The Witchcraft Compiler Collection (WCC) is a binary analysis and modification toolkit focused on ELF executables. It provides three primary tools: wld converts executables to shared libraries, wcc 'unlinks' binaries into relocatable objects, and wsh offers an interactive Lua-scriptable shell for runtime binary inspection and modification. The architecture is modular with shared utilities, leveraging BFD for binary format abstraction, Capstone for disassembly, and Lua/JIT for extensibility. Key capabilities include section/header manipulation, symbol table management, relocation processing, and cross-architecture analysis via Qemu user-mode emulation. WCC demonstrates strong craftsmanship in its Lua-C API extension patterns, sophisticated ELF handling, and modular tool design. The wsh tool's Lua integration exposes binary analysis functions (memory access, symbol lookup, section iteration) through a clean C extension interface. The wld tool implements robust ELF section/header manipulation and relocation processing with careful attention to binary format details. The disassembler wrapper in disasm.c provides multi-architecture support while maintaining integration with WCC's data structures. These components show non-obvious skill in binary manipulation and language embedding. The project shows active maintenance with commits up to 2026 and updated copyright notices. Technical drift is low due to recent updates and compatibility with modern dependencies (Lua 5.3, Capstone). While focused on Linux/ELF and primarily x86_64, the code maintains portability through conditional compilation and abstracted binary handling. The build system uses Makefiles with git submodules for dependency management, and the MIT-licensed codebase includes comprehensive documentation and demonstration materials for security research use cases.
KeyDive is a Python-based CLI tool designed for extracting Widevine L3 DRM keys from Android devices. It operates by establishing an ADB connection to a rooted device, injecting a Frida JavaScript script into the Widevine Content Decryption Module (CDM) process, and hooking specific native functions to intercept cryptographic material (client IDs, private keys, keyboxes). The tool supports multiple provisioning methods (Keybox, OTA, OEM Certificate) and exports data in formats compatible with pywidevine (.wvd). It is primarily used for DRM research, security analysis, and educational purposes regarding digital rights management on Android. The architecture consists of a Python core (`keydive.core.Core`) that manages device communication and Frida sessions, a JavaScript injection script (`keydive.js`) that performs the actual memory interception and data extraction, and a suite of modules (`keydive.drm`) for parsing and serializing DRM-specific binary formats like KeyBox and WVD. The tool handles complex C++ memory layouts (std::string, std::vector) across different Android ABIs and SDK versions, demonstrating significant reverse engineering capability.
XMap is a high-performance network scanner designed for Internet-wide IPv4 and IPv6 address space scanning. It is a reimplementation and improvement of ZMap, featuring a modular architecture with interchangeable probe modules (ICMP, TCP, UDP, DNS), output modules (CSV, JSON, Redis), and interface identifier (IID) modules for target address generation. The tool uses cyclic groups for efficient, non-sequential address traversal, AES-based validation to prevent response spoofing, and Bloom filters for duplicate packet detection. It is actively used in security research and has been presented at multiple academic conferences. The repository contains significant code duplication among DNS probe modules, which increases maintenance burden.
The LOLBAS project is a curated dataset of Windows binaries, scripts, and libraries that can be abused for malicious purposes (Living Off The Land Binaries and Scripts). Each entry is documented in YAML files with a standardized schema, including technical details, use cases, MITRE ATT&CK mappings, detection artifacts, and external references. The repository serves as a threat intelligence resource for offensive security research and defensive security operations, enabling threat hunting and detection rule development. Data is organized by file type (binaries, libraries, scripts) and maintained through community contributions with automated validation via Pydantic schemas.
This repository is a curated 'awesome list' of password cracking tools, research, and resources — not a software application. The primary artifact is a single, comprehensive README.md that catalogs ~150 tools and resources across 15+ categories: hashcat automation/distributed cracking/rules, John the Ripper tooling, cloud-based cracking (AWS/Colab), wordlist generators and analyzers, hash conversion utilities, ML/AI password guessing models, academic papers (2009-2026), and notable researchers in the field. The list is alphabetically sorted, CC0-licensed, and maintained by a human curator who explicitly rejects AI-generated contributions. The repo's engineering value lies in its community governance infrastructure. A GitHub Actions workflow (pr-quality.yaml) uses peakoss/anti-slop to automatically detect and close AI-generated or spam PRs, enforcing account age, profile completeness, PR size limits, and maintainer-can-modify permissions. A second workflow runs awesome-lint to enforce list formatting standards. The PR template requires AI self-disclosure via a magic string. This governance stack is a genuinely reusable pattern for any community-curated repository facing AI slop. The content is current (papers through 2026) and the repo is actively maintained with zero open issues. While it contains no application code, it serves as a high-value reference index for security researchers, penetration testers, and anyone working on password recovery or authentication security. The hybrid nature: it's a curated data resource (the list itself) wrapped in application-grade CI/CD governance.
