Add: cgosec/Blauhaunt to DFIR section

2024-10-01 07:45:36 -04:00 · 2024-04-21 16:21:15 +07:00 · 2024-01-02 15:29:58 +07:00 · 2017-12-14 15:43:06 +07:00 · 2024-01-02 15:44:16 +07:00 · 2017-11-09 23:11:18 +07:00
diff --git a/.github/workflows b/.github/workflows
pe3zx 15200f308b Add: cgosec/Blauhaunt to DFIR section		2024-04-21 16:21:15 +07:00
.github/workflows	Allow links response with 403	2024-01-02 15:29:58 +07:00
CODE_OF_CONDUCT.md	Create CODE_OF_CONDUCT.md	2017-12-14 15:43:06 +07:00
cover.png	File permissions update	2024-01-02 15:44:16 +07:00
LICENSE	Initial commit	2017-11-09 23:11:18 +07:00
Offensive.md	Add: SpectorOps/Nemesis to C2 section	2024-03-10 17:06:18 +07:00
README.md	Add: cgosec/Blauhaunt to DFIR section	2024-04-21 16:21:15 +07:00
Link	Description
activeshadow/go-atomicredteam	go-atomicredteam is a Golang application to execute tests as defined in the atomics folder of Red Canary's Atomic Red Team project
alphasoc/flightsim	A utility to generate malicious network traffic and evaluate controls
Attack Simulatorin Office 365	Simulate realistic attacks on Office 365 environment
Azure/Cloud-Katana	Unlocking Serverless Computing to Assess Security Controls
BinaryDefense/beacon-fronting	A simple command line program to help defender test their detections for network beacon patterns and domain fronting
blackbotinc/Atomic-Red-Team-Intelligence-C2	ARTi-C2 is a post-exploitation framework used to execute Atomic Red Team test cases with rapid payload deployment and execution capabilities via .NET's DLR.
Blue Team Training Toolkit	Blue Team Training Toolkit (BT3) is designed for network analysis training sessions, incident response drills and red team engagements
carbonblack/excel4-tests	Carbon Black TAU Excel 4 Macro Analysis
center-for-threat-informed-defense/adversary_emulation_library	An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs.
Coalfire-Research/Red-Baron	Automate creating resilient, disposable, secure and agile infrastructure for Red Teams
Cyb3rWard0g/Invoke-ATTACKAPI	A PowerShell script to interact with the MITRE ATT&CK Framework via its own API
Cyb3rWard0g/mordor	Re-play Adversarial Techniques
chryzsh/DarthSidious	Building an Active Directory domain and hacking it
d3vzer0/reternal-quickstart	Repo containing docker-compose files and setup scripts without having to clone the individual reternal components
Datadog/stratus-red-team	☁️ ⚡ Granular, Actionable Adversary Emulation for the Cloud.
ElevenPaths/ATTPwn	ATTPwn is a computer security tool designed to emulate adversaries.
endgameinc/RTA	RTA provides a framework of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK
FourCoreLabs/firedrill	firedrill is a malware simulation harness for evaluating your security controls
fozavci/tehsat	Tehsat Malware Traffic Generator
FSecureLABS/leonidas	Automated Attack Simulation in the Cloud, complete with detection use cases.
JonathanSalwan/Triton	Triton is a dynamic binary analysis library. Build your own program analysis tools, automate your reverse engineering, perform software verification or just emulate code.
jymchoeng/AutoTTP	Automated Tactics Techniques & Procedures
lawrenceamer/0xsp-Mongoose	a unique framework for cybersecurity simulation and red teaming operations, windows auditing for newer vulnerabilities, misconfigurations and privilege escalations attacks, replicate the tactics and techniques of an advanced adversary in a network.
microsoft/restler-fuzzer	RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services.
MiladMSFT/ThreatHunt	ThreatHunt is a PowerShell repository that allows you to train your threat hunting skills.
mitre/caldera	An automated adversary emulation system
mvelazc0/PurpleSharp	PurpleSharp is a C# adversary simulation tool that executes adversary techniques with the purpose of generating attack telemetry in monitored Windows environments
NextronSystems/APTSimulator	A toolset to make a system look as if it was the victim of an APT attack
NextronSystems/ransomware-simulator	Ransomware simulator written in Golang
n0dec/MalwLess	Test blue team detections without running any attack
OTRF/Microsoft-Sentinel2Go	Microsoft Sentinel2Go is an open source project developed to expedite the deployment of a Microsoft Sentinel research lab.
OTRF/SimuLand	Cloud Templates and scripts to deploy mordor environments
praetorian-code/purple-team-attack-automation	Praetorian's public release of our Metasploit automation of MITRE ATT&CK™ TTPs
qsecure-labs/overlord	Overlord - Red Teaming Infrastructure Automation
ReconInfoSec/adversary-emulation-map	Creates an ATT&CK Navigator map of an Adversary Emulation Plan
redcanaryco/atomic-red-team	Small and highly portable detection tests based on MITRE's ATT&CK.
redcanaryco/AtomicTestHarnesses	Public Repo for Atomic Test Harness
redcanaryco/chain-reactor	Chain Reactor is an open source framework for composing executables that simulate adversary behaviors and techniques on Linux endpoints.
redhuntlabs/RedHunt-OS	Virtual Machine for Adversary Emulation and Threat Hunting
RedTeamOperations/RedCloud-OS	RedCloudOS is a Cloud Adversary Simulation Operating System for Red Teams to assess the Cloud Security of Leading Cloud Service Providers (CSPs)
nickzer0/RedLab	Files for red team lab infrastructure.
