundum - Open source FPGA-based NIC and platform for in-network compute
• adki/AMBA_AXI_AHB_APB - AMBA bus lecture material
• YosysHQ/picorv32 - PicoRV32 - A Size-Optimized RISC-V CPU
• SI-RISCV/e200_opensource - Deprecated, please go to next generation Ultra-Low Power RISC-V Core https://github.com/riscv-mcu/e203_hbirdv2
• cassuto/nano-cpu32k - Superscalar out-of-order RISC core (with Cache& MMU) and SoC, supporting GNU toolchain & Linux 4.20 kernel, having been verified on Xilinx Kintex-7 FPGA.
• secworks/trng - True Random Number Generator core implemented in Verilog.
• secworks/aes - Verilog implementation of the symmetric block cipher AES (Advanced Encryption Standard) as specified in NIST FIPS 197. This implementation supports 128 and 256 bit keys.
• secworks/ed25519 - ed25519 public key signature implemented in Verilog.
• ljgibbslf/SM2_core - opensource crypto IP core
• T-head-Semi/opene902 - OpenXuantie - OpenE902 Core
• T-head-Semi/opene906 - OpenXuantie - OpenE906 Core
• T-head-Semi/openc906 - OpenXuantie - OpenC906 Core
• T-head-Semi/openc910 - OpenXuantie - OpenC910 Core
• riscv-mcu/e203_hbirdv2 - The Ultra-Low Power RISC-V Core
• fire-sand/ECC-Verilog - ECC implementation in Verilog
• hyperpicc/ecc - Verilog HDL implementation of Elliptic Curve Cryptography (ECC) over GF(2^163)
• shiva-t/Elliptical-Curve-Cryptography-FPGA - Implementation of ECC on FPGA-Zynq7000 SoC
• crypt-xie/XCryptCore - Implementation of cryptographic algorithm with verilog hdl(such as des,aes,sha,rsa,ecc etc.)
• T-head-Semi/wujian100_open - IC design and development should be faster，simpler and more reliable
• IA-C-Lab-Fudan/KWS-SoC - This is an SoC design dedicated to Keyword Spotting (KWS) based on a neural-network accelerator and the wujian100 platform.
• seldridge/verilog - Repository for basic (and not so basic) Verilog blocks with high re-use potential
• Obijuan/open-fpga-verilog-tutorial - Learn how to design digital systems and synthesize them into an FPGA using only opensource tools
• aolofsson/oh - Verilog library for ASIC and FPGA designers
• analogdevicesinc/hdl - HDL libraries and projects
• alexforencich/verilog-ethernet - Verilog Ethernet components for FPGA implementation
• raymondrc/FPGA_SM4 - FPGA implementation of Chinese SM4 encryption algorithm.
• darklife/darkriscv - opensouce RISC-V cpu core implemented in Verilog from scratch in one night!
• kgpai94/ECC-Encryption-System - This is a Verilog algorithm which takes 8bits and encrypts the data for the purpose of secure communication based on the concept of Elliptic Curve Cryptography. This project was implemented using a spartan 3 FPGA kit.
• myriadrf/LimeSDR-USB_GW - Altera Cyclone IV FPGA project for the USB 3.0 LimeSDR board

Visual Basic

• mdsecactivebreach/SharpShooter - Payload Generation Framework
• china-richway2/Azmrk - Azmrk是一款在Windows XP下专用的任务管理器，包含SSDT查看、进程管理，有简易的调试功能，句柄查看和关闭（文件解锁），查看驱动模块并复制到硬盘上，读取内核内存……
• NYAN-x-CAT/Lime-RAT - LimeRAT | Simple, yet powerful remote administration tool for Windows (RAT)

Visual Basic .NET

• EVLF/Cypher-Rat-Source-Code - Cypher Rat Full Version - Advanced Android Remote Tool 2022

Vue

• dromara/go-view - GoView 说明文档，GoView 是一个低代码数据可视化开发平台，将图表或页面元素封装为基础组件，无需编写代码即可完成业务需求。 它的技术栈为：Vue3 + TypeScript4 + Vite2 + NaiveUI + ECharts5 + Axios + Pinia2 + PlopJS
• harvester/dashboard - Rancher new Dashboard UI
• Nagarjuna-PradeepKumar/hospital-management-system - Hospital management system made with Vuejs, Expressjs, Nodejs, Mongodb. Ideal for small hospitals and clinics.
• salomonelli/best-resume-ever - 👔 💼 Build fast 🚀 and easy multiple beautiful resumes and create your best CV ever! Made with Vue and LESS.

XSLT

• LOLBAS-Project/LOLBAS - Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)
• transpect/docx2tex - Converts Microsoft Word docx to LaTeX

YARA

• MalGamy/YARA_Rules -
• mandiant/red_team_tool_countermeasures -
• sophoslabs/IoCs - Sophos-originated indicators-of-compromise from published reports
• StrangerealIntel/Orion - A YARA rules repository continuously updated for monitoring the old and new threats from articles, incidents responses ...
• The-DFIR-Report/Yara-Rules -
• ParrotSec/mimikatz -
• citizenlab/malware-indicators - Citizen Lab Malware Reports
• CYB3RMX/Qu1cksc0pe - All-in-One malware analysis tool.
• cristianzsh/freki - 🐺 Malware analysis platform
• JusticeRage/Manalyze - A static analyzer for PE executables.
• eset/malware-ioc - Indicators of Compromises (IOC) of our various investigations
• urwithajit9/ClaMP - A Malware classifier dataset built with header fields’ values of Portable Executable files
• Yara-Rules/rules - Repository of yara rules
• blackeko/PEpper - An open source script to perform malware static analysis on Portable Executable
• guelfoweb/peframe - PEframe is a open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents.
• CyberMonitor/APT_CyberCriminal_Campagin_Collections - APT & CyberCriminal Campaign Collection

License

To the extent possible under law, goldenscale has waived all copyright and related or neighboring rights to this work.