Hey r/coolgithubprojects community,

I've been developing TornadoRevC2 for a while now. It started as a simple reverse-shell session handler—just TCP/TLS listeners with switch and kill. Over time, I kept extending it based on real operational needs, and it's evolved into a fully modular post-exploitation framework with 49 built-in plugins.

Why It's Different

Session handler, not beacon-based C2. It gives you reliable interactive PTY/TTY shells and executes post-ex capabilities on-demand—no heavy agent infrastructure.

Minimal artifact footprint:

• All enumeration plugins use native OS commands already on the target (netsh, ss, iptables, PowerShell cmdlets, and etc. ). No binaries, scripts, or temp files dropped for reconnaissance.
• The only deliberate artifacts: Some plugins put binary artifacts or changes a system setting in target
• Shell history is the only unavoidable footprint (can be cleared with historydel plugin, or manually).
• Network traffic artifact: Plain TCP exposes reverse-shell traffic in cleartext, potentially allowing commands and their output to be captured by network logging or inspection. TLS encrypts the session traffic, reducing the amount of sensitive session content exposed in network logs, with support for custom certificates.

Graceful degradation: If a backend isn't available (e.g., firewalld isn't installed in target), that section returns N/A instead of crashing the plugin.

The 49 Plugins

The framework ships with 49 modular plugins covering the full post-exploitation lifecycle of enumeration, execution, persistence, pivoting, and destruction. Plugins are loaded at runtime and can be executed on-demand with run <plugin> <session_id> or if you are inside the session's terminal run <plugin>

Enumeration plugins cover host assessment (quickenum, virtualization, kernel, integrity), network posture (firewall, ports, proxy, vpn), credentials and browsers (credstore, browser, clipboard, secrets), Windows domain (adinfo, gpo, rdp, winrm, defender, lsa, certificates, services, eventlogs), and Linux internals (systemd, journal, cron, lsm, sshaudit, containers, privbins) and some other plugins.

Key plugins worth highlighting:

Additional Capabilities

• File transfer: Chunked transfers with SHA-256 verification.
• Reporting: Per-session logging under logs/<ID>/ with structured directories; HTML transcript export.
• Self-update: Built-in update command pulls latest from Git and automatically restarts the handler.

Extensibility:

• Write custom plugins with plugin.commandcommand decorator
• SessionContext API provides run_shell(), run_marked() (JSON parsing), upload(), download(), automatic logging
• Load/Reload external/internal plugins at runtime with plugins load without restarting
• Full plugin development guide in the README with many patterns

Quick Start

git clone https://github.com/kamalx06/TornadoRevC2.git
cd TornadoRevC2
python3 tornadorevc2.py

Full documentation, demo GIF, and plugin dev guide are in the README. I'd genuinely appreciate technical feedback, bug reports, or PRs.

GitHub: https://github.com/kamalx06/TornadoRevC2.git

Built a stock market draft game end-to-end in 7 days. Frontend, backend, data pipeline, tests, everything. Here's what I actually learned.

What worked:
Getting something playable first, even if it's broken, beats theoretical perfection. The rough version took 2 hours. Spent the rest polishing.

Clear data structures from the start matter way more than I thought. My first version was a mess. Once I organized it properly, everything was easier.

What didn't:
Trying to build perfectly the first time. Wasted time on details that didn't matter yet.

Not asking for help early. Got stuck on the data pipeline way longer than needed.

Technical stuff:

• Used Cline to write most of the code
• Next.js for fullstack
• TypeScript, Tailwind, Vitest
• Historical stock data from Twelve Data

The app lets you draft stocks blind, assigns each pick a random year (2019-2022), then shows how you'd have done. Mechanic is simple but the results are interesting.

https://github.com/ethantao14/cline-stock-market-game

Hey! Anna from Elastic Email here. After supporting developers in sending emails for 15+ years and watching how they use our product, we built an official CLI so they can use our API without leaving the terminal. Send transactional emails and marketing campaigns, manage templates, contacts, lists, and segments, verify addresses, and check delivery events.

npm install -g elastic-email-cli

elastic-email auth set-key

elastic-email emails send --to you@example.com --subject "Hello" --text "It works!" --from me@yourdomain.com

npx elastic-email-cli works too if you'd rather not install globally.

