Michael Tsai

copy-fail-CVE-2026-31431. Copy Fail (CVE-2026-31431): 9-year-old Linux kernel LPE found by Theori's Xint Code

Chrome-App-Bound-Encryption-Decryption. Bypass Chromium's App-Bound Encryption via Direct Syscall-based Reflective Process Hollowing. Extract cookies, passwords, payment methods & tokens from Chrome, Edge, Brave & Avast - fileless, user-mode, no admin required.

ctf-agent. Autonomous CTF solver that races multiple AI models in parallel. 1st place BSidesSF 2026.

Awesome-AI-Hacking-Agents. List of AI Hacking Agents

gpoParser. gpoParser is a tool designed to extract and analyze configurations applied through Group Policy Objects (GPOs) in an Active Directory environment.

smbtakeover. BOF and Python3 implementation of technique to unbind 445/tcp on Windows via SCM interactions

wspcoerce. wspcoerce coerces a Windows computer account via SMB to an arbitrary target using MS-WSP

Being-A-Good-CLR-Host. C

system-prompts-and-models-of-ai-tools. FULL Augment Code, Claude Code, Cluely, CodeBuddy, Comet, Cursor, Devin AI, Junie, Kiro, Leap.new, Lovable, Manus, NotionAI, Orchids.app, Perplexity, Poke, Qoder, Replit, Same.dev, Trae, Traycer AI, VSCode Agent, Warp.dev, Windsurf, Xcode, Z.ai Code, Dia & v0. (And other Open Sourced) System Prompts, Internal Tools & AI Models

BadSuccessor. PowerShell

Pentest-Tools-Collection. PowerShell

sliver. Adversary Emulation Framework

RedirectThread. Playing around with Thread Context Hijacking. Building more evasive primitives to use as alternative for existing process injection techniques

EDR-Preloader. An EDR bypass that prevents EDRs from hooking or loading DLLs into our process by hijacking the AppVerifier layer

NativeDump. Dump lsass using only NTAPI functions by hand-crafting Minidump files (without MiniDumpWriteDump!!!)

blindsight. Red teaming tool to dump LSASS memory, bypassing basic countermeasures.

Loki. 🧙‍♂️ Node.js Command & Control for Script-Jacking Vulnerable Electron Applications

BFScan. Tool for finding URLs, paths, secrets and generating raw HTTP requests and OpenApi specifications from config files and annotations used in JAR / WAR / APK applications.

convoC2. C2 infrastructure over Microsoft Teams.

ccmpwn. Python

ComDotNetExploit. A C++ proof of concept demonstrating the exploitation of Windows Protected Process Light (PPL) by leveraging COM-to-.NET redirection and reflection techniques for code injection. This PoC showcases bypassing code integrity checks and loading malicious payloads in highly protected processes such as LSASS. Based on research from James Forshaw.

Coercer. A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 12 methods.

Misconfiguration-Manager. Misconfiguration Manager is a central knowledge base for all known Microsoft Configuration Manager tradecraft and associated defensive and hardening guidance.

DEFCON-31-Syscalls-Workshop. Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".

SharpUnhooker. C# Based Universal API Unhooker

Krueger. Proof of Concept (PoC) .NET tool for remotely killing EDR with WDAC

LLM4Decompile. Reverse Engineering: Decompiling Binary Code with Large Language Models

genesis-world. Simulation platform for general-purpose robotics & embodied AI learning.

WADComs.github.io. WADComs is an interactive cheat sheet, containing a curated list of offensive security tools and their respective commands, to be used against Windows/AD environments.

oxml_xxe. A tool for embedding XXE/XML exploits into different filetypes

Certipy. Tool for Active Directory Certificate Services enumeration and abuse

PassTheCert. Proof-of-Concept tool to authenticate to an LDAP/S server with a certificate through Schannel

GOAD. game of active directory

Il2CppDumper. Unity il2cpp reverse engineer

frida-il2cpp-bridge. A Frida module to dump, trace or hijack any IL2CPP application at runtime, without needing the global-metadata.dat file

Cpp2IL. Work-in-progress tool to reverse unity's IL2CPP toolchain.

dnSpy. Unofficial revival of the well known .NET debugger and assembly editor, dnSpy

badsecrets. A library for detecting known secrets across many web frameworks

ddddocr. 带带弟弟 通用验证码识别OCR pypi版

chisel. A fast TCP/UDP tunnel over HTTP

DNN-decompiler. BTD - Bin To DNN: A DNN Executables Decompiler

silent-spring. Silent Spring: Prototype Pollution Leads to Remote Code Execution in Node.js

CVE-2023-4634. CVE-2023-4634

rp. rp++ is a fast C++ ROP gadget finder for PE/ELF/Mach-O x86/x64/ARM/ARM64 binaries.

