halo-record

halo-record Tamper-evident runtime records for AI agents : the audit trail the vendor runs but cannot edit. Every action your agent takes tool calls, model calls, data access, approvals becomes one record in an append-structured, hash-chained log. Any party holding a checkpoint of the chain can...

infernal-twin

Infernal-Wireless v3 Release 3 Improved and Compatibility on Kali Linux 2018 Added Visual Representation of Wireless Scan Added Visual Representation of Probe Requests and Map per SSID requested by Devices Updated MAC address mapping Added MAC address mappting on probe request devices Evil Twin...

AI-driven-MITRE-Attack

POC : Detección de Tácticas MITRE y Enriquecimiento de Alertas Impulsado por IA Este repositorio demuestra un pipeline de aprendizaje automático para detectar técnicas MITRE ATT&CK a partir de registros y enriquecer la salida usando un LLM local. Descripción general El proyecto está dividido en d...

NginxHunter

NginxHunter Descripción NginxHunter es una herramienta integral diseñada para analizar los registros de acceso de Nginx en busca de vulnerabilidades de seguridad y actividades sospechosas. Detecta intentos de inyección SQL, herramientas de escaneo, accesos a rutas sensibles, intentos de...

EventLogin-CVE-2025-29969

EventLogin - CVE-2025-29969 EventLogin es una vulnerabilidad de tiempo de verificación a tiempo de uso en el protocolo MS-EVEN. La vulnerabilidad permite a usuarios con bajos privilegios escribir archivos arbitrarios en una máquina remota, evitando efectivamente la necesidad de una cuenta de...

redsails

Redsails About A post-exploitation tool capable of: maintaining persistence on a compromised machine subverting many common host event logs both network and account logon generating false logs / network traffic Based on PyDivert https://github.com/ffalcinelli/pydivert, a Python binding for...

zeek-long-connections

Long Connections Zeek normally logs connections at the end of the connection, but this can cause trouble for incident responders in the case of very long lived connections that end up being unknown to defenders until too late. This package provides a new log named connlong which will log...

LeakGauge

LeakGauge This is the code repository for our paper: The Model's Tell: Measuring Context-Leakage Attack Signals with Behavior Gauges. ArXiv version and paper link: https://arxiv.org/abs/2608.17829 This repository implements the LeakGauge pipeline for leakage detection: demo dataset preparation,...

PhantomFS

Fake Files. Real Security. Virtual honeypot file system for Windows — lure attackers into a directory that looks real, then catch them in the act. What Is PhantomFS? PhantomFS uses the Windows Projected File System ProjFS to surface a virtual directory full of convincing decoy files — financial...

Sentinel-GPT

Sentinel-GPT: IA Agéntica para la Caza de Amenazas 🛡️ Un pipeline automatizado de ciberseguridad que transforma registros sin procesar de Azure en inteligencia accionable mediante razonamiento basado en LLM. 📖 Descripción general Sentinel-GPT es un Agente de IA especializado en la caza de amenazas...

DCSYNCMonitor

DCSYNCMonitor Description This tool is an application/service that can be deployed on Domain controllers to alert on Domain Controller Syncronization attempts. When an attempt is detected, the tool will write an event to the Windows Event Log. These events can be correlated in a SIEM. In addition...

patator

Patator Patator was written out of frustration from using Hydra, Medusa, Ncrack, Metasploit modules and Nmap NSE scripts for password guessing attacks. I opted for a different approach in order to not create yet another brute-forcing tool and avoid repeating the same shortcomings. Patator is a...

securityonion

Security Onion Security Onion is a free and open Linux distribution for threat hunting, enterprise security monitoring, and log management. It includes a comprehensive suite of tools designed to work together to provide visibility into your network and host activity. ✨ Features Security Onion...

ossec-hids

Información sobre OSSEC OSSEC es una plataforma completa para monitorear y controlar tus sistemas. Combina todos los aspectos de HIDS detección de intrusiones basada en host, monitoreo de registros y SIM/SIEM en una solución simple, potente y de código abierto. Visita nuestro sitio web para obten...

ossec-hids

OSSEC v4.3.0 Information about OSSEC OSSEC is a full platform to monitor and control your systems. It mixes together all the aspects of HIDS host-based intrusion detection, log monitoring and SIM/SIEM together in a simple, powerful and open source solution. Visit our website for the latest...

home_SOC_suite

Home SOC Suite — Night's Watch Un Centro de Operaciones de Seguridad SOC personal construido desde cero durante un programa de reentrenamiento en Anwendungsentwicklung. Esta suite monitorea un endpoint Windows en busca de anomalías de red, picos de recursos, ejecución de procesos, cambios en el...

wazuh

Wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments. Wazuh solution consists of an endpoint security agent, deployed to the monitored...

watchguard-sso-client

Proof of Concept for Watchguard SSO Agent Vulnerabilitites CVE-2024-6592, CVE-2024-6593, CVE-2024-6594 Details are described in our advisories available at: CVE-2024-6592 CVE-2024-6593 CVE-2024-6594 The script requires the Python click library to run. Examples Issue Arbitrary Commands to SSO...

Panoptic

Panoptic Panoptic is an open source penetration testing tool that automates the search and retrieval of common log and config files through path traversal vulnerabilities. Features Async concurrent scanning with configurable worker pool --concurrency Automatic discovery of common log and...

CVE-2023-34051

CVE-2023-34051 CVE-2023-34051 is an authentication bypass that bypasses the patch for VMSA-2023-0001. VMSA-2023-0001 for vRealize Log Insight includes the following CVEs: VMware vRealize Log Insight Directory Traversal Vulnerability CVE-2022-31706 VMware vRealize Log Insight broken access control...