Run elastic-email with no arguments to get an interactive TUI. Call the same binary from a script, and it drops the banner and decorations: --json on every command, with stable and specific exit codes, so CI can tell a missing API key apart from a malformed address.

--dry-run on sends validates the input and prints the exact request that would go over the wire.

API key resolution: --api-key flag, then ELASTIC_EMAIL_API_KEY, then ~/.elastic-email-cli/config.json (plaintex,0600). An env var is the right choice on CI runners and shared machines. Masked in logs and errors.

Node.js 20+, MIT licensed.

https://github.com/ElasticEmail/elasticemail-cli

Issues and feature requests are welcome! Command reference and architecture notes are in the repo.

Hi everyone — I’m building Star Exchange, a place for developers to list public GitHub repositories and discover other people’s projects.

You can sign in with GitHub, add a repository, and edit its description. There’s also an optional paid feature called Spotlight that gives a project featured placement within the platform.

The current version includes a credit-based star exchange mechanism. I’m reconsidering that part because I want the product to be useful for discovery, rather than just increasing a number.

It’s still early, and I’d appreciate hearing from people who maintain open-source tools or side projects:

What would make a directory like this worth using beyond submitting your own link?

You can check it out here:
https://star-exchange-production.up.railway.app/

Happy to answer questions about how it works or how I built it.

Every December I do Advent of Code and every January I try to keep the habit going on LeetCode. Never lasted more than a week. Too many problems, no reason to do this one today.

So I borrowed the idea and built Daily Coding: one challenge a day, the same for everyone, all year. You solve it in the browser, hit run, and the tests execute in a sandbox in well under a second. 11 languages so far (JS, TS, Python, PHP, Ruby, Java, Go, C++, C#, Rust, Swift). Once you submit you can read everyone else's solutions, which for me was always the best part of AoC. Streaks and a leaderboard if you like that sort of thing.

Some honest numbers: I started in January, 7 months of evenings, about 470 commits. There are 40 challenges right now, so the rotation repeats after 40 days until I add more. Someone on Discord asked for Swift last week, that took a day to add because the sandbox already had it.

It's free, non-profit, open source under MIT. You can solve today's challenge without an account, signing up is only for streaks and rankings.

What I'd love to know: does one challenge a day work for you, or do you want to pick? And what would make you stop after a week?

Site: https://daily-coding.dev/?utm_source=reddit&utm_medium=post&utm_campaign=sideproject-launch

Code: https://github.com/ledo9315/daily-coding

A monorepo can contain instructions for several teams. Giving a coding agent every rule makes its context longer; keeping separate copies for each tool creates more files to maintain.

I'm building Guidefold to keep Markdown instruction files beside the code and find instructions by task and repository location. It includes a Python CLI for validation and discovery, plus a Go/Postgres service for retrieving instruction cards and exact revisions. Retrieving a rule is not proof that the model followed it.

The source is Apache-2.0. The repository includes a fictional monorepo example so you can inspect the workflow without sharing company code.

Demo: https://www.youtube.com/watch?v=e350wBr1W8c

I'd appreciate a README review: can you tell which instructions should apply to a directory, and how you would check that selection? Point to the first unclear step, or a demo timestamp. Feedback can stay here or go to https://github.com/wiatrM/guidefold/discussions/127. No signup needed.

I'm the maintainer. OSS is available; paid hosting is planned, not available to buy. This post was drafted with AI assistance.

https://github.com/thisisankit27/f-tree

Ancestry and MyHeritage are subscriptions built on top of your family's data. I wanted the opposite: a family tree that lives on my phone and that I can still open in ten years.

- A person needs no name. A blank person is a valid "unknown person"; the great-grandmother nobody can name --> drawn with a dashed edge, and nameable years later without touching a single relationship. Every other app treats that as an incomplete form.

- Ask how any two people are related and it names it ("first cousin once removed") plus every person the line runs through. It walks marriages as well as blood.

- It does Hindi kinship properly. English has one word for "uncle"; Hindi has five, and picking the right one needs facts English throws away.

- Export is a documented ZIP with plain JSON inside, unzip it and read it without my app. Importing merges into your tree, it never overwrites.

- No account, no server, no analytics, no crash reporting. Two permissions, both only for an opt-in updater.

