A collection of malware, botnets, and other post-exploitation tools.¶
- Static Analyzers
- Analysis and reverse engineering
- Banking trojans
- Command and Control
- Credential Stuffing Account Checkers
- Data stealers
- Phishing kits
- RAM scrapers
- Remote Administration Tools (RATs)
- Web Shells
- Brakeman - Static analysis security vulnerability scanner for Ruby on Rails applications.
- FindBugs - Free software static analyzer to look for bugs in Java code.
- Progpilot - Static security analysis tool for PHP code.
- RegEx-DoS - Analyzes source code for Regular Expressions susceptible to Denial of Service attacks.
- bandit - Security oriented static analyser for Python code.
- cppcheck - Extensible C/C++ static analyzer focused on finding bugs.
- sobelow - Security-focused static analysis for the Phoenix Framework.
- cwe_checker - Suite of tools built atop the Binary Analysis Platform (BAP) to heuristically detect CWEs in compiled binaries and firmware.
Analysis and reverse engineering¶
- theZoo - Repository of live malwares for your own joy and pleasure, created to make the possibility of malware analysis open and available to the public.
- Idisagree - Control remote computers using Discord bot and Python 3.
Command and Control¶
(Also known as C2 and C&C.)
- Browser Exploitation Framework (BeEF) - Command and control server for delivering exploits to commandeered Web browsers.
- Merlin - Cross-platform post-exploitation HTTP/2 command and control server and agent written in golang.
- SILENTTRINITY - Asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR.
Credential Stuffing Account Checkers¶
Also known as Account Takeover (ATO) or account cracking.
- Black Bullet - Single-threaded account checker with captcha bypass features and Selenium WebDriver support, sold for about $30 to $50. (Reference)
- Private Keeper - Russian language account checker and takeover tool, sold at prices starting from approximately $1 USD.
- SNIPR - Windows toolkit for credential stuffing across Web (HTTP/S) and email (IMAP) attack surfaces with the ability to encrypt and re-sell ATO configurations, sold for about $20.
- STORM - Flexible account checker with Cloudflare protection bypass features written in C#. (Reference)
- Woxy - Email account checker with built-in support for automating password reset and searching email content for valuable information, now cracked and available free of charge. (Reference)
- CheckPlease - Sandbox evasion modules written in PowerShell, Python, Go, Ruby, C, C#, Perl, and Rust.
- TechNowLogger - Windows/Linux keylogger generator which sends key-logs via email with other juicy target info.
(Also known as phishkits, one word.)
- ActorExpose/PhishKits - Collection of phishing kits provided to the public to make the Internet a safer environment.
See RamScraper for now.
Remote Administration Tools (RATs)¶
Some Command and Control tools also overlap with RAT software.
(Also known as Remote Access Trojan or post-exploitation agent.)
- Bella - Pure Python post-exploitation data mining and remote administration tool for macOS.
- Empire - Pure PowerShell post-exploitation agent built on cryptologically-secure communications and a flexible architecture.
- EvilOSX - Modular RAT that uses numerous evasion and exfiltration techniques out-of-the-box.
- Pupy - Low-footprint, cross-platform (Windows, Linux, macOS, Android) RAT featuring all-in-memory execution guideline written in Python.
- RedPeanut - Small RAT developed in .Net Core 2 and its agent in .Net 3.5/4.0, weaponized with several additional utilities.
- Slackor - Golang implant that uses Slack as a command and control server.
- Twittor - Stealthy Python based backdoor that uses Twitter (Direct Messages) as a command and control server.
- Adore-NG - Rootkit adapted for the 2.6 and 3.x Linux kernels.
- AdoreForAndroid - Adore rootkit ported to Android.
- Diamorphine - LKM rootkit for Linux Kernels 2.6.x, 3.x, and 4.x.
- Masochist - Framework for creating XNU based rootkits useful in OS X and iOS security research.
- Vector-EDK - Commercial UEFI rootkit illegally sold by Hacking Team to numerous governments, leaked by hacker Phineas Phisher in 2015, and the basis of the MosaicRegressor rootkit.
- vlany - Linux
(Also known as webshells, one word.)
- BlackArch Webshells Collection - Various webshells that can be installed as a package on BlackArch Linux.
- DAws - Advanced Web shell.
- PHP-backdoors - Collection of PHP backdoors, for educational and/or testing purposes only.
- PHP Exploit Scripts - Collection of PHP exploit scripts (often but not necessarily always backdoors or web shells), found when investigating hacked servers.
- PHP WebShells collection - Repository of common PHP Web shells, somewhat dated.
- PhpSploit - Remote control framework, aiming to provide a stealth interactive shell-like connection over HTTP between client and web server.
- SharPyShell - Tiny and obfuscated ASP.NET webshell for C# web applications.
- SecLists Web Shells - Examples of core Web shell functionality in PHP, JSP, ASP(X), ColdFusion, and more.
- Weevely - Extensible PHP Web shell with numerous out-of-the-box modules.