Daniel Roethlisberger

ClearSword. C

macchk. 🎤 mic check! checksec for Mach-O executables

OTABase. OTABase is an over-the-air testing framework for detecting memory crashes in commercial LTE basebands.

usbip-macos. A USB/IP client for macOS

Thirteen. Header only minimalist interface to graphics, inspired by the olden days of mode 13h

BGPalerter. BGP and RPKI monitoring tool. Pre-configured for real-time detection of visibility loss, RPKI invalid announcements, hijacks, ROA misconfiguration, and more.

KDU. Kernel Driver Utility

OpenEmuXPCCommunicator. Framework allowing applications to establish XPC communications between the main app and background processes

pysiphash. SipHash in Python

flexdecrypt. Decrypt iOS Apps and Mach-O binaries

apple-tools. A collection of tools for working with Apple software/hardware

UnFairPlay. Decrypt FairPlay encrypted executable binaries on macOS

FEX. A fast usermode x86 and x86-64 emulator for Arm64 Linux

dynarmic. An ARM dynamic recompiler.

books. Free Accounting Software

sandblaster_26. Extract sandbox profiles from the sandbox kernel extension

aarch64_kernel. A kernel for aarch64

aarch64_bootloader. A bootloader for my aarch64 kernel

unicorn. Unicorn CPU emulator framework (ARM, AArch64, M68K, Mips, Sparc, PowerPC, RiscV, S390x, TriCore, X86)

marko. A markdown parser with high extensibility.

continuity. Apple Continuity Protocol Reverse Engineering and Dissector

kernelhook. Windows inline hooking tool.

spytrap-wifi. Test a phone for stalkerware using a wifi hotspot and deep packet inspection

spytrap-adb. Test a phone for stalkerware using adb and usb debugging to scan for suspicious apps and configuration

simulator-trainer. Simulator tweak injection and helpers

liblpm. A high-performance C library for Longest Prefix Match (LPM) lookups, supporting both a multi-bit trie of 8-bit stride for IPv4 and a wide multi-level 16-bit stride for IPv6, featuring runtime dynamic SIMD dispatching (SSE2, SSE4.2, AVX, AVX2, AVX512F) for optimal performance and throughput on any CPU architecture.

libdnet. libdnet provides a simplified, portable interface to several low-level networking routines.

rxtls. rxtls is a hyper-optimized, per-core Certificate Transparency (CT) log processor built for one purpose: to extract and process 100,000+ X.509 certificates per second from the global CT ecosystem with zero GC, zero blocking, and total CPU saturation.

ctail. Tail Certificate Transparency logs and extract hostnames

x64dbg. An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.

JonMon-Lite. C++

iometa. arm64 IOKit class dumper

bn-objc-extras. Experimental improvements to Objective-C analysis for Binary Ninja

qemu-xnu. Integration fork of QEMU focusing on XNU platforms (arm, aarch64, etc)

ios-resources. Useful resources for iOS hacking

insert_dylib. Command line utility for inserting a dylib load command into a Mach-O binary

pypush. Python APNs and iMessage client

DyldExtractor. Extract Binaries from Apple's Dyld Shared Cache

securitytxt. Swisscom security contacts according to RFC 9116

lldbinit. A gdbinit clone for LLDB

chomper. A lightweight emulation framework for emulating security algorithms in iOS executables and libraries.

libprejailbreak. A pre-jailbreak library for devices running iOS 12 - 14.

optool. Command Line Tool for interacting with MachO binaries on OSX/iOS

diaphora. Diaphora, the most advanced Free and Open Source program diffing tool.

MachOView. MachOView fork

git-backdate. Backdate a commit or range of commit to a date or range of dates.

qiling. A True Instrumentable Binary Emulation Framework

binwalk. Firmware Analysis Tool

ladybird. Truly independent web browser

objc-kb. Notes on the Objective-C ABI and related topics

binja-blocks. Apple Blocks Plugin for Binary Ninja

XMachOViewer. XMachOViewer is a Mach-O viewer for Windows, Linux and MacOS

CTI. Random Cyber Threat Intelligence

mcrit. The MinHash-based Code Relationship & Investigation Toolkit (MCRIT) is a framework created to simplify the application of the MinHash algorithm in the context of code similarity.

pytricia. A library for fast IP address lookup in Python.