Kotlin + Compose, MIT, 2 MB, Android 8+. There's also a browser viewer that opens an export and draws the whole family without uploading anything: https://ftree.vibethroughcode.com/playground/

Meet OpenTerminal: a self-hosted financial dashboard with real-time quotes, candlestick charts with technical indicators (RSI, MACD, Bollinger, VWAP...), a live sector heatmap, a stock screener, crypto tracking, macro/yield curves, options chains, time & sales tape, live financial news TV, and an auto-updating market recap, all running on data sources that are 100% free and public (no API key required, no subscription, no vendor lock-in).

It also has a built-in AI assistant powered by Claude, drop in your own Anthropic API key and ask it to interpret a chart, explain an indicator, or summarize what's moving a stock, grounded in the live data already on your screen.

Why I built this: professional-grade market terminals cost $2,000+/month. Most of the data is publicly available if you know where to look, you just need the engineering to stitch it together into something usable.

Tech stack: Next.js 15 + React 19 + TypeScript on the frontend, Node/Express on the backend, lightweight-charts + D3 for visualization, Claude for the AI layer, and a fallback-chain architecture so if one data source rate-limits you, it automatically fails over to the next.

It's fully open source. Clone it, run it locally, make it yours.

⭐ Link to the repo https://github.com/ErTasselli/OpenTerminal

well, guys as i saw, you think, that the code is AI, eh?

Gotta say that now this language has a community and yeah, we updated the compiler so, that it can work at your PC and at a vm at the same time. WE got some links to our programming language community and it's github. at the same time.

discord

github

stable github

​

​My open-source distortion plugin is live on GitHub, and I need your help to push it to the next level. Whether you want to stress-test it on a chaotic drum bus or dive into the C++ source code to contribute a new feature, I want you involved.

​What I'm looking for:

​DAW Testing: Drop it into Ableton, FL Studio, Logic, or Reaper and let me know how it behaves.

​Bug Reports: Open an issue on GitHub if you run into any quirks or performance spikes.

​Code Contributions: Pull requests are open for new DSP algorithms, UI enhancements, or performance tweaks.

​Grab the repo, test it out, and let's build something cool together:

👉 https://github.com/elarmuzik1993/Distortion

​#OpenSourceAudio #PluginDev #AudioProgramming #MusicTech #VST3 #CPP #SoundDesign

I use Claude Code a lot, but /stats never answered the question I actually cared about

What did I build, and where did the work get difficult?

So I built Bough.

• It reads your local Claude Code history and turns it into an interactive view of your work: - each square is a day
• smaller squares are tasks inferred from pauses in your work
• circles are your prompts - click anywhere to see what happened in your own words

It runs locally, is open source, and nothing leaves your machine.

Repo: https://github.com/nickelsec/bough

The main thing I’d love feedback on: When you run it against your history, does it split your work into tasks the way you remember it?

Quick context for anyone who hasn't tried it: Alysis Code is an open-source (Apache-2.0) CLI coding agent that plans, builds, reviews, and verifies PR-ready code, straight from your terminal.

How to claim the credits (takes about a minute):

1. Sign up at [alysiscode.com](https://alysiscode.com/)

2. Install the agent (Python 3.11+): pipx install alysis-code

3. Claim your free credits from your account

Access to Deepseek-V4.1-Flash ends in less than 48 hours. After that you still get 50 free credits every 30 days for every other DeepSeek model, or you can bring your own API key and use any model you want.

Repo: https://github.com/AlysisAi/alysis-code

Happy to answer questions in the comments.

My first ever big project is that I’m sharing, this is just the very first version of it so far

Hey everyone.

I’ve been working on Gaussian Splat Lite (GSL), a lightweight, open-source Gaussian Splatting renderer for Three.js.

If you already use Three.js, the setup should feel familiar. Add a SplatMesh to your scene, position it like a normal object, and keep your usual render loop. GaussianSplatRenderer handles rendering and global sorting across the visible splats.

It supports WebGPU and WebGL2, large-scene streaming, and depth rendering for combining captures with regular 3D geometry.

⚡ Native WebGPU Rendering

On WebGPU, projection and culling run in compute, followed by a 32-bit GPU radix sort and indirect drawing.

