SourceWolf

SourceWolf ​ Tested environments: Windows, MAC, linux, and windows subsystem for linux WSL Sponsors Support this project by becoming a sponsor. Checkout these awesome sponsors: Oxylabs provides premium proxies with 100M+ IPs across 195 countries and ready-to-use Scraper APIs. You can use this...

TrueTree

TrueTree About Read all about the TrueTree concept here TrueTree is more than just a pstree command for macOS. It is used to display a process tree for current running processes while using a hierarchy built on additoinal pids that can be collected from the operating system. The standard process...

caldera

Caldera™ Caldera™ is a cyber security platform designed to easily automate adversary emulation, assist manual red-teams, and automate incident response. It is built on the MITRE ATT&CK™ framework and is an active research project at MITRE. The framework consists of two components: 1. The core...

ritm

Ruby In The Middle HTTP/HTTPS interception proxy Ruby in the middle RITM is an HTTP/HTTPS interception proxy with on-the-fly certificate generation and signing, which leaves the user with the full power of the Ruby language to intercept and even modify requests and responses as she pleases...

Audix

| / /| | / / / / / |// / // // // / / // |,/ ,/ // //|| is a PowerShell tool to quickly configure the Windows Event Audit Policies for monitoring & incident response. Please note: This tool will only change the local security policy. If applied to a host with a GPO setting, it is best to use the...

katana

A next-generation crawling and spidering framework Features • Installation • Usage • Scope • Config • Filters • Join Discord Features Fast And fully configurable web crawling Standard and Headless mode JavaScript parsing / crawling Customizable automatic form filling Scope control - Preconfigured...

iris-web

Incident Response Investigation System Current Version v2.4.20 Online Demonstration IRIS Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. Table of contents Getting Started Run IrisWeb Configuration Versioning Showcase...

attackgen

AttackGen AttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK and ATLAS frameworks. The tool generates tailored incident response scenarios based on user-selected threat actor groups, AI attack case...

sickrageWTF

Sickrage cleartext github credentials CVE-2018-9160 1. About Exploit Title: SickRage Clear-Text Credentials in HTTP Response Date: 2018-04-01 Exploit Author: Sven Fassbender Contact: https://twitter.com/mezdanak Vendor Homepage: https://sickrage.github.io Software Link:...

CVE-2023-0669

CVE-2023-0669 GoAnywhere MFT Deserialization - Je Yiuwai's Blog CVE-2023-0669 CVE-2023-0669 is a GoAnywhere MFT deserialization vulnerability. Due to the deserialization of an arbitrary attacker-controlled object, a pre-authenticated command injection vulnerability exists in the License Response...

Meerkat

Meerkat Meerkat is collection of PowerShell modules designed for artifact gathering and reconnaissance of Windows-based endpoints without requiring a pre-deployed agent. Use cases include incident response triage, threat hunting, baseline monitoring, snapshot comparisons, and more. Artifacts Host...

nuubi

Nuubi Tools Scanner, Recon. Details Options: -h/--help | Show help message and exit Arguments: -b/--banner | Banner grabing of target ip address -s/--subnet | Subnetlookup of target -c/--cms | Cms detect with headers -d/--dns | Dnslookup of target domain -e/--extract | Extract links from target...

nextjs-rce-incident-response

Next.js RCE Incident Response — CVE-2025-55182 Type: Live Production Incident Response Vulnerability: CVE-2025-55182 — React Server Components Insecure Deserialization RCE Affected System: Next.js frontend + remote production server Role: Cyber Security Intern — SenseLive Technologies Date:...

security checks

🔍 Miner Hunter Crypto-miner detection, removal, and hardening toolkit for Linux servers. Built from real-world incident response — detects miners that hide from ps, top, htop, and btop using rootkit techniques. 📦 Installation git clone https://gitlab.com/abdom.seada/security-checks.git cd...

rip_raw

Rip Raw Rip Raw is a small tool to analyse the memory of compromised Linux systems. It is similar in purpose to Bulk Extractor, but particularly focused on extracting system Logs from memory dumps from Linux systems. This enables you to analyse systems without needing to generate a profile. This ...

dissect

dissect Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT part of NCC Group. This project is a meta package, it will install all other Dissect modules wi...

CVE-2024-41107

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ 🚀 CVE-2024-41107...

ibm-qradar-ajp_smuggling_CVE-2022-26377_poc

CVE-2022-26377 A Proof of Concept developed by @watchTowr to exploit an AJP Smuggling vulnerability to poison the HTTP Response Queue of an IBM QRadar instance with a stored redirect. Follow the watchTowr Labs Team for our Security Research https://labs.watchtowr.com/...

Trawler

Dredging Windows for Persistence What is it? Trawler is a PowerShell script designed to help Incident Responders discover potential indicators of compromise on Windows hosts, primarily focused on persistence mechanisms including Scheduled Tasks, Services, Registry Modifications, Startup Items,...

stride-gpt

STRIDE GPT is an AI-powered threat modelling tool that leverages Large Language Models LLMs to generate threat models and attack trees for a given application based on the STRIDE methodology. Users provide application details, such as the application type, authentication methods, and whether the...