evtx

EVTX A cross-platform parser for the Windows XML EventLog format Features 🔒 Implemented using 100% safe rust - and works on all platforms supported by rust that have stdlib. ⚡ Fast - see benchmarks below. It's faster than any other implementation by orders of magnitude! 🚀 Multi-threaded. ✨ Suppor...

kcmapper

KcMapper KcMapper is a tool for exporting Keycloak configuration data into a Neo4j graph database. This representation allows for the analysis of relationships between realms, clients, users, groups, and roles. The tool includes a web interface to run pre-defined Cypher queries for analysis and...

GoodHound

GoodHound / / / / / / / / / / / / / / / // / / / / / / / / // / // / // / // / / // / // / / / / // / ///,// ///,// //,/ Attackers think in graphs, defenders think in actions, management think in charts. GoodHound operationalises Bloodhound by determining the busiest paths to high value...

CVE-2024-8309

Proof of Concept for Langchain CVE-2024–8309 Vulnerability Overview This setup demonstrates a proof of concept for the prompt injection vulnerability in the GraphCypherQAChain class that allows SQL injection in a Neo4j database. Components: 1. Neo4j Database : Runs Neo4j. 2. Backend FastAPI :...

autobloody

autobloody autobloody is a tool to automatically exploit Active Directory privilege escalation paths shown by BloodHound. Description This tool automates the AD privesc between two AD objects, the source the one we own and the target the one we want if a privesc path exists in BloodHound database...

cloudmapper

CloudMapper Note the Network Visualization functionality command prepare is no longer maintained. CloudMapper helps you analyze your Amazon Web Services AWS environments. The original purpose was to generate network diagrams and display them in your browser functionality no longer maintained. It...

aclpwn.py

aclpwn.py Aclpwn.py is a tool that interacts with BloodHound to identify and exploit ACL based privilege escalation paths. It takes a starting and ending point and will use Neo4j pathfinding algorithms to find the most efficient ACL based privilege escalation path. Aclpwn.py is similar to the...

cypherhound

CypherHound A Python3 terminal application that contains Neo4j cyphers for BloodHound data sets with a script to automate importing them into BloodHound CE. Output Samples Terminal HTML Report HTML Report continued Why? BloodHound is a staple tool for every penetration tester. However, there are...

nuvola

nuvola nuvola with the lowercase n is a tool to dump and perform automatic and manual security analysis on AWS environments configurations and services using predefined, extensible and custom rules created using a simple Yaml syntax. The general idea behind this project is to create an abstracted...

netstat2neo4j

Netstat Visualization with Neo4j Description Graphs help to spot anomalies and patterns in large datasets. This script takes netstat information from multiple hosts and formats them in a way to make them importable into Neo4j. Neo4j can be queried for find connections to certain hosts, from certa...

FalconHound

FalconHound NOTE: As of the BloodHound CE 7.0 release, the default database has been switched to Postgres. This version of FalconHound still relies on Neo4j to be the default database. If you want to keep using FalconHound while running the latest BloodHound version, add the following line to you...

beagle

Beagle 1. About Beagle 2. Installation 1. Docker 2. Python Package 3. Configuration 3. Web Interface 1. Uploading Data 2. Browsing Existing Graphs 3. Graph Interface 1. Inspecting Nodes and Edges 2. Expanding Neighbours 3. Hiding Nodes 4. Running Mutators 5. Toggling Node and Edge Types 6...

PurplePanda

PurplePanda This tool fetches resources from different cloud/saas applications focusing on permissions in order to identify privilege escalation paths and dangerous permissions in the cloud/saas configurations. Note that PurplePanda searches both privileges escalation paths within a platform and...

epagneul

epagneul Epagneul is a tool to visualize and investigate windows event logs. Deployment Requires docker and docker-compose to be installed. Installing make Offline deployment On a machine connected to internet, build an offline release: make release This will create a release folder containing...

cypheroth

Cypheroth Automated, extensible toolset that runs cypher queries against Bloodhound's Neo4j backend and saves output to spreadsheets. Description This is a bash script that automates running cypher queries against Bloodhound data stored in a Neo4j database. I found myself re-running the same...

cartography

Documentation Cartography is a Python tool that pulls infrastructure assets and their relationships into a Neo4j graph database. What it connects: AWS, GCP, Azure, Kubernetes, GitHub, Okta, Entra ID, CrowdStrike, and 30+ more platforms. Questions it answers: Which identities have access to which...

Max

Maximizing BloodHound with a simple suite of tools Description New Release: dpat - The BloodHound Domain Password Audit Tool DPAT A simple suite of tools: get-info - Pull lists of information from the Neo4j database mark-owned - Mark a list of objects as Owned mark-hvt - Mark a list of objects...

thingernet-graph

thingernet-graph Python script to generate neo4j Cypher representation of a collection of IoT devices for visualisation and query. The script reads a directory of JSON files describing 'things' and creates the relevant neo4j cypher text for import to neo4j in order to produce a graph database...

CVE-2026-1337

CVE-2026-1337 - Neo4j - Log Injection Log injection by an authenticated user is possible in the Neo4j query.log when Neo4j is not configured to be in json format. Summary Neo4j does not escape control characters in the metadata field when of a bolt transaction. An autenticated user could send...

ODIN

ODIN Observe, Detect, and Investigate Networks Current version: v2.0.0 "Huginn" ODIN is Python tool for automating intelligence gathering, asset discovery, and reporting. Remember, check the dev branch for the bleeding edge, and feedback is welcome! See the GitHub wiki for details and installatio...