Amsi-Killer. Lifetime AMSI bypass

HWSyscalls. HWSyscalls is a new method to execute indirect syscalls using HWBP, HalosGate and a synthetic trampoline on kernel32 with HWBP.

ShellGhost. A memory-based evasion technique which makes shellcode invisible from process start to end.

security-research. This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.

Jackalope. Binary, coverage-guided fuzzer for Windows, macOS, Linux and Android

semgrep-rules. A collection of my Semgrep rules to facilitate vulnerability research.

SAST. 《深入理解SAST静态应用安全测试》Static Application Security Testing.

graudit. grep rough audit - source code auditing tool

ImHex. 🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.

semgrep-rules. Java

collisions. Hash collisions and exploitations

pocs. Proof of Concepts (PE, PDF...)

simple-railway-captcha-solver. 實作基於CNN的台鐵訂票驗證碼辨識以及透過模仿及資料增強的訓練集產生器 (Simple captcha solver based on CNN and a training set generator by imitating the style of captcha and data augmentation)

MapleShark. MapleShark is a MapleStory sniffer that works with SharpPcap. Sniff dem packetzz!

GuidedHacking-Injector. The BEST DLL Injector Library.

awesome-game-security. awesome game security [Welcome to PR]

AntiCheat-Testing-Framework. Framework to test any Anti-Cheat

ReClass.NET. More than a ReClass port to the .NET platform.

windows-syscalls. Windows System Call Tables (NT/2000/XP/2003/Vista/7/8/10/11)

Hypervisor-From-Scratch. Source code of a multiple series of tutorials about the hypervisor. Available at: https://rayanfam.com/tutorials

PHP_INCLUDE_TO_SHELL_CHAR_DICT. PHP

Auto_Wordlists. Python

follina.py. POC to replicate the full 'Follina' Office RCE vulnerability for testing purposes

Shhhloader. Syscall Shellcode Loader (Work in Progress)

nanodump. The swiss army knife of LSASS dumping

Covenant. Covenant is a collaborative .NET C2 framework for red teamers.

cloudgoat. CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool

C0deVari4nt. A variant analysis and visualisation tool that scans codebases for similar vulnerabilities

SpringShell. Spring4Shell - Spring Core RCE - CVE-2022-22965

Security-PPT. Security-related Slide Presentation & Security Research Report（大安全各领域各公司各会议分享的PPT以及各类安全研究报告）

tabby. A CAT called tabby ( Code Analysis Tool )

javaweb-sec. Java

http2smugl. Go

slither. Static Analyzer for Solidity and Vyper

publications. Publications from Trail of Bits

SpoolFool. Exploit for CVE-2022-21999 - Windows Print Spooler Elevation of Privilege Vulnerability (LPE)

Source-and-Fuzzing. 一些阅读源码和Fuzzing 的经验,涵盖黑盒与白盒测试..

Pachine. Python implementation for CVE-2021-42278 (Active Directory Privilege Escalation)

joern. Open-source code analysis platform for C/C++/Java/Binary/Javascript/Python/Kotlin based on code property graphs. Discord https://discord.gg/vv4MH284Hc

quine-relay. An uroboros program with 100+ programming languages

xrop. Tool to generate ROP gadgets for ARM, AARCH64, x86, MIPS, PPC, RISCV, SH4 and SPARC

Portspoof. Portspoof

Fuzzing101. An step by step fuzzing tutorial. A GitHub Security Lab initiative

client-side-prototype-pollution. Prototype Pollution and useful Script Gadgets

gau. Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl.

EyeWitness. EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.

OffensiveVBA. This repo covers some code execution and AV Evasion methods for Macros in Office documents

CredBandit. Proof of concept Beacon Object File (BOF) that uses static x64 syscalls to perform a complete in memory dump of a process and send that back through your already existing Beacon communication channel

gadgetinspector. A byte code analyzer for finding deserialization gadget chains in Java applications

Awesome-WAF. Everything about Web Application Firewalls (WAFs) from Security Standpoint! 🔥

weggli. weggli is a fast and robust semantic search tool for C and C++ codebases. It is designed to help security researchers identify interesting functionality in large codebases.

SharpGPOAbuse. SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO.

jwt-hack. JSON Web Token Hack Toolkit

restler-fuzzer. RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services.

gixy. Nginx configuration static analyzer

JDBC-Attack. JDBC Connection URL Attack