HookCase. Tool for reverse engineering macOS/OS X

siegfried. signature-based file format identification

zmap. ZMap is a fast single packet network scanner designed for Internet-wide network surveys.

netmap. Automatically exported from code.google.com/p/netmap

PongoOS. pongoOS

iphone_backup_decrypt. Decrypt an encrypted local iOS backup on Windows or MacOS

whoisit. A Python library to RDAP WHOIS-like services for internet resources such as ASNs, IPs, CIDRs and domains

ipsw. iOS/macOS Research Swiss Army Knife

dyn-dns-list. This repository contains a comprehensive list of over 30k dynamic DNS domains as of 2024. The list is provided for informational purposes only and can be used for a variety of purposes, including blocking malicious domains, filtering content, and enhancing privacy and security.

ssldump. ssldump - (de-facto repository gathering patches around the cyberspace)

stalkerware-indicators. Indicators of stalkerware apps

Crescendo. Crescendo is a swift based, real time event viewer for macOS. It utilizes Apple's Endpoint Security Framework.

distorm. Powerful Disassembler Library For x86/AMD64

binee. Binee: binary emulation environment

apple_bleee. Apple BLE research

github-do-not-ban-us. GitHub do not ban us from open source world :iran:

plyara. Parse YARA rules and operate over them more easily.

what_is_this_c2. For all these times you're asking yourself "what is this panel again?"

MalConfScan. Volatility plugin for extracts configuration data of known malware

ghidra_scripts. Scripts for the Ghidra software reverse engineering suite.

ecfs. extended core file snapshot format

ghidra. Ghidra is a software reverse engineering (SRE) framework

CVE-2018-20250. exp for https://research.checkpoint.com/extracting-code-execution-from-winrar

Evil-WinRAR-Gen. Generator of malicious Ace files for WinRAR < 5.70 beta 1

YARA-rules. Some YARA rules i will add from time to time

python-exe-unpacker. A helper script for unpacking and decompiling EXEs compiled from python code.

yara-forensics. Set of Yara rules for finding files using magics headers

emotet_research. C

Windows-Kernel-Explorer. A free but powerful Windows kernel research tool.

vti-dorks. Awesome VirusTotal Intelligence Search Queries

Scylla. Imports Reconstructor

build-your-own-x. Master programming by recreating your favorite technologies from scratch.

AD-Attack-Defense. Attack and defend active directory using modern post exploitation adversary tradecraft activity

Named-Pipe-Sniffer. Mario & Luigi - Tools for sniffing Windows Named Pipes communication

CobaltStrikeForensic. Toolset for research malware and Cobalt Strike beacons

mermaid. Generation of diagrams like flowcharts or sequence diagrams from text in a similar manner as markdown

urh. Universal Radio Hacker: Investigate Wireless Protocols Like A Boss

hopper-scripts. Scripts for Hopper Disassembler

python-netflow-v9-softflowd. PyPI "netflow" package. NetFlow v9 parser, collector and analyzer implemented in Python 3. Developed and tested with softflowd

aa-tools. Artifact analysis tools by JPCERT/CC Analysis Center

dissect.cstruct_legacy. A no-nonsense c-like structure parsing library for Python

auditd. Best Practice Auditd Configuration

veles. Binary data analysis and visualization tool

dwarfcorp. An open-source 3D colony management game for PC, Mac and Linux

sslyze. Fast and powerful SSL/TLS scanning library.

Detours. Detours is a software package for monitoring and instrumenting API calls on Windows. It is distributed in source code form.

rosenbridge. Hardware backdoors in some x86 CPUs

FLIRTDB. A community driven collection of IDA FLIRT signature files

csrstat. Command line tool to get the active System Integrity Protection status

SCTP_NKE_HighSierra. A version of the SCTP NKE running on Mac OS X 10.13 (High Sierra)

SCTP_NKE_ElCapitan. A version of the SCTP NKE running on Mac OS X 10.11 (El Capitan)

PowerSponse. PowerSponse is a PowerShell module focused on targeted containment and remediation during incident response.

URLhaus. Open platform for sharing malware distribution sites

sctp-services. Mock SCTP network services for testing port scanners and clients

misp-book. User guide of MISP

yarp. Yet another registry parser

cutter. Free and Open Source Reverse Engineering Platform powered by rizin

zydis. Fast and lightweight x86/x86-64 disassembler and code generation library

VBscriptInternals. Scripts for disassembling VBScript p-code in the memory to aid in exploits analysis

Manalyze. A static analyzer for PE executables.

malware_configs. Various config files obtained during malware analysis

HexFiend. A fast and clever hex editor for macOS

example.kext. Makefile for building macOS kernel extensions

xnumon. monitor macOS for malicious activity

fsmon. Filesystem monitor tool for Linux/Android iOS/macOS

mac_apt. macOS (& ios) Artifact Parsing Tool

osquery-configuration. A repository for using osquery for incident detection and response

pypykatz. Mimikatz implementation in pure Python

ml. ml runs linux binaries on osx

mach_inject. interprocess code injection for Mac OS X

angr. A powerful and user-friendly binary analysis platform!