ScarredMonk/SysmonSimulator	Sysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detections and correlation rules by Blue teams.
SecurityRiskAdvisors/VECTR	VECTR is a tool that facilitates tracking of your red and blue team testing activities to measure detection and prevention capabilities across different attack scenarios
SpiderLabs/sheepl	Sheepl : Creating realistic user behaviour for supporting tradecraft development within lab environments
splunk/attack_range	A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk
splunk/salo	Synthetic Adversarial Log Objects: A Framework for synthentic log generation
Splunk Boss of SOC	Splunk Boss of SOC
swimlane/atomic-operator	A Python package is used to execute Atomic Red Team tests (Atomics) across multiple operating system environments.
swimlane/soc-faker	A python package for use in generating fake data for SOC and security automation.
TryCatchHCF/DumpsterFire	"Security Incidents In A Box!" A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events.
uber-common/metta	An information security preparedness tool to do adversarial simulation.
Unfetter	Unfetter is a project designed to help network defenders, cyber security professionals, and decision makers identify and analyze defensive gaps in a more scalable and repeatable way
warhorse/warhorse	Warhorse consists of a fully-featured Ansible playbook to deploy infrastructure in the cloud for conducting security assessments.
Link	Description
aboul3la/Sublist3r	Fast subdomains enumeration tool for penetration testers
Acheron-VAF/Acheron	Acheron is a RESTful vulnerability assessment and management framework built around search and dedicated to terminal extensibility.
ambionics/phpggc	PHPGGC is a library of unserialize() payloads along with a tool to generate them, from command line or programmatically.
anchore/grype	A vulnerability scanner for container images and filesystems
appsecco/spaces-finder	A tool to hunt for publicly accessible DigitalOcean Spaces
anatshri/svn-extractor	Simple script to extract all web resources by means of .SVN folder exposed over network.
aquasecurity/kube-hunter	Hunt for security weaknesses in Kubernetes clusters
aquasecurity/trivy	A Simple and Comprehensive Vulnerability Scanner for Container Images, Git Repositories and Filesystems. Suitable for CI
ARPSyndicate/kenzer	automated web assets enumeration & scanning
Assured OSS	Improve the security of your software supply chain by incorporating the same trusted open source software (OSS) packages that Google secures and uses into your own developer workflows.
barrracud4/image-upload-exploits	This repository contains various media files for known attacks on web applications processing media files. Useful for penetration tests and bug bounty.
BishopFox/GitGot	Semi-automated, feedback-driven tool to rapidly search through troves of public data on GitHub for sensitive secrets.
BishopFox/h2csmuggler	HTTP Request Smuggling over HTTP/2 Cleartext (h2c)
brannondorsey/dns-rebind-toolkit	A front-end JavaScript toolkit for creating DNS rebinding attacks.
bridgecrewio/checkov	Prevent cloud misconfigurations during build-time for Terraform, Cloudformation, Kubernetes, Serverless framework and other infrastructure-as-code-languages with Checkov by Bridgecrew.
brompwnie/botb	A container analysis and exploitation tool for pentesters and engineers.
Bug Bounty Recon	Bug Bounty Recon (bbrecon) is a Recon-as-a-Service for bug bounty hunters and security researchers. The API aims to provide a continuously up-to-date map of the Internet "safe harbor" attack surface, excluding out-of-scope targets.
Checkmarx/kics	Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.
chvancooten/BugBountyScanner	A Bash script and Docker image for Bug Bounty reconnaissance. Intended for headless use.
danmar/cppcheck	static analysis of C/C++ code
deepfence/SecretScanner	Find secrets and passwords in container images and file systems
deepfence/ThreatMapper	Identify vulnerabilities in running containers, images, hosts and repositories
DefectDojo/django-DefectDojo	DefectDojo is an open-source application vulnerability correlation and security orchestration tool.
delvelabs/tachyon	Tachyon is a fast web application security reconnaissance tool.
delvelabs/vane2	WordPress version identification and vulnerability finder.
doyensec/inql	InQL - A Burp Extension for GraphQL Security Testing
dstotijn/hetty	Hetty is an HTTP toolkit for security research. It aims to become an open source alternative to commercial software like Burp Suite Pro, with powerful features tailored to the needs of the infosec and bug bounty community.
facebook/pyre-check/	Performant type-checking for python.
Findomain/Findomain	The fastest and cross-platform subdomain enumerator, do not waste your time.
fkie-cad/cwe_checker	cwe_checker finds vulnerable patterns in binary executables
google/atheris	Atheris is a coverage-guided Python fuzzing engine. It supports fuzzing of Python code, but also native extensions written for CPython. Atheris is based off of libFuzzer. When fuzzing native code, Atheris can be used in combination with Address Sanitizer or Undefined Behavior Sanitizer to catch extra bugs.
google/tsunami-security-scanner	Tsunami is a general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence.
googleprojectzero/weggli	weggli is a fast and robust semantic search tool for C and C++ codebases. It is designed to help security researchers identify interesting functionality in large codebases.
