waf-detector

WAF Detector CLI tool for detecting, testing, and profiling Web Application Firewalls WAFs and Content Delivery Networks CDNs. Important: Only test systems you own or have explicit authorization to test. For AI coding agents: See AGENTS.md for skill mapping and workflow pointers. Use...

ubuntils

ubuntils Forensic triage for live Ubuntu systems — automated artifact collection, persistence detection, and guided remediation in under 5 seconds. The Problem When you suspect a Linux system is compromised, the first 30-40 minutes are usually spent running the same ten commands in sequence: chec...

scan

Atomdrift Scan Atomdrift Scan is a modern ML-based malware scanner designed to detect 0-day attacks against the software supply-chain. It's designed to be deterministic, fast, and flexible, and embeddable in any workflow or security tool you have in mind, and can operate against files, archives,...

Malicious code in ig-gox (PyPI)

Source: kam193 780638a0747103eb44a85312a2cfb552981e498655f638c5baf86eb4a5f74042 Package hides obfuscated code aimed to avoid analysis and downloading the remote stage. The remote code is used to abuse Instagram service for mass fake account registration. --- Category: MALICIOUS - The campaign has...

Yara-rules

About What is this? A repo containing some of my privately developed Yara rules. Why? To contribute to the community. Can I use these rules? Of course! That's why I created this repo. You can use them in your detection systems. For example, CAPE sandbox, MalwareBazaar, UnPac.me and VirusTotal mus...

sysmon-modular

sysmon-modular | A Sysmon configuration repository for everybody to customise Sysmon Modular is a configuration repository for Microsoft Sysinternals Sysmon. Small XML modules make it easier to select, review and maintain the telemetry that is useful to your organisation. The sysmon-modular Go to...

zombieguard

ZombieGuard A defensive scanner for structural metadata evasion in ZIP archives. ZombieGuard detects contradictions between ZIP local file headers, central directory records, and payload characteristics. These contradictions can be used to make archive contents appear empty or harmless to one...

Siem-queries-for-CVE-2021-44228

This repository does not have a README...

CVE-2023-21716_YARA_Results

This repository does not have a README...

unidbg

unidbg Allows you to emulate an Android native library, and an experimental iOS emulation. This is an educational project to learn more about the ELF/MachO file format and ARM assembly. Use it at your own risk ! Features Support MCP Model Context Protocol for AI-assisted debugging with Cursor and...

wp2shell-compromise-scanner-plugin

Compromise Scanner for wp2shell read-only A standalone, read-only WordPress plugin that scans your database and plugin directory for signs that the wp2shell core chain CVE-2026-63030 + CVE-2026-60137 was exploited — even if it happened weeks ago or the attacker cleaned up. It changes nothing on...

XSS2Shell-CVE-2026-64638

XSS2Shell Multi-Target Scanner Developer: YogaGymn PoC/scanning utility for authorized WordPress security testing. The project contains a single-target exploitation workflow and a concurrent multi-target scan-only mode. Important: Use this project only on WordPress installations that you own or...

ai-security-battle

🤖 AI Security Battle System Red Team vs Blue Team: Adversarial ML Combat Simulation A comprehensive adversarial machine learning security simulation where Red Team attackers battle against Blue Team defenders in a 30-minute AI/ML security warfare scenario. 🎯 Project Overview This system simulates...

DeTTECT

Detect Tactics, Techniques & Combat Threats Latest version: 2.2.0 To get started with DeTT&CT, check out one of these resources: This page on the Wiki. This blog written by Renaud Frère from NVISO has a comprehensive and recent description on the capabilities of DeTT&CT. Blog:...

BurpSuite-For-Pentester

🕷️ BurpSuite for Pentester A practical Burp Suite cheat sheet and learning guide designed for bug bounty hunters and penetration testers to efficiently discover web application vulnerabilities from low severity P4 to critical P1 using Burp Suite. This repository provides a structured reference for...

Malware

YARA rules, programs for ransomware families: Akira Babuk Beast BlackByte BlackCat ALPHV BlackMatter BlueLocker MemeCryptor Cerber Conti DarkBit DeadBolt Dharma Enmity GarrantyDecrypt GlobeImposter / NewBomani GoodMorning / SD HardBit Hive / Hunters International HsHarada / Rapture Hunters...

canarytokens-docker

Dockerisierte Canarytokens von Thinkst Applied Research Überblick Canarytokens helfen dabei, Aktivitäten und Aktionen in Ihrem Netzwerk zu verfolgen. Wenn Sie Probleme haben, schauen Sie bitte in unsere FAQ hier oder erstellen Sie ein Issue, und wir werden versuchen, uns so schnell wie möglich be...

NexaCorp-DFIR-INC-2026-001

NexaCorp DFIR: INC-2026-001 - Linux Infrastructure Compromise DFIR investigation and detection engineering on a simulated intrusion against NexaCorp infrastructure. Conducted as a 4-day solo engagement BeCode Brussels Blue & Red Team bootcamp, Mission 01. The deliverable is a 54-page findings...

Sigma-Rules

Sigma-Rules A repository of my own Sigma detection rules...

linux-malware-detect

Linux Malware Detect LMD Scanner di malware per Linux — rilevamento delle minacce multi-stadio MD5, SHA-256, HEX, YARA, analisi statistica, integrazione con ClamAV, monitoraggio in tempo reale tramite inotify, operazioni di quarantena/pulizia/ripristino e alerting multi-canale email, Slack,...