LnkParse. Windows Shortcut file (LNK) parser

edb-debugger. edb is a cross-platform AArch32/x86/x86-64 debugger.

misp-warninglists. Warning lists to inform users of MISP about potential false-positives or other information in indicators

msoffcrypto-tool. Python tool and library for decrypting and encrypting MS Office files using passwords or other keys

portal. Ops-Trust Platform - Portal

windows-event-forwarding. A repository for using windows event forwarding for incident detection and response

urlhaus. Python

amsiscanner. A C/C++ implementation of Microsoft's Antimalware Scan Interface

yq. Command-line YAML, XML, TOML processor - jq wrapper for YAML/XML/TOML documents

opensnitch. OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.

asciisciit. ASCII Art, Video, and Plotting Toolbox

mistune. A fast yet powerful Python Markdown parser with renderers and plugins.

OLEPackagerFormat. OLE Package Format Documentation

patat. Terminal-based presentations using Pandoc

vimdeck. VIM as a presentation tool

mdp. A command-line based markdown presentation tool.

macOS-Security-Updates. Notifies the user when macOS Security components like Gatekeeper and XProtect have been updated

openbsm. OpenBSM open audit implementation

pe-sieve. Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

upvote_py2. A multi-platform binary whitelisting solution

yara. The pattern matching swiss knife

malware-ioc. Indicators of Compromises (IOC) of our various investigations

Royal_APT. Royal APT - APT15 - Related Information from NCC Group Cyber Defense Operations Research

retefe. Artefacts from various retefe campaigns

regf. Windows registry file format specification

pentest-wiki. PENTEST-WIKI is a free online security knowledge library for pentesters / researchers. If you have a good idea, please share it with others.

Sticky-Keys-Slayer. Scans for accessibility tools backdoors via RDP

otool-ng. Some improvements to Apple's otool.

EvilOSX. An evil RAT (Remote Administration Tool) for macOS / OS X.

map-macro. A recursive C preprocessor macro which performs an operation on each element of a list

flightsim. A utility to safely generate malicious network traffic patterns and evaluate controls.

DetectionLab. Automate the creation of a lab environment complete with security tooling and logging best practices

rex_versus_the_romans. Anti Hacking Team TrustedBSD module

python-rsa. Python-RSA is a pure-Python RSA implementation.

darling. Darwin/macOS emulation layer for Linux

santa. A binary authorization and monitoring system for macOS

tommyds. A C library of hashtables and tries designed to store objects with high performance

OfficeBrute. OfficeBrute - brute force protected word documents

h2spec. A conformance testing tool for HTTP/2 implementation.

misp-objects. Definition, description and relationship types of MISP objects

mitmproxy. An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.

multidiff. Binary data diffing for multiple objects or streams of data

SadMacScreenSaver. Sad Mac Screen Saver

bsmtrace. BSM based intrusion detection system

jq. Command-line JSON processor

filewatcher. A simple auditing utility for macOS

TheHive. TheHive is a Collaborative Case Management Platform, now distributed as a commercial version

awesome-incident-response-pro-bono. This repository is a curated list of pro bono incident response entities.

misp-taxonomies. Taxonomies used in MISP taxonomy system and can be used by other information sharing tool.

MISP-RPM. RPM packages for MISP

DrK. The DrK Attack - Proof of concept

neopg. The multiversal cryptoengine!

pop-nedry. x86-64 Windows shellcode that recreates the Jurassic Park hacking scene (Ah, ah, ah... you didn't' say the magic word!)

atomic-red-team. Small and highly portable detection tests based on MITRE's ATT&CK.

sigma. Main Sigma Rule Repository

XXEinjector. Tool for automatic exploitation of XXE vulnerability using direct and different out of band methods.

TrickBot-Toolkit. A collection of tools for dealing with TrickBot

malware. Python

asn1js. JavaScript generic ASN.1 parser

trickbot_configs. A collection of all the Trickbot banking trojan configurations that I've collected so far

javalang. Pure Python Java parser and tools

adwind-decryptor. Simple decrypter for Java AdWind, jRAT, jBifrost trojan

Loki. Loki - Simple IOC and YARA Scanner

Responder. Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.

sflock. Sample staging & detonation utility to be used in combination with Cuckoo Sandbox.

CVE-2017-8759. CVE-2017-8759 - A vulnerability in the SOAP WDSL parser.

mosh. Mobile Shell

plasma. Plasma is an interactive disassembler for x86/ARM/MIPS. It can generates indented pseudo-code with colored syntax.

PowerGRR. PowerGRR is an API client library in PowerShell working on Windows, Linux and macOS for GRR automation and scripting.

bokeh. Interactive Data Visualization in the browser, from Python

yarasigs. Various Yara signatures (possibly to be included in a release later).

mispy. Another MISP module for Python

morphHTA. morphHTA - Morphing Cobalt Strike's evil.HTA

phishery. An SSL Enabled Basic Auth Credential Harvester with a Word Document Template URL Injector