IlluminateJs	IlluminateJs is a static javascript analysis engine (a deobfuscator so to say) aimed to help analyst understand obfuscated and potentially malicious JavaScript Code.
ismailtasdelen/xss-payload-list	Cross Site Scripting ( XSS ) Vulnerability Payload List
jonluca/Anubis	Subdomain enumeration and information gathering tool
LanikSJ/dfimage	Reverse-engineer a Dockerfile from a Docker image.
lelinhtinh/de4js	JavaScript Deobfuscator and Unpacker
mazen160/bfac	BFAC (Backup File Artifacts Checker): An automated tool that checks for backup artifacts that may disclose the web-application's source code.
microsoft/onefuzz	A self-hosted Fuzzing-As-A-Service platform
mindedsecurity/JStillery	Advanced JS Deobfuscation via Partial Evaluation.
mwrlabs/dref	DNS Rebinding Exploitation Framework
nccgroup/singularity	A DNS rebinding attack framework
nccgroup/whalescan	Whalescan is a vulnerability scanner for Windows containers, which performs several benchmark checks, as well as checking for CVEs/vulnerable packages on the container
NetSPI/AutoDirbuster	Automatically run and save Dirbuster scans for multiple IPs
NetSPI/PowerUpSQL	PowerUpSQL: A PowerShell Toolkit for Attacking SQL Server
NotSoSecure/SerializedPayloadGenerator	It's Web Interface to generate payload using various deserialization exploitation framework
noqcks/xeol	Xeol is a scanner for End Of Life (EOL) packages in container images, systems, and SBOMs
Insights	Open Source Insights is an experimental service developed and hosted by Google to help developers better understand the structure, construction, and security of open source software packages.
ossf/allstar	GitHub App to set and enforce security policies
ossf/scorecard	Security Scorecards - Security health metrics for Open Source
OJ/gobuster	Directory/File, DNS and VHost busting tool written in Go
OWASP/Nettacker	Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management
OWASP/wstg	The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.
OWASP Zed Attack Proxy Project	The OWASP Zed Attack Proxy (ZAP) is one of the world’s most popular free security tools and is actively maintained by hundreds of international volunteers
PerimeterX/Restringer	A Javascript Deobfuscator
praetorian-inc/gokart	A static analysis tool for securing Go code
praetorian-inc/snowcat	a tool to audit the istio service mesh
pimps/JNDI-Exploit-kit	JNDI-Exploitation-Kit（A modified version of the great JNDI-Injection-Exploit created by @welk1n. This tool can be used to start an HTTP Server, RMI Server and LDAP Server to exploit java web apps vulnerable to JNDI Injection
presidentbeef/brakeman	A static analysis security vulnerability scanner for Ruby on Rails applications
Public WWW	Source Code Search Engine
pumasecurity/puma-scan	Puma Scan is a software security Visual Studio extension that provides real time, continuous source code analysis as development teams write code. Vulnerabilities are immediately displayed in the development environment as spell check and compiler warnings, preventing security bugs from entering your applications.
pwntester/ysoserial.net	Deserialization payload generator for a variety of .NET formatters
quarkslab/kdigger	kdigger is a context discovery tool for Kubernetes penetration testing.
redphx/localify	Effectively debug minified JS files
RedTeamPentesting/monsoon	Fast HTTP enumerator
RhinoSecurityLabs/IPRotate_Burp_Extension	Extension for Burp Suite which uses AWS API Gateway to rotate your IP on every request.
RhinoSecurityLabs/SleuthQL	Python3 Burp History parsing tool to discover potential SQL injection points. To be used in tandem with SQLmap.
rpgeeganage/audit-node-modules-with-yara	Audit Node Module folder with YARA rules to identify possible malicious packages hiding in node_moudles
s0md3v/XSStrike	Most advanced XSS detection suite
Screetsec/Sudomy	Sudomy is a subdomain enumeration tool to collect subdomains and analyzing domains performing automated reconnaissance (recon) for bug hunting / pentesting
securego/gosec	Golang security checker
SLSA	Safeguarding artifact integrity across any software supply chain
Snyk	Continuously find & fix vulnerabilities in your dependencies
sslab-gatech/Rudra	Rust Memory Safety & Undefined Behavior Detection
subfinder/subfinder	SubFinder is a subdomain discovery tool that discovers valid subdomains for websites. Designed as a passive framework to be useful for bug bounties and safe for penetration testing.
target/mmk-ui-api	UI, API, and Scanner (Rules Engine) services for Merry Maker
trailofbits/it-depends	A tool to automatically build a dependency graph and Software Bill of Materials (SBOM) for packages and arbitrary source code repositories.
vchinnipilli/kubestriker	A Blazing fast Security Auditing tool for Kubernetes
visma-prodsec/confused	Tool to check for dependency confusion vulnerabilities in multiple package management systems
wallarm/gotestwaf	Go Test WAF project, a tool to test different WAF detects for apps and APIs
wagiro/BurpBounty	Burp Bounty (Scan Check Builder in BApp Store) is a extension of Burp Suite that allows you, in a quick and simple way, to improve the active and passive scanner by means of personalized rules through a very intuitive graphical interface.
wagoodman/dive	A tool for exploring each layer in a docker image
xmendez/wfuzz	Wfuzz has been created to facilitate the task in web applications assessments and it is based on a simple concept: it replaces any reference to the FUZZ keyword by the value of a given payload.
