f0rb1dd3n/Reptile

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

2718 stars · 579 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Reptile is a Linux kernel module (LKM) rootkit written in C that provides privilege escalation, file/process/network connection hiding, persistence, and a port-knocking backdoor with a full TTY shell. It is intended solely for security research, education, and defensive testing in controlled environments.

Use cases

• study how linux kernel rootkits work
• test rootkit detection tools
• security research on lkm rootkit techniques
• red team lab training environment
• analyze rootkit hiding techniques
• build defensive detections for kernel rootkits

When to choose

• you need a well-known reference rootkit for malware analysis or detection research
• you are running an isolated lab VM to study kernel-level hiding and backdoor techniques
• you want to evaluate antivirus or EDR detection of LKM rootkits

When to avoid

• you want to secure a production system - this is a rootkit, not a defense tool
• you lack explicit authorization for the target system
• you need a supported or licensed project - it has no license and dual-use legal risk
• you run non-Linux or unsupported kernel versions

Facets

library · maturity active

security cryptography security operating-systems penetration-testing cpp rootkit lkm kernel-module backdoor privilege-escalation dual-use security-research malware-analysis linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="f0rb1dd3n/Reptile")