Unicorn Engine is a lightweight, multi-architecture CPU emulation framework derived from QEMU. It provides a pure C API with bindings for Python, Go, Java, Rust, Ruby, .NET, Haskell, Pascal, Zig, and VB6. The engine supports ARM, ARM64, M68K, MIPS, PowerPC, RISC-V, S390X, SPARC, TriCore, and x86 (16/32/64-bit). It is used primarily for security research, reverse engineering, fuzzing, and dynamic analysis of binary code. The architecture is a library with a central C API that exposes memory mapping, register access, hooks (code, block, memory, interrupt, instruction, syscall, TLB), and context save/restore. The core emulation logic is based on QEMU's TCG (Tiny Code Generator) for dynamic binary translation, with a custom glib compatibility layer to eliminate external dependencies. The repository includes extensive regression tests, fuzz targets, and sample programs for each architecture and binding. While the engine is actively maintained and widely used, it carries technical debt from its QEMU fork (based on QEMU 5.0.1) and auto-generated binding constants that may drift from the C API.
Wirebrowser is an Electron desktop application that provides an integrated runtime instrumentation platform for web applications, built entirely on the Chrome DevTools Protocol (CDP). In production, it acts as a unified debugger, memory inspector, network interceptor, and automation runner for JavaScript running in Chromium-based browsers. The application launches a headless or headful Chrome instance via Puppeteer-core, attaches CDP debuggers to multiple pages, and presents a rich GUI (React, Ant Design, Monaco Editor, AG Grid) through an Electron window. The architecture follows a modular event-driven design: core back-end modules (Heap, Debugger, Network, Automation) are loaded by a ModuleManager and communicate with the front-end via custom DOM events and Electron IPC. The debugger module implements a sophisticated hook system that injects user-defined JavaScript callbacks on function entry/leave/return without monkeypatching, using CDP breakpoints and a state machine to serialize asynchronous events. The heap module supports both live object search (via injected QueryObjects) and offline snapshot analysis with object similarity matching (Jaccard/Dice/SimHash) for origin tracing. Key data flows include user-defined automation scripts (Node-side or browser-side) that interact with pages through the WB.Node and WB.Browser APIs, network requests that can be intercepted and modified in real-time, and memory snapshots that are queried for structural matches across multiple snapshots (BDHS). External dependencies are heavy: Puppeteer (bundled Chrome), AG-Grid (community), Monaco Editor, Ant Design, lowdb, and several CDP-specific features that lock the tool to Chromium. The project is primarily targeted at security researchers, reverse engineers, and advanced frontend developers who need introspection beyond standard DevTools.
This repository is a collection of blog posts, presentations, Jupyter notebooks, and scripts by John Lambert (@JohnLaTwC), a renowned security engineer from Microsoft. It serves as a knowledge base for security defenders, covering topics such as attack graph theory, the MS08-067 vulnerability story, and the 'Githubification of InfoSec' concept, which advocates for open, community-driven security practices using MITRE ATT&CK, Sigma rules, and Jupyter notebooks. The notebooks focus on malware analysis, shellcode reverse engineering, and threat hunting, often leveraging VirusTotal APIs and custom disassembly tools. The Yara rules provide detection for document-based attacks. The PowerShell scripts are utilities to restore Windows Defender to a secure configuration. While the content is highly educational and demonstrates deep security expertise, the repository does not constitute a structured application or a reusable data pipeline; it is a curated set of resources for learning and reference.
SecLists is a massive, curated collection of security testing wordlists and payloads, not a software application. It serves as a companion dataset for penetration testers and security researchers, aggregating lists of usernames, passwords, URLs, fuzzing payloads, web shells, and other sensitive data patterns into a single repository. The 'architecture' is purely organizational: a directory tree of text files grouped by category (e.g., Passwords, Fuzzing, Discovery, Payloads), supplemented by a set of maintenance scripts in `.bin/` for updating lists from remote sources, validating file integrity, and automating contributions via GitHub Actions. The primary 'data flow' is curation: lists are sourced from external projects (e.g., FuzzDB, RAFT, Probable-Wordlists, sqlmap), committed to the repo, and periodically refreshed by automated scripts. There are no models, analytics, or dashboards produced. The repository's value lies entirely in the breadth and quality of its aggregated lists. Maintenance is active, with commits as recent as June 2026 and automated hourly/daily update workflows for select lists (JWT secrets, API endpoints, etc.). However, from a data engineering perspective, the repo has significant limitations. There is no dependency management (no requirements.txt, Dockerfile, or environment spec), no data validation beyond basic newline/empty-line checkers, and no documentation of data lineage or update frequency for the vast majority of lists. Many READMEs are outdated or reference defunct sources. The collection is highly heterogeneous: some lists are meticulously curated and documented, while others are raw dumps with no metadata. There are no tests, no schema definitions, and no quality metrics. The `.bin/` scripts are functional but minimal—straightforward Python and shell scripts for fetching remote files and checking formatting, none of which demonstrate non-obvious engineering craftsmanship. In summary, SecLists is an invaluable reference dataset for the security community, but it is not a data pipeline or analytical project. It is a file repository with light automation, judged by data engineering standards: low reproducibility, minimal documentation, no dependency management, and no data quality framework beyond basic file hygiene.
This repository is not a software application or a data pipeline; it is a document archive of cybersecurity publications, mostly in Spanish, authored or co-authored by Dr. Alfonso Muñoz. The content includes books and reports on SSL/TLS protocol attacks and cryptanalysis, stegomalware and antivirus evasion via steganography, offensive prompt engineering, AI-applied threat intelligence, and RADIUS protocol vulnerabilities. There are no source files, no README, no build configuration, and no tests; the only non-PDF item is a single JPEG image and the .git directory itself.