Yelp/detect-secrets	An enterprise friendly way of detecting and preventing secrets in code.
ZupIT/horusec	Horusec is an open source tool that improves identification of vulnerabilities in your project with just one command.
Link	Description
acsdavid97/DotNetHooker	API tracing and argument dumping to ease reverse engineering .NET malware.
advanced-threat-research/DotDumper	An automatic unpacker and logger for DotNet Framework targeting files
Air14/HyperHide	Hypervisor based anti anti debug plugin for x64dbg
ajpc500/RelayRumbler	A proof-of-concept tool that attempts to retrieve the configuration from the memory dump of an F-Secure C3 Relay executable.
avast-tl/retdec	RetDec is a retargetable machine-code decompiler based on LLVM
binref/refinery	High Octane Triage Analysis
binvis.io	visual analysis of binary files
blackberry/pe_tree	Python module for viewing Portable Executable (PE) files in a tree-view using pefile and PyQt5. Can also be used with IDA Pro to dump in-memory PE files and reconstruct imports.
BLint	BLint is a Binary Linter to check the security properties, and capabilities in your executables. It is powered by lief
bohops/RogueAssemblyHunter	Rogue Assembly Hunter is a utility for discovering 'interesting' .NET CLR modules in running processes.
bootleg/ret-sync	ret-sync is a set of plugins that helps to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg2/x64dbg) with IDA/Ghidra disassemblers.
buzzer-re/Shinigami	Shinigami is an experimental tool designed to detect and unpack malware implants that are injected via process hollowing or generic packer routines.
can1357/NoVmp	A static devirtualizer for VMProtect x64 3.x. powered by VTIL.
carbonblack/binee	Binee: binary emulation environment
Cisco-Talos/GhIDA	GhIDA is an IDA Pro plugin that integrates the Ghidra decompiler in IDA.
Cisco-Talos/Ghidraaas	Ghidraaas is a simple web server that exposes Ghidra analysis through REST APIs. The project includes three Ghidra plugins to analyze a sample, get the list of functions and to decompile a function.
certcc/kaiju	CERT Kaiju is a binary analysis framework extension for the Ghidra software reverse engineering suite
Comsecuris/gdbghidra	gdbghidra - a visual bridge between a GDB session and GHIDRA
Comsecuris/gdbida	gdbida - a visual bridge between a GDB session and IDA Pro's disassembler
Cutter	Free and Open Source RE Platform powered by radare2
DarthTon/Blackbone	Windows memory hacking library
Decompiler Explorer	This is the Decompiler Explorer! It is an interactive online decompiler which shows equivalent C-like output of decompiled programs from many popular decompilers. It's meant to be the reverse of the amazing Compiler Explorer.
dr4k0nia/Unscrambler	Universal unpacker and fixer for a number of modded ConfuserEx protections
dragon-dreamer/binary-valentine	Binary Valentine is a cross-platform static analysis tool for Portable Executable files. Detects security, configuration, optimization, system and format issues.
e-m-b-a/emba	EMBA - The firmware security analyzer
endgameinc/xori	Xori is an automation-ready disassembly and static analysis library for PE32, 32+ and shellcode
enkomio/shed	.NET runtine inspector. Shed - Inspect .NET malware like a Sir
FernandoDoming/r2diaphora	r2diaphora is a port of Diaphora to radare2 and MySQL. It also uses r2ghidra as decompiler by default, with support for other decompilers such as pdc.
flare-emu	flare-emu marries a supported binary analysis framework, such as IDA Pro or Radare2, with Unicorns emulation framework to provide the user with an easy to use and flexible interface for scripting emulation tasks.
fibratus	A modern tool for the Windows kernel exploration and observability
fireeye/capa	capa detects capabilities in executable files. You run it against a PE file or shellcode and it tells you what it thinks the program can do. For example, it might suggest that the file is a backdoor, is capable of installing services, or relies on HTTP to communicate.
fireeye/capa-rules	Standard collection of rules for capa: the tool for enumerating the capabilities of programs
fireeye/flare-floss	FireEye Labs Obfuscated String Solver - Automatically extract obfuscated strings from malware.
fireeye/speakeasy	Speakeasy is a portable, modular, binary emulator designed to emulate Windows kernel and user mode malware.
fireeye/stringsifter	A machine learning tool that ranks strings based on their relevance for malware analysis.
fkie-cad/FACT_core	Firmware Analysis and Comparison Tool
forrest-orr/moneta	Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs
FuzzySecurity/Dendrobate	Managed code hooking template.
FuzzySecurity/Fermion	Fermion, an electron wrapper for Frida & Monaco.
gaasedelen/tenet	A Trace Explorer for Reverse Engineers
GaloisInc/reopt	A tool for analyzing x86-64 binaries.
