Skip to content
View Real-Fruit-Snacks's full-sized avatar
2 followers · 0 following

Block or report Real-Fruit-Snacks

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
Real-Fruit-Snacks/README.md

Real-Fruit-Snacks

Building offensive security tools — one wave at a time

Portfolio

Python Go C Assembly JavaScript TypeScript Shell

Featured Projects


Siphon

Lightweight C2 — ECDH P-256 forward secrecy, AES-256-GCM encryption, uTLS fingerprinting

Docs Go


Aquifer

Linux post-exploitation — kernel namespace isolation, polymorphic beacons, 36 stealth modules

Docs Go


Riptide

Collaborative browser terminal — real-time sync, credential vault, variable substitution

Docs JS


Vapor

Encrypted reverse shell + Hell's Gate process injector in pure x86_64 NASM assembly

Docs ASM

Streak

C2 & Post-Exploitation

Tool What It Does Language
Kraken OPSEC-first C2 — X25519 ECDH, AES-256-GCM, modular implant with runtime-loadable modules, mesh networking, multi-transport (HTTP/HTTPS/TCP/SMB/DNS), BOF compatibility Rust
Aquifer Linux post-exploitation — kernel namespace isolation, multi-channel C2, polymorphic beacons, 36 stealth modules Go
Siphon Lightweight C2 — ECDH P-256 forward secrecy, AES-256-GCM transport, uTLS Chrome fingerprinting Go
Wellspring Payload delivery server — 12 delivery methods, token-gated access, AES-256-GCM at rest, memory zeroing. Single binary. Go
Spillway Reverse/bind/dormant FUSE mount — browse remote filesystems locally over TLS 1.3 with mutual PSK auth Go

Network & Tunneling

Tool What It Does Language
Flux Swiss Army Netcat — replaces nc/ncat/socat/pwncat. TLS + Noise encryption, auto-PTY shells, file transfer with SHA256, SOCKS5 pivoting, TCP scanning. Single static binary. Rust
Neap Static SSH server — reverse/bind shells with full PTY, SFTP, local/remote/dynamic port forwarding, TLS with SNI spoofing Rust
Undertow Static SSH server — reverse/bind shells, SFTP, port forwarding, TLS wrapping with SNI spoofing. Under 1.5 MB. Go
Slipstream Drop-in SSH wrapper — tunnel management, file transfers, passive filesystem mapping, per-command logging, fingerprint identity Rust
Conduit SOCAT relay with kernel-level process masquerading — prctl/setproctitle stealth, argument hiding, 50+ channel types C
Culvert Pivot under the obstruction — one-command ligolo-ng tunnel setup with TUN, routing, magic 240/4 localhost CIDR, and WebUI Shell
Depth Full SSH-2.0 in pure assembly — ChaCha20-Poly1305, Ed25519, X25519, SFTP, PTY, port forwarding. 94 KB static ELF, no libc. ASM

Shells & Implants

Tool What It Does Language
Vapor Encrypted reverse shell + process injector in pure x86_64 NASM — ChaCha20-Poly1305 AEAD, Hell's Gate syscalls, zero deps ASM
Grotto Encrypted netcat in pure assembly — ChaCha20-Poly1305, Linux ELF + Windows PE, ~8 KB, zero dependencies ASM
Dew HTTPS reverse shell — XChaCha20-Poly1305 over TLS, ~37 KB binary, zero dependencies C
Droplet HTTPS reverse shell for Windows — ~50 KB C implant, AES-256 encryption, interactive Python listener C
Undercurrent io_uring stealth loader in pure assembly — ChaCha20-Poly1305, ~4.2 KB, invisible to syscall monitoring ASM

Enumeration & Exploitation

Tool What It Does Language
Abyss Offensive forensic analysis — credentials, keys, persistence from disk/memory images. SAM, NTDS.dit, LSA, DPAPI, browser passwords, SSH keys, LSASS minidumps. Raw/E01/VMDK with NTFS/ext4. Rust
Flood Async web fuzzer — directory enum, VHost discovery, parameter fuzzing. Recursive scanning, clusterbomb mode, auto-throttle on 429s, JSON/CSV/Hashcat output. Rust
Riptide Collaborative browser terminal — real-time sync, credential vault, variable substitution, session recording, playbook workspace JS
Runoff AD security audit — extract quick wins, attack paths, and misconfigurations from BloodHound CE Python
Maelstrom NetExec wrapper — 35+ AD enumeration modules in one command, multi-target scanning, actionable recommendations Python
Rapids Credential spraying framework — 28 native protocol modules, adaptive skipping, pass-the-hash support Python
Lure SMB hash bait — drops poisoned .url/.scf/.xml payloads on writable shares to coerce NTLM auth via Responder Python
Seep Windows privesc enumeration — 16 checks, 97 tools, MITRE ATT&CK mapping, fileless agent, single-file HTML reports Python
Whirlpool Privesc reasoning engine — parses LinPEAS/WinPEAS output, generates ranked exploitation playbooks Python

