Aaia

NOTE This repository is not under active development. However, I am open to accepting PRs. Aaia still works as there has been no significant changes in terms of AWS APIs it uses to collect data. Aaia Analysis of Identity and Access Note: Expansion created post the name was decided :P What does Aa...

GoodHound

GoodHound / / / / / / / / / / / / / / / // / / / / / / / / // / // / // / // / / // / // / / / / // / ///,// ///,// //,/ Attackers think in graphs, defenders think in actions, management think in charts. GoodHound operationalises Bloodhound by determining the busiest paths to high value...

Compromised-Org-Chart-Generator

Compromised Org Chart Generator Overview Active Directory is used by organization as the identity provider. It contains information of all employees including their names, job titles, departments, and their managers. Password audits can help to discover weaknesses and risks. You might try passwor...

evtx

EVTX A cross-platform parser for the Windows XML EventLog format Features 🔒 Implemented using 100% safe rust - and works on all platforms supported by rust that have stdlib. ⚡ Fast - see benchmarks below. It's faster than any other implementation by orders of magnitude! 🚀 Multi-threaded. ✨ Suppor...

BloodHound

BloodHound is a monolithic web application composed of an embedded React frontend with Sigma.js and a Go based REST API backend. It is deployed with a Postgresql application database and a Neo4j graph database, and is fed by the SharpHound and AzureHound data collectors. BloodHound leverages grap...

autobloody

autobloody autobloody is a tool to automatically exploit Active Directory privilege escalation paths shown by BloodHound. Description This tool automates the AD privesc between two AD objects, the source the one we own and the target the one we want if a privesc path exists in BloodHound database...

PurplePanda

PurplePanda This tool fetches resources from different cloud/saas applications focusing on permissions in order to identify privilege escalation paths and dangerous permissions in the cloud/saas configurations. Note that PurplePanda searches both privileges escalation paths within a platform and...

beagle

Beagle 1. About Beagle 2. Installation 1. Docker 2. Python Package 3. Configuration 3. Web Interface 1. Uploading Data 2. Browsing Existing Graphs 3. Graph Interface 1. Inspecting Nodes and Edges 2. Expanding Neighbours 3. Hiding Nodes 4. Running Mutators 5. Toggling Node and Edge Types 6...

FalconHound

FalconHound NOTE: As of the BloodHound CE 7.0 release, the default database has been switched to Postgres. This version of FalconHound still relies on Neo4j to be the default database. If you want to keep using FalconHound while running the latest BloodHound version, add the following line to you...

nuvola

nuvola nuvola with the lowercase n is a tool to dump and perform automatic and manual security analysis on AWS environments configurations and services using predefined, extensible and custom rules created using a simple Yaml syntax. The general idea behind this project is to create an abstracted...

ODIN

ODIN Observe, Detect, and Investigate Networks Current version: v2.0.0 "Huginn" ODIN is Python tool for automating intelligence gathering, asset discovery, and reporting. Remember, check the dev branch for the bleeding edge, and feedback is welcome! See the GitHub wiki for details and installatio...

AD_Miner

AD Miner is an Active Directory on-premise and Entra ID auditing tool that: Leverages Cypher queries to analyze data from the BloodHound graph database Neo4j. Provides a comprehensive overview of existing weaknesses through a static, web-based report. Web-based reports features: Detailed listings...

kcmapper

KcMapper KcMapper es una herramienta para exportar los datos de configuración de Keycloak a una base de datos de grafos Neo4j. Esta representación permite analizar las relaciones entre realms, clientes, usuarios, grupos y roles. La herramienta incluye una interfaz web para ejecutar consultas Cyph...

Max

Maximizing BloodHound with a simple suite of tools Description New Release: dpat - The BloodHound Domain Password Audit Tool DPAT A simple suite of tools: get-info - Pull lists of information from the Neo4j database mark-owned - Mark a list of objects as Owned mark-hvt - Mark a list of objects...

cypheroth

Cypheroth Conjunto de herramientas automatizado y extensible que ejecuta consultas cypher contra el backend Neo4j de Bloodhound y guarda la salida en hojas de cálculo. Descripción Este es un script Bash que automatiza la ejecución de consultas cypher contra datos de Bloodhound almacenados en una...

cypheroth

Cypheroth Automated, extensible toolset that runs cypher queries against Bloodhound's Neo4j backend and saves output to spreadsheets. Description This is a bash script that automates running cypher queries against Bloodhound data stored in a Neo4j database. I found myself re-running the same...

netstat2neo4j

Netstat Visualization with Neo4j Description Graphs help to spot anomalies and patterns in large datasets. This script takes netstat information from multiple hosts and formats them in a way to make them importable into Neo4j. Neo4j can be queried for find connections to certain hosts, from certa...

netstat2neo4j

Visualización de Netstat con Neo4j Descripción Los gráficos ayudan a detectar anomalías y patrones en grandes conjuntos de datos. Este script toma información de netstat de múltiples hosts y la formatea de manera que pueda importarse a Neo4j. Neo4j puede ser consultado para encontrar conexiones a...

Stormspotter

Stormspotter creates an “attack graph” of the resources in an Azure subscription. It enables red teams and pentesters to visualize the attack surface and pivot opportunities within a tenant, and supercharges your defenders to quickly orient and prioritize incident response work. Installation With...

ImproHound

ImproHound Identify the attack paths in BloodHound breaking your AD tiering ImproHound is a dotnet standalone win x64 exe with GUI. To use ImproHound, you must run SharpHound to collect the necessary data from the AD. You will then upload the data to your BloodHound installation. ImproHound will...