GHIDRA	A software reverse engineering (SRE) suite of tools developed by NSA's Research Directorate in support of the Cybersecurity mission
goretk/redress	Redress - A tool for analyzing stripped Go binaries
grimm-co/GEARSHIFT	GEARSHIFT is a tool that performs structure recovery for a specified function within a stripped binary. It also generates a fuzz harness that can be used to call functions in a shared object (.so) or dynamically linked library (.dll) file.
guelfoweb/peframe	PEframe is a open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents.
hasherezade/hollows_hunter	A process scanner detecting and dumping hollowed PE modules.
hasherezade/hook_finder	a small tool for investigating inline hooks (and other in-memory code patches)
hasherezade/pe_to_shellcode	Converts PE into a shellcode
herosi/CTO	Call Tree Overviewer
horsicq/XELFViewer	ELF file viewer/editor for Windows, Linux and MacOS.
HyperDbg/HyperDbg	The Source Code of HyperDbg Debugger 🐞
hzqst/unicorn_pe	Unicorn PE is an unicorn based instrumentation project designed to emulate code execution for windows PE files.
Kaitai Struct	Kaitai Struct is a declarative language used to describe various binary data structures, laid out in files or in memory: i.e. binary file formats, network stream packet formats, etc.
KenSecurityLab/BinAbsInspector	BinAbsInspector: Vulnerability Scanner for Binaries
LIEF	Library to Instrument Executable Formats
loov/lensm	Go assembly and source viewer
mandiant/dncli	The FLARE team's open-source library to disassemble Common Intermediate Language (CIL) instructions.
mandiant/GoReSym	Go symbol recovery tool
mandiant/route-sixty-sink	Link sources to sinks in C# applications.
Martyx00/CollaRE	CollareRE is a tool for collaborative reverse engineering that aims to allow teams that do need to use more then one tool during a project to collaborate without the need to share the files on a separate locations.
Microsoft/binskim	A binary static analysis tool that provides security and correctness results for Windows portable executables
Microsoft/ProcDump-for-Linux	A Linux version of the ProcDump Sysinternals tool
MITRECND/malchive	Various capabilities for static malware analysis.
moyix/gpt-wpre	Whole-Program Reverse Engineering with GPT-3
mrphrazer/obfuscation_detection	Collection of scripts to pinpoint obfuscated code
mxmssh/drltrace	Drltrace is a library calls tracer for Windows and Linux applications
NASA-SW-VnV/ikos	IKOS (Inference Kernel for Open Static Analyzers) is a static analyzer for C/C++ based on the theory of Abstract Interpretation
nsacyber/BAM	The Binary Analysis Metadata tool gathers information about Windows binaries to aid in their analysis.
nccgroup/WindowsMemPageDelta	A Microsoft Windows service to provide telemetry on Windows executable memory page changes to facilitate threat detection
netspooky/scare	A multi-arch assembly REPL and emulator for your command line.
OALabs/hashdb-ida	HashDB API hash lookup plugin for IDA Pro
osandov/drgn	Programmable debugger
pierrezurek/Signsrch	tool for searching signatures inside files, extremely useful in reversing engineering for figuring or having an initial idea of what encryption/compression algorithm is used for a proprietary protocol or file. it can recognize tons of compression, multimedia and encryption algorithms and many other things like known strings and anti-debugging code which can be also manually added since it's all based on a text signature file read at runtime and easy to modify.
Pinitor	An API Monitor Based on Pin
pygore	Python library for analyzing Go binaries
qilingframework/qiling	Qiling Advanced Binary Emulation Framework
revng/pagebuster	PageBuster - dump all executable pages of packed processes.
REW-sploit/REW-sploit	Emulate and Dissect MSF and other attacks
rizin	Free and Open Source Reverse Engineering Framework
secretsquirrel/recomposer	Randomly changes Win32/64 PE Files for 'safer' uploading to malware and sandbox sites.
sibears/IDAGolangHelper	Set of IDA Pro scripts for parsing GoLang types information stored in compiled binary
strazzere/golang_loader_assist	Making GO reversing easier in IDA Pro
synacktive/frinet	Frida-based tracer for easier reverse-engineering on Android, iOS, Linux, Windows and most related architectures.
taviso/loadlibrary	Porting Windows Dynamic Link Libraries to Linux
unipacker/unipacker	Automatic and platform-independent unpacker for Windows binaries based on emulation
utkonos/lst2x64dbg	Extract labels from IDA, Ghidra, Binary Ninja, and Relyze files and export x64dbg database. Including radare2 main address.
Veles	New open source tool for binary data analysis
VisUAL	A highly visual ARM emulator
vmp2/vmemu	VMProtect 2 Virtual Machine Handler Emulation
wader/fq	Tool, language and decoders for inspecting binary data.
Wenzel/checksec.py	Checksec tool in Python, Rich output. Based on LIEF
WerWolv/ImHex	A Hex Editor for Reverse Engineers, Programmers and people that value their eye sight when working at 3 AM.
williballenthin/python-idb	Pure Python parser and analyzer for IDA Pro database files (.idb).
Link	Description
0xsha/CloudBrute	A tool to find a company (target) infrastructure, files, and apps on the top cloud providers (Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, Linode). The outcome is useful for bug bounty hunters, red teamers, and penetration testers alike.
