Skip to content

A collection of malware, botnets, and other post-exploitation tools.


Static Analyzers

  • Brakeman - Static analysis security vulnerability scanner for Ruby on Rails applications.
  • FindBugs - Free software static analyzer to look for bugs in Java code.
  • Progpilot - Static security analysis tool for PHP code.
  • RegEx-DoS - Analyzes source code for Regular Expressions susceptible to Denial of Service attacks.
  • bandit - Security oriented static analyser for Python code.
  • cppcheck - Extensible C/C++ static analyzer focused on finding bugs.
  • sobelow - Security-focused static analysis for the Phoenix Framework.
  • cwe_checker - Suite of tools built atop the Binary Analysis Platform (BAP) to heuristically detect CWEs in compiled binaries and firmware.

Analysis and reverse engineering

  • theZoo - Repository of live malwares for your own joy and pleasure, created to make the possibility of malware analysis open and available to the public.


  • Idisagree - Control remote computers using Discord bot and Python 3.

Command and Control

(Also known as C2 and C&C.)

  • Browser Exploitation Framework (BeEF) - Command and control server for delivering exploits to commandeered Web browsers.
  • Merlin - Cross-platform post-exploitation HTTP/2 command and control server and agent written in golang.
  • SILENTTRINITY - Asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR.

Credential Stuffing Account Checkers

Also known as Account Takeover (ATO) or account cracking.

  • Black Bullet - Single-threaded account checker with captcha bypass features and Selenium WebDriver support, sold for about $30 to $50. (Reference)
  • Private Keeper - Russian language account checker and takeover tool, sold at prices starting from approximately $1 USD.
  • SNIPR - Windows toolkit for credential stuffing across Web (HTTP/S) and email (IMAP) attack surfaces with the ability to encrypt and re-sell ATO configurations, sold for about $20.
  • STORM - Flexible account checker with Cloudflare protection bypass features written in C#. (Reference)
  • Sentry MBA - Among the oldest and longest in-use account checkers, using OCR for captcha bypass but unable to pass JavaScript anti-bot challenges, sold for between $5 and $20 per configuration file. (Reference)
  • Woxy - Email account checker with built-in support for automating password reset and searching email content for valuable information, now cracked and available free of charge. (Reference)

Data stealers



  • CheckPlease - Sandbox evasion modules written in PowerShell, Python, Go, Ruby, C, C#, Perl, and Rust.


  • TechNowLogger - Windows/Linux keylogger generator which sends key-logs via email with other juicy target info.

Phishing kits

(Also known as phishkits, one word.)

  • ActorExpose/PhishKits - Collection of phishing kits provided to the public to make the Internet a safer environment.

RAM scrapers


See RamScraper for now.



Remote Administration Tools (RATs)

Some Command and Control tools also overlap with RAT software.

(Also known as Remote Access Trojan or post-exploitation agent.)

  • Bella - Pure Python post-exploitation data mining and remote administration tool for macOS.
  • Empire - Pure PowerShell post-exploitation agent built on cryptologically-secure communications and a flexible architecture.
  • EvilOSX - Modular RAT that uses numerous evasion and exfiltration techniques out-of-the-box.
  • Pupy - Low-footprint, cross-platform (Windows, Linux, macOS, Android) RAT featuring all-in-memory execution guideline written in Python.
  • RedPeanut - Small RAT developed in .Net Core 2 and its agent in .Net 3.5/4.0, weaponized with several additional utilities.
  • Slackor - Golang implant that uses Slack as a command and control server.
  • Twittor - Stealthy Python based backdoor that uses Twitter (Direct Messages) as a command and control server.


  • Adore-NG - Rootkit adapted for the 2.6 and 3.x Linux kernels.
  • AdoreForAndroid - Adore rootkit ported to Android.
  • Diamorphine - LKM rootkit for Linux Kernels 2.6.x, 3.x, and 4.x.
  • Masochist - Framework for creating XNU based rootkits useful in OS X and iOS security research.
  • Vector-EDK - Commercial UEFI rootkit illegally sold by Hacking Team to numerous governments, leaked by hacker Phineas Phisher in 2015, and the basis of the MosaicRegressor rootkit.
  • vlany - Linux LD_PRELOAD rootkit.

Web Shells

(Also known as webshells, one word.)

  • BlackArch Webshells Collection - Various webshells that can be installed as a package on BlackArch Linux.
  • DAws - Advanced Web shell.
  • PHP-backdoors - Collection of PHP backdoors, for educational and/or testing purposes only.
  • PHP Exploit Scripts - Collection of PHP exploit scripts (often but not necessarily always backdoors or web shells), found when investigating hacked servers.
  • PHP WebShells collection - Repository of common PHP Web shells, somewhat dated.
  • PhpSploit - Remote control framework, aiming to provide a stealth interactive shell-like connection over HTTP between client and web server.
  • SharPyShell - Tiny and obfuscated ASP.NET webshell for C# web applications.
  • SecLists Web Shells - Examples of core Web shell functionality in PHP, JSP, ASP(X), ColdFusion, and more.
  • Weevely - Extensible PHP Web shell with numerous out-of-the-box modules.