netwatch

NetWatch Network diagnostics in your terminal. netwatch --view dense. Four boxes, no chrome, every keybind on a border. Download grows up from the axis, upload grows down. One binary, no config. sudo netwatch and you have live capture with L7 decode, process attribution where available, and a...

cloud_ip_ranges

Cloud IP Ranges Description Most cloud providers publish up to date lists of their IP address ranges. This tools identifies if an IP belongs to a provider's ranges by fetching and parsing the latest lists. Supports: AWS source Azure source Google Cloud Platform source Alibaba Cloud currently...

whodunit

whodunit Recognizing the most likely APT groups responsible for an incident Description This program takes a report from a cybersecurity incident containing the MITRE ATT&CK techniques that have been detected to have been used in the incident and tries to recognize which APT groups are the most...

zeek-cheatsheets

Zeek Cheatsheets These are the Zeek cheatsheets that Corelight hands out as laminated glossy sheets. We have given them a license which permits you to make modifications and to distribute copies of these sheets. The only restrictions are that they can't be used commercially and attribution back t...

bandwhich

bandwhich This is a CLI utility for displaying current network utilization by process, connection and remote IP/hostname Table of contents bandwhich Table of contents Project status How does it work? Installation Downstream packaging status Download a prebuilt binary Building from source...

EternalLiberty

EternalLiberty Description This repository contains all Threat Actor aliases used by different Threat Intelligence companies in their reports. Objectives This allows to find the Threats Actors that you want survey or search in getting the name used by different companies or for attribution of...

CVE-2017-17562

CVE-2017-17562 not coded by me...

CVE-2024-22243

CVE-2024-22243 Code used from @SeanPesce...

DB_Audit_Research

Self-Defeating Audits — reproducible lab License: MIT code / CC BY 4.0 docs Defensive-security research testing whether a low-privilege, injection-only database role can reversibly blind a trigger-based auditor and poison attribution on stock PostgreSQL — and which defenses actually stop it...

edge

Cloud edge - Whois for the Cloud Lookup an IP to find the cloud provider and other details based on the provider's published JSON, CSV, or text data Cloud edge is a recon tool focused on exploring cloud service providers. It can be used for cloud attribution and forensics, pentesting, bug bounty,...

essh

ESSH An SSH workspace with persistent sessions and live health dashboards. Keep remote shells running across connection drops, switch between hosts with keys or the mouse, and check system health without leaving your terminal. ESSH uses OpenSSH for connections and tmux to keep your work alive. Se...

linnix

Linnix Find which process is hurting your SLOs — not just who's using CPU, but who's causing stalls. The Problem top shows 80% CPU. Prometheus shows high latency. But which pod is actually stalling your payment service? Linnix uses eBPF + PSI Pressure Stall Information to answer this. PSI measure...

conduit

Conduit The on-prem control plane for AI coding agents. Per-engineer cost attribution · hard budgets · egress governance · context-rot observability · audit-ready exports — all inside your VPC. Conduit sits between your AI coding agents Claude Code, Cursor, Codex, Aider and whatever provider you...

trappsec

trappsec trappsec is an open-source framework that helps developers detect attackers who probe API business logic. By embedding realistic decoy routes and honey fields that are difficult to distinguish from real API constructs, attackers are nudged to authenticate — converting reconnaissance into...

gluegate

gluegate Detection research PoC: proxy memory operations memory mapping, local memory allocation through Mozilla's signedmozglue.dll so kernel callbacks attribute the final user module to a trusted vendor DLL Mozilla signed instead of untrusted or unsigned module. Proxied APIs Both are MFBTAPI...

discourse-CVE-2023-45806

yksivaihde-CVE-2023-45806 CVE: https://github.com/discourse/discourse/security/advisories/GHSA-hcgf-hg2g-mw78 Patch: https://github.com/discourse/discourse/commit/7d484864fe91ff79c478f57e7ddb1235d701921e usage: fixquoteattribution"Username|", , where "Username|" is the unique search string within...

Sigma

Sigma Rules A collection of Sigma rules developed at Huntress Labs Twitter: https://twitter.com/embeeresearch https://twitter.com/HuntressLabs License The rules are essentially free to use without restriction, provided that appropriate credit is maintained Author/Owner etc. Detection Rule License...

Astra Linux – Vulnerability in Zabbix

Currently, the geomap configuration Administration - General - Geographical maps allows the use of HTML in the “Attribution text” field when the “Other” Tile provider is selected...

AgentWatcher

AgentWatcher AgentWatcher is a detection-based defense against indirect prompt injection in LLM agents. It first runs causal context attribution over untrusted context to find the most influential contexts, then applies a monitor LLM that classifies those contexts under explicit, customizable...

IF-Guide

IF-Guide: Influence Function-Guided Detoxification of LLMs NeurIPS 2025 This repository contains the code for IF-Guide, the LLM detoxification technique introduced in our paper: IF-Guide: Influence Function-Guided Detoxification of LLMs Zachary Coalson , Juhan Bae, Nicholas Carlini, Sanghyun Hong...