Alfresco/prowler	Tool for AWS security assessment, auditing and hardening. It follows guidelines of the CIS Amazon Web Services Foundations Benchmark.
andresriancho/nimbostratus	Tools for fingerprinting and exploiting Amazon cloud infrastructures
asecure.cloud	A free repository of customizable AWS security configurations and best practices
asecurityteam/spacecrab	Bootstraps an AWS account with everything you need to generate, mangage, and distribute and alert on AWS honey tokens. Made with breakfast roti by the Atlassian security team.
aws-cloudformation/cloudformation-guard	Guard offers a policy-as-code domain-specific language (DSL) to write rules and validate JSON- and YAML-formatted data such as CloudFormation Templates, K8s configurations, and Terraform JSON plans/configurations against those rules.
awslabs/aws-security-benchmark	Open source demos, concept and guidance related to the AWS CIS Foundation framework.
Azure/Stormspotter	Azure Red Team tool for graphing Azure and Azure Active Directory objects
AzureAD/Azure-AD-Incident-Response-PowerShell-Module	The Azure Active Directory Incident Response PowerShell module provides a number of tools, developed by the Azure Active Directory Product Group in conjunction with the Microsoft Detection and Response Team (DART), to assist in compromise response.
BishopFox/iam-vulnerable	Use Terraform to create your own vulnerable by design AWS IAM privilege escalation playground.
BishopFox/smogcloud	Find cloud assets that no one wants exposed
BloodHoundAD/AzureHound	Azure Hound
bridgecrewio/cdkgoat	CdkGoat is Bridgecrew's "Vulnerable by Design" AWS CDK repository. CdkGoat is a learning and training project that demonstrates how common configuration errors can find their way into production cloud environments.
bridgecrewio/cfngoat	Cfngoat is Bridgecrew's "Vulnerable by Design" Cloudformation repository. Cfngoat is a learning and training project that demonstrates how common configuration errors can find their way into production cloud environments.
carlospolop/PurplePanda	Identify privilege escalation paths within and across different clouds
carnal0wnage/weirdAAL	WeirdAAL [AWS Attack Library] wiki!
cisagov/Sparrow	Sparrow.ps1 was created by CISA's Cloud Forensics team to help detect possible compromised accounts and applications in the Azure/m365 environment.
cisagov/untitledgoosetool	Untitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to run a full investigation against a customer’s Azure Active Directory (AzureAD), Azure, and M365 environments.
cloud-sniper/cloud-sniper	Cloud Security Operations Orchestrator
cloudquery/cloudquery	cloudquery transforms your cloud infrastructure into queryable SQL tables for easy monitoring, governance and security.
cloudsploit/scans	AWS security scanning checks
cr0hn/festin	FestIn is a tool for discovering open S3 Buckets starting from a domains.
CrowdStrike/CRT	This tool queries the following configurations in the Azure AD/O365 tenant which can shed light on hard to find permissions and configuration settings in order to assist organizations in securing these environments.
cyberark/blobhunter	Find exposed data in Azure with this public blob scanner
cyberark/SkyArk	SkyArk is a cloud security tool, helps to discover, assess and secure the most privileged entities in AWS
cyberark/SkyWrapper	SkyWrapper helps to discover suspicious creation forms and uses of temporary tokens in AWS
dagrz/aws_pwn	A collection of AWS penetration testing junk
darkbitio/aws-recon	Multi-threaded AWS inventory collection tool with a focus on security-relevant resources and metadata.
darkquasar/AzureHunter	A Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365
disruptops/cred_scanner	A simple file-based scaner to look for potential AWS accesses and secret keys in files
duo-labs/cloudtracker	CloudTracker helps you find over-privileged IAM users and roles by comparing CloudTrail logs with current IAM policies.
duo-labs/cloudmapper	CloudMapper helps you analyze your Amazon Web Services (AWS) environments.
endgameinc/varna	Varna: Quick & Cheap AWS CloudTrail Monitoring with Event Query Language (EQL)
eth0izzle/bucket-stream	Find interesting Amazon S3 Buckets by watching certificate transparency logs.
FishermansEnemy/bucket_finder	Amazon bucket brute force tool
FSecureLABS/Azurite	Enumeration and reconnaissance activities in the Microsoft Azure Cloud.
glen-mac/goGetBucket	A penetration testing tool to enumerate and analyse Amazon S3 Buckets owned by a domain.
google/cloud-forensics-utils	Python library to carry out DFIR analysis on the Cloud
hausec/PowerZure	PowerShell framework to assess Azure security
initstring/cloud_enum	Multi-cloud OSINT tool. Enumerate public resources in AWS, Azure, and Google Cloud.
jonrau1/ElectricEye	Continuously monitor your AWS services for configurations that can lead to degradation of confidentiality, integrity or availability. All results will be sent to Security Hub for further aggregation and analysis.
jordanpotti/AWSBucketDump	Security Tool to Look For Interesting Files in S3 Buckets
jordanpotti/CloudScraper	CloudScraper: Tool to enumerate targets in search of cloud resources. S3 Buckets, Azure Blobs, Digital Ocean Storage Space.
kromtech/s3-inspector	Tool to check AWS S3 bucket permissions
lyft/metadataproxy	A proxy for AWS's metadata service that gives out scoped IAM credentials from STS
Macmod/STARS	A multi-cloud DNS record scanner that aims to help cybersecurity/IT analysts identify dangling CNAME records in their cloud DNS services that could possibly lead to subdomain takeover scenarios.
