How To approach recon on real targets — from passive enumeration to origin IP discovery. Covers tools, automation, and the logic behind each phase.

BOF exploiting the Visual Studio Installer Elevation Service for SYSTEM LPE and persistence via AppDomainManager hijacking, with native ETW evasion. For Cobalt Strike & Adaptix.

A VBA parser and emulation engine to analyze malicious macros.

A 2.78-trillion-parameter Kimi K3 running inference on a single CPU in 8.24 GB of RAM. Portable C99: no BLAS, no framework, no GPU.

A repo to hold some scripts pertaining WMI (Windows implementation of WBEM) forensics

GitHub-native command-and-control framework for authorized security research, with encrypted multi-channel transport and resilient failover.

True IMAP Tunnel (secure)

HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug b…

Raw NTFS volume oracle: locked-file read and offline SAM hashes without LSASS

Kubernetes Security Training Platform - focusing on security mitigation

RCE PoC for Redis 6.2.22, 7.4.9, 8.6.4, 8.8.0, 8.8.1

Extract Windows credentials directly from VM memory snapshots and virtual disks

Security sensor for realtime threat detection and protection

Elastic Security Labs' malware analysis and reverse engineering library

817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works w…

A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.

The only tool/technique to punch holes through firewalls/NATs where multiple clients & server can be behind separate NATs without any 3rd party involvement. Pwnat is a newly developed technique, ex…

Desktop VDI client for Proxmox VE — SPICE, VNC, RDP and SSH console launchers

A vector index built on TurboQuant, written in Rust with Python bindings

Unlimited file cloud storage based on using Telegram API

Modular and decentralised honeypot

A complete web-based remote monitoring and management web site. Once setup you can install agents and perform remote desktop session to devices on the local network or over the Internet.

Timeline of Active Directory changes with replication metadata

Powershell module for VMWare vSphere forensics

Malware Configuration And Payload Extraction

tsocks, a transparent SOCKS proxying library.

Local MTProto proxy server for partial bypassing of Telegram loading

💡 Download the complete source code of any website (including all assets). [ Javascripts, Stylesheets, Images ] using Node.js

Decrypt VMware vTPM-encrypted .vmem/.vmsn/.vmss/.nvram from the VM password, and flatten the .vmem to a Volatility-ready image.

GO Simple Tunnel - a simple tunnel written in golang