All repos — GH Trending Explorer

tklengyel / drakvuf

DRAKVUF Black-box Binary Analysis

timb-machine / linux-malware

Tracking interesting Linux (and UNIX) malware. Send PRs

Washi1337 / AsmResolver

A library for creating, reading and editing PE files and .NET modules.

cisagov / thorium

A scalable file analysis and data generation platform that allows users to easily orchestrate arbitrary docker/vm/shell tools at scale.

morluto / awesome-reverse-engineering

Curated reverse-engineering tools and learning resources for binaries, apps, firmware, formats, and protocols.

mitchellkrogza / apache-ultimate-bad-bot-blocker

Apache Block Bad Bots, (Referer) Spam Referrer Blocker, Vulnerability Scanners, Malware, Adware, Ransomware, Malicious Sites, Wordpress Theme Detectors and Fail2Ban Jail for Repeat Offenders

data-prep-kit / data-prep-kit

Open source project for data preparation for GenAI applications

Bert-JanP / Open-Source-Threat-Intel-Feeds

This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash.

certsocietegenerale / fame

FAME Automates Malware Evaluation

binref / refinery

High Octane Triage Analysis

mrrfv / cloudflare-gateway-pihole-scripts

Use Cloudflare Gateway DNS/VPN to block ads, malware and tracking domains - free alternative to NextDNS, Pi-hole and AdGuard

marcocesarato / PHP-Antimalware-Scanner

AMWScan (PHP Antimalware Scanner) is a free tool to scan php files and analyze your project to find any malicious code inside it.

objective-see / Malware

macOS Malware Collection

kai5263499 / osx-security-awesome

A collection of OSX and iOS security resources

Chocolate4U / Iran-v2ray-rules

Enhanced v2ray/xray and v2ray/xray-clients routing rules with built-in Iranian domains and a focus on security and adblocking.

JoasASantos / Red-Team-Exercises

—

lkimuk / ReArk

An intelligent reverse engineering and AI-assisted analysis tool for HarmonyOS NEXT (HAP/APP/ABC), Android (APK/AAB), iOS (IPA), and native PE/ELF/Mach-O binaries.

horsicq / XAPKDetector

APK/DEX detector for Windows, Linux and MacOS.

0xDanielLopez / TweetFeed

TweetFeed collects Indicators of Compromise (IOCs) shared by the infosec community at Twitter. Here you will find malicious URLs, domains, IPs, and SHA256/MD5 hashes.

chainguard-dev / malcontent

#supply #chain #attack #detection

dmdhrumilmistry / pyhtools

A Python Hacking Library consisting of network scanner, arp spoofer and detector, dns spoofer, code injector, packet sniffer, network jammer, email sender, downloader, wireless password harvester credential harvester, keylogger, download&execute, ransomware, data harvestors, etc.

darama22 / Malware-Research-Hub

Self-contained malware research hub: curated catalog of 80 families (1971-2024) + 2,764 real encrypted samples, indexed and searchable. Local Flask app, bilingual.

Spacial / awesome-csirt

Awesome CSIRT is an curated list of links and resources in security and CSIRT daily activities.

MISP / misp-galaxy

Clusters and elements to attach to MISP events or attributes (like threat actors)

secana / PeNet

Portable Executable (PE) library written in .Net

duggytuxy / Data-Shield_IPv4_Blocklist

Data-Shield provides maintained IPv4 blocklists for inbound filtering on firewalls, gateways and web application firewalls.

Azr43lKn1ght / DFIR-LABS

DFIR LABS - A compilation of challenges that aims to provide practice in simple to advanced concepts in the following topics: Digital Forensics, Incident Response, Malware Analysis and Threat Hunting.

hagezi / dns-servers

HaGeZi DNS: Free, Non-Commercial EU Public DNS Servers

borestad / blocklist-abuseipdb

Aggregated AbuseIPDB blocklists with worst IPv4 & IPv6 offenders (~99% confidence)

lynxthecat / adblock-lean

Lean and powerful adblocking solution for OpenWrt

utmstack / UTMStack

Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.

Sadpainy / Stuxnet

Stuxnet - a super-factory virus discovered in 2010, exploited multiple vulnerabilities and modules. Here reproduced by me. Set work on Windows 7 and Windows XP.

horsicq / Nauz-File-Detector

Linker/Compiler/Tool detector for Windows, Linux and MacOS.

fmhy / FMHYFilterlist

FMHY Filterlist

digitalisx / awesome-memory-forensics

A curated list of awesome Memory Forensics for DFIR

CybercentreCanada / assemblyline

Assemblyline 4: File triage and malware analysis

levelsio / superlevels

A super Chrome extension I made that's safer than installing external malware/spyware-filled extensions that form a massive security risk, this one is open source and you can read and check the source code (with AI) before you install it, and customize it to your liking!

ImKKingshuk / LockKnife

LockKnife: The Ultimate Android Security Research Tool. A unified TUI workspace and headless CLI for deep Android security research, built for researchers and hackers. Powered by Python orchestration and a Rust-accelerated core, enabling AI agent–driven hacking, credential recovery/cracking, APK analysis, intelligence gathering, runtime inspection.

struppigel / PortEx

Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness

zachlagden / Pi-hole-Optimized-Blocklists

Pre-built, deduplicated Pi-hole blocklists merged from curated upstream sources and community reports: a master list plus advertising, tracking, malware and phishing, suspicious, and NSFW categories. Rebuilt weekly.

Karib0u / rustinel

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

tyeurada / edrEvasionWorkshop

Workshop materials for “Step-by-Step Malware Development: Evading EDR from Loaders to the Kernel” presented at DEF CON 34 and BSidesLV 2026. Covers malware development, EDR Architecture, EDR evasion, C2 customization, and kernel-level techniques.

bl4ckr0ss3 / knife

A terminal-first reverse engineering toolkit in Rust: PE/ELF/Mach-O analysis through CLI, TUI, and MCP. Installs as knife.

manyuegong33 / r0crawl_skills

r0crawl_skills is a massive reverse-engineering skill arsenal for web, Android, iOS, Frida, native binaries, protocols, malware, firmware, and anti-analysis—built for beginners, tuned for pros, and engineered for reproducible results.

ADWMC / helm-d

DeepSeek Harness 破甲一体化安全分析插件：Android · Web · Native · Protocol · Malware · AI-Security 全领域聚合（9 bundle + 1 preset）

atomdrift-project / scan

0-day malware detection for binaries, source & scripts (that doesn't suck)

Ablation-Tool / ablation

Ablation is an autonomous reverse engineering system.

dslsdzc / rev-skills

122 个逆向工程 AI 技能：恶意软件分析 / 软件逆向 / 固件嵌入式 / 协议逆向 / 移动应用 / 脱壳反混淆 / 软件破解 / 漏洞挖掘 / 托管代码 / 取证情报 / CTF。

openbin-ai / binny

BINNY: an open source agent harness for reverse engineering. Plug in any model, or a local one.

Whispergate / Labyrinth

Malware as a Service Ludus Range

scottalt / senior-securityengineer-cybersecuritybookmarks

A senior security engineer's actual browser bookmarks. 40+ curated cybersecurity resources for recon, OSINT, exploitation, privilege escalation, and malware analysis.

dahan6 / whetstones-lab

Whetstones Lab: measuring coevolution between adaptive malware and behavioral defense. De-weaponized research release — genomes, evolution rounds, telemetry, training harness (stubbed primitives), and lab range tooling. Payloads, real primitives, and C2 infrastructure intentionally withheld. Research and defensive use only.