mgeeky/AzureRT	AzureRT - A Powershell module implementing various Azure Red Team tactics
MindPointGroup/cloudfrunt	A tool for identifying misconfigured CloudFront domains
nccgroup/aws-inventory	Discover resources created in an AWS account
nccgroup/azucar	Security auditing tool for Azure environments
nccgroup/PMapper	A tool for quickly evaluating IAM permissions in AWS.
nccgroup/s3_objects_check	Whitebox evaluation of effective S3 object permissions, in order to identify publicly accessible objects.
nccgroup/Scout2	Security auditing tool for AWS environments
nccgroup/ScoutSuite	Scout Suite is an open source multi-cloud security-auditing tool, which enables security posture assessment of cloud environments
Netflix-Skunkworks/diffy	Diffy is a digital forensics and incident response (DFIR) tool developed by Netflix's Security Intelligence and Response Team (SIRT).
Netflix/security_monkey	Security Monkey monitors your AWS and GCP accounts for policy changes and alerts on insecure configurations.
NetSPI/aws_consoler	A utility to convert your AWS CLI credentials into AWS console access.
NetSPI/MicroBurst	A collection of scripts for assessing Microsoft Azure security
NotSoSecure/cloud-service-enum	This script allows pentesters to validate which cloud tokens (API keys, OAuth tokens and more) can access which cloud service.
prevade/cloudjack	Route53/CloudFront Vulnerability Assessment Utility
projectdiscovery/cloudlist	Cloudlist is a tool for listing Assets from multiple Cloud Providers.
pumasecurity/serverless-prey	Serverless Functions for establishing Reverse Shells to Lambda, Azure Functions, and Google Cloud Functions
random-robbie/slurp	Enumerate S3 buckets via certstream, domain, or keywords
RhinoSecurityLabs/cloudgoat	CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool
RhinoSecurityLabs/pacu	Rhino Security Labs' AWS penetration testing toolkit
RiotGames/cloud-inquisitor	Enforce ownership and data security within AWS
sa7mon/S3Scanner	Scan for open S3 buckets and dump
salesforce/cloudsplaining	Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized HTML report with a triage worksheet
sendgrid/krampus	The original AWS security enforcer™
SecurityFTW/cs-suite	Cloud Security Suite - One stop tool for auditing the security posture of AWS infrastructure.
soteria-security/365Inspect	A PowerShell script that automates the security assessment of Microsoft Office 365 environments.
spacesiren/spacesiren	A honey token manager and alert system for AWS.
sbasu7241/AWS-Threat-Simulation-and-Detection	Playing around with Stratus Red Team (Cloud Attack simulation tool) and SumoLogic
swimlane/CLAW	A packer utility to create and capture DFIR Image for use AWS & Azure
theflakes/reg_hunter	Blueteam operational triage registry hunting/forensic tool
ThreatResponse/margaritashotgun	Remote Memory Acquisition Tool for AWS
ThreatResponse/aws_ir	Python installable command line utiltity for mitigation of host and key compromises.
toniblyx/prowler	Tool based on AWS-CLI commands for AWS account security assessment and hardening, following guidelines of the CIS Amazon Web Services Foundations Benchmark 1.1
widdix/aws-s3-virusscan	Antivirus for Amazon S3 buckets
Link	Description
specterops/at-ps	Adversary Tactics - PowerShell Training
Link	Description
Balasys/dheater	D(HE)ater is a security tool can perform DoS attack by enforcing the DHE key exchange.
CERTCC/keyfinder	A tool for analyzing private (and public) key files, including support for Android APK files.
CertDB	Internet-wide search engine for digital certificates
Ciphey/Ciphey	Automatically decode encryptions without a key, decode encodings, and crack hashes
Demonslay335/CryptoTester	A utility for playing with cryptography, geared towards ransomware analysis.
mpgn/BEAST-PoC	Poc of BEAST attack against SSL/TLS
mpgn/Padding-oracle-attack	Padding oracle attack against PKCS7
mpgn/poodle-PoC	Poodle (Padding Oracle On Downgraded Legacy Encryption) attack
mxrch/evilize	Use md5-collisions to make evil executables looking like a good one.
salesforce/ja3	JA3 is a standard for creating SSL client fingerprints in an easy to produce and shareable way.
Link	Description
BOTS 1.0 Dataset	The BOTS 1.0 dataset records two attacks perpetrated by a fictitious hacktivist group called po1s0n1vy targeting Wayne Corp of Batman mythology. There are many comic book references in the data; from heroes and villains to “Batman’s” street addresses. Not only does the dataset have many different types of data—everything from Sysmon to Suricata—but there are even file hashes that can be found in Virustotal.com and domains/IPs to hunt for in OSINT tools like PassiveTotal and Robtex!
