googleprojectzero/sandbox-attacksurface-analysis-tools

Health v2 · maintenance only

Adoption not part of the score

2332 stars · 454 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A suite of PowerShell tools and .NET libraries from Google Project Zero for analyzing Windows sandbox attack surfaces. It includes NtCoreLib/NtObjectManager for inspecting NT objects, tokens, and security descriptors from the perspective of a sandboxed process.

Use cases

• enumerate NT object manager namespace accessible from a sandboxed process
• inspect and manipulate process tokens on Windows
• view security descriptors from SDDL strings
• analyze exposed attack surface of Windows sandboxes
• list and interact with NT kernel objects via PowerShell

When to choose

• you are doing Windows security research or sandbox escape analysis
• you need low-level access to NT system calls and objects from managed code
• you want to enumerate what a sandboxed process can access

When to avoid

• you need a general-purpose vulnerability scanner
• you are not working on Windows
• you want a GUI-only security tool

Facets

cli-tool · maturity active

security penetration-testing reverse-engineering cli security windows developer-tools reverse-engineering windows cli sandbox-analysis attack-surface windows-internals nt-api powershell-module google-project-zero

Member repositories

For agents

markdown · JSON · MCP: product_card(name="googleprojectzero/sandbox-attacksurface-analysis-tools")