Reference & Environments

Tool What It Does Language
Shallows Browser-native Linux terminals — x86 emulation in the browser. No servers, no installs, no accounts. JS
Ripple Browser-based Vim editor — full keybindings via CodeMirror 6, split panes, tabs, virtual filesystem, zero dependencies JS
Deluge Nmap & RustScan parser — color-coded terminal reports, multi-format export, interactive scanning, Catppuccin styling Python
Surge Markdown-to-command-reference — fuzzy search, variable substitution, offline-first PWA, Catppuccin themes JS
Fathom Offline man pages browser — TLDR summaries, instant search, Catppuccin themes. PWA, works without internet. JS
Cascade Native markdown editor — real-time collaboration, live preview, wiki-links, canvas whiteboard, 21+ themes. Tauri + Rust. TS
Sunken-Archive Personal knowledge base — digital garden with interconnected notes, graph view, full-text search. Built on Quartz. TS
HydroShot Screenshot capture & annotation — region select, drawing tools, copy/save. Built with Rust, winit, tiny-skia. Rust
Tidepool Interactive terminal portfolio — explore a developer profile through real shell commands in the browser via xterm.js JS
Deadwater Research publication platform — index, search, and serve computational papers. Full-text search, citation graph, API. TS
x86-assembly-lab Interactive x86 assembly lab — simulator, stack visualizer, register quiz, tutorials from fundamentals to reverse engineering HTML

AI & Enterprise

Tool What It Does Language
armsforge AI-powered security platform — intelligent automation, Claude Code integration, workflow orchestration for offensive operations TS

Multi-Call Binaries

A sail-themed quartet — same idea (BusyBox-style single-binary shell toolkits), four different languages, four different size/portability tradeoffs.

Tool What It Does Language
Rill BusyBox-style multi-call binary in pure x86_64 NASM — 41 Unix utilities, ~34 KB static ELF, direct syscalls, no libc ASM
Topsail Single-file BusyBox-like multi-call binary in Go — ~3.4 MB per platform (Linux/macOS/Windows × amd64/arm64), .deb/.rpm/.apk packages too Go
Jib BusyBox-style multi-call binary in Rust — 73 Unix utilities + jq/http/dig, ~2.4 MB avg (1.4 MB slim → 3.7 MB full) across 11 platform builds Rust
Mainsail BusyBox-style multi-call binary in Python — 73 Unix utilities, ~5.5 MB native bundles (or ~110 KB .pyz with system Python), Linux/Windows/macOS Python

Utilities

Tool What It Does Language
Tidemark Obsidian plugin — variable substitution in markdown via YAML frontmatter. Copy, replace, rename in one command. TS

Games

Tool What It Does Language
Blueprint Browser-based incremental factory game — build, automate, prestige, publish. Zero-dependency vanilla HTML/CSS/JS. JS
Crownfall Pixel-art medieval wave-defense incremental built as a single HTML file. Hold the wall, bank Crowns, return stronger. HTML
Tower-Defense Cyberpunk neon tower defense — 6 elements, 14 towers, procedural campaign, endless mode, roguelite unlocks. Phaser 3 + TypeScript + Vite. TS

Snake

Followers Repos Focus

All tools are built for authorized security testing and educational purposes.

Popular repositories Loading

  1. Riptide Riptide Public

    Collaborative browser-based terminal and playbook workspace for penetration testing, CTF competitions, and red team operations — real-time sync, credential vault, variable substitution, output pars…

    JavaScript 4 1

  2. Siphon Siphon Public

    Lightweight C2 framework for red team operations — ECDH P-256 forward secrecy, AES-256-GCM encryption, uTLS Chrome fingerprinting

    Go 4 1

  3. Aquifer Aquifer Public

    Linux post-exploitation framework using kernel namespace isolation — multi-channel C2 with polymorphic beacons and 36 stealth modules

    Go 2 1

  4. Culvert Culvert Public

    Pivot under the obstruction — one-command ligolo-ng tunnel setup. Auto-downloads binaries, configures TUN, guides routing.

    Shell 1

  5. Deluge Deluge Public

    Advanced parser and formatter for Nmap and RustScan outputs — color-coded terminal reports, multi-format exports, interactive scanning with Catppuccin styling

    Python 1

  6. Whirlpool Whirlpool Public

    Privilege escalation reasoning engine — parses LinPEAS/WinPEAS output and generates ranked exploitation playbooks

    Python 1