DataPlane.org	DataPlane.org is a community-powered Internet data, feeds, and measurement resource for operators, by operators. We provide reliable and trustworthy service at no cost.
cobaltstrike-beacon-data	Open Dataset of Cobalt Strike Beacon metadata (2018-2022)
Google Dataset Search	Google Dataset Search
FiveDirections/OpTC-data	Operationally Transparent Cyber (OpTC) Data
intel/yarpgen	Yet Another Random Program Generator
Kitsune Network Attack Dataset	Nine labeled attacks with extracted features and the original network capture
nimrodpar/Labeled-Elfs	A collection of well labeled ELF binaries compiled from benign and malicious code in various ways. Great for exploring similarity in executables and training various ML models.
Security Datasets	The Security Datasets project is an open-source initiatve that contributes malicious and benign datasets, from different platforms, to the infosec community to expedite data analysis and threat research.
SecRepo.com - Samples of Security Related Data	Finding samples of various types of Security related can be a giant pain. This is my attempt to keep a somewhat curated list of Security related data I've found, created, or was pointed to. If you perform any kind of analysis with any of this data please let me know and I'd be happy to link it from here or host it here. Hopefully by looking at others research and analysis it will inspire people to add-on, improve, and create new ideas.
sophos-ai/SOREL-20M	Sophos-ReversingLabs 20 million sample dataset
splunk/attack_data	A Repository of curated datasets from various attacks
Winbindex	The Windows Binaries Index
Link	Description
externalist/exploit_playground	Analysis of public exploits or my 1day exploits
FriendsOfPHP/security-advisories	The PHP Security Advisories Database references known security vulnerabilities in various PHP projects and libraries. This database must not serve as the primary source of information for security issues, it is not authoritative for any referenced software, but it allows to centralize information for convenience and easy consumption.
gellin/TeamViewer_Permissions_Hook_V1	A proof of concept injectable C++ dll, that uses naked inline hooking and direct memory modification to change your TeamViewer permissions.
HASecuritySolutions/VulnWhisperer	Create actionable data from your Vulnerability Scans
hasherezade/process_doppelganging	My implementation of enSilo's Process Doppelganging (PE injection technique)
itm4n/Perfusion	Exploit for the RpcEptMapper registry key permissions vulnerability (Windows 7 / 2088R2 / 8 / 2012)
itm4n/UsoDllLoader	Windows - Weaponizing privileged file writes with the Update Session Orchestrator service
nomi-sec/PoC-in-GitHub	📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
opencve/opencve	CVE Alerting Platform
ScottyBauer/Android_Kernel_CVE_POCs	A list of my CVE's with POCs
smgorelik/Windows-RCE-exploits	The exploit samples database is a repository for RCE (remote code execution) exploits and Proof-of-Concepts for WINDOWS, the samples are uploaded for education purposes for red and blue teams.
Spajed/processrefund	An attempt at Process Doppelgänging
spencerdodd/kernelpop	Kernel privilege escalation enumeration and exploitation framework
tunz/js-vuln-db	A collection of JavaScript engine CVEs with PoCs
victims/victims-cve-db	This database contains information regarding CVE(s) that affect various language modules. We currently store version information corresponding to respective modules as understood by select sources.
VulnReproduction/LinuxFlaw	This repo records all the vulnerabilities of linux software I have reproduced in my local workspace
xairy/kernel-exploits	A bunch of proof-of-concept exploits for the Linux kernel
Link	Description
0x6d69636b/windows_hardening	Windows Hardening settings and configurations
Benchmark: NIST SP 800-53 Revision 5	NIST SP 800-53 Revision 5 represents a multi-year effort to develop the next generation of security and privacy controls needed to strengthen and support the U.S. federal government. These next generation controls offer a proactive and systematic approach to ensure that critical systems, components, and services are sufficiently trustworthy and have the necessary resilience to defend the economic and national security interests of the United States.
cisagov/cset	Cybersecurity Evaluation Tool
elastic/PPLGuard	PPLGuard is a proof of concept tool that can mitigate two currently-unpatched Windows security flaws which pose threats to Protected Processes Light (PPL) processes, such as AntiMalware services.
Linux Kernel Runtime Guard	Linux Kernel Runtime Guard (LKRG) is a out-of-tree security module for the Linux kernel developed by Openwall. It does run-time integrity checks in order to stop known, and unknown, security vulnerabilities in the Linux kernel. It can log detected intrusion attempts or stop them by causing a kernel panic - resulting in a frozen machine or a reboot depending on how the kernel is configured.
nccgroup/exploit_mitigations	Knowledge base of exploit mitigations available across numerous operating systems, architectures and applications and versions.
Privacy.sexy	Enforce privacy & security on Windows and macOS
Santa	Santa is a binary authorization system for macOS
Security Technical Implementation Guides (STIGs)	The Security Technical Implementation Guides (STIGs) are the configuration standards for DOD IA and IA-enabled devices/systems.
securitywithoutborders/hardentools	Hardentools simply reduces the attack surface on Microsoft Windows computers by disabling low-hanging fruit risky features.
ukncsc/Device-Security-Guidance-Configuration-Packs	This repository contains policy packs which can be used by system management software to configure device platforms (such as Windows 10 and iOS) in accordance with NCSC device security guidance. These configurations are aimed primarily at government and other medium/large organisations.
Windows Security Baseline	A security baseline is a group of Microsoft-recommended configuration settings that explains their security impact. These settings are based on feedback from Microsoft security engineering teams, product groups, partners, and customers.