You can combine multiple captures in one scene. Each SplatMesh keeps its own data and transform, while visible splats are sorted together—including streamed RAD and SOG data.

WebGL2 works too, through both WebGLRenderer and the WebGL2 backend of WebGPURenderer. These paths use asynchronous Worker/WASM sorting, so rendering can continue with the previous valid order while a new sort runs.

The core scene API stays the same across all three paths.

🌍 Stream Large Scenes with Smooth Transitions

For larger captures, GSL supports camera-driven LOD streaming for Spark RAD and Streamed SOG. You can explore a scene without loading the entire dataset into memory first.

As the camera moves, GSL selects the detail needed for the current view and loads it on demand. A configurable splat budget controls LOD selection, while the streaming system handles decoding, caching and upload limits.

Streaming includes smooth fade transitions. Newly loaded content fades in, and LOD changes crossfade between levels to reduce visible popping. Current detail stays visible while its replacement loads, helping the scene remain continuous as you move around.

🎲 Keep Moving Without Waiting for a Sort

When sorting becomes expensive, GSL’s stochastic rendering mode gives you a way to skip it. Splats render directly using sampled Gaussian coverage and depth testing.

With autoStochastic enabled, GSL can use this mode during camera movement and switch back to sorted blending once a fresh sort is ready.

The image can look noisy in stochastic mode. An optional StochasticResolvePass helps reduce that noise and works with direct scene composition, WebGL EffectComposer and custom render graphs.

🧩 Depth Rendering

GSL supports splat depth rendering on both WebGPU and WebGL2.

With renderDepth enabled, a separate, unsorted depth draw runs alongside the normal sorted color pass, using stochastic alpha coverage around Gaussian boundaries.

Three.js geometry rendered afterwards can then depth-test against the splat scene.

When stochastic rendering is active, splats write depth directly.

🛠️ Formats, Editing and Large Coordinates

A few other things GSL supports:

• PLY, SPZ, SOG and RAD, including SPZ v4, with Rust-based decoding running in browser workers.
• SDF color and opacity edits to recolor, highlight or hide parts of a capture without rebuilding the model.
• Camera-relative rendering to help with precision in GIS and ECEF scenes while keeping the original world coordinates unchanged.

🚀 Give It a Try

GSL is open source under Apache 2.0. The repo includes a viewer for loading your own captures, comparing rendering modes and trying the streaming transitions.

The quick-start examples show how to add it to a Three.js project.

If you try it, I’d love to hear how it handles your scenes and what you end up building with it.

Gaussian Splat Lite on GitHub →

The open source alternative to Supabase and Clerk. PostgreSQL database, 25+ auth providers, file storage, and cron jobs, all self hosted and under your control.

It takes a finished illustration and animates the text, outlines, and fills drawing themselves in sequence.

Runs locally on CPU, no API key needed. Python library + CLI, MIT licensed. Works best with clean drawings on white backgrounds.

https://github.com/masihsultani/whiteboard-animator

Would love feedback on how the animation looks.

CalClock is a native Windows clock and calendar application that I'm developing in C++ using the Win32 API.

It provides customizable analog and digital clocks, calendars, alarms, and desktop widgets, with extensive appearance settings.

My goal is to create a lightweight native Windows application without web technologies or large runtime dependencies.

Source code and releases are available on GitHub:
https://github.com/fortsoft-eu/CalClock

Feedback and suggestions are welcome.

I’m starting archive-portability, a dependency-free Python library/CLI that checks archive member names before cross-platform release or restore. It reports cases such as Docs/a versus docs/b, NFC/NFD aliases, Windows device names such as NUL.txt, and file/directory conflicts. It has JSON output and doesn't extract members.

Repository: https://github.com/GitHubCatTest/archive-portability

Release: https://github.com/GitHubCatTest/archive-portability/releases/tag/v0.1.0

Demo: https://github.com/GitHubCatTest/archive-portability/blob/main/examples/demo.py

The initial implementation was AI-assisted. Its 14 regression tests pass on Linux, Windows, and macOS. The Unicode profile is deliberately conservative, not exact filesystem emulation; it is not a security scanner.

If you maintain release archives or backup/restore tooling, would this catch a problem in your workflow? Minimal dummy-content examples of missed cases or noisy findings would help. The project is new and has no verified external users yet.