SkillsGuard

Support Development If SkillsGuard protects your pipeline, consider supporting ongoing research and new detection rules. ETH Donation Wallet 0x11282eE5726B3370c8B480e321b3B2aA13686582 Scan the QR code or copy the wallet address above. Static security scanner for AI agent skill packages. Detects...

pyod

.. image:: https://raw.githubusercontent.com/yzhao062/pyod/master/brand/pyod-icon.svg :target: https://pyod.dev :alt: PyOD Ecosystem :width: 84px Python Outlier Detection PyOD 3 PyOD 3: Agentic Anomaly Detection At Scale |badgewebsite| |badgepypi| |badgeanaconda| |badgedocs| |badgestars|...

nmap

Nmap Nmap is released under a custom license, which is based on but not compatible with GPLv2. The Nmap license allows free usage by end users, and we also offer a commercial license for companies that wish to redistribute Nmap technology with their products. See Nmap Copyright and Licensing for...

BeaconHunter

BeaconHunter Behavior based monitoring and hunting tool built in C leveraging ETW tracing. Blue teamers can use this tool to detect and respond to potential Cobalt Strike beacons. Red teamers can use this tool to research ETW bypasses and discover new processes that behave like beacons. Author :...

zeek-gozi-detector

Gozi Malware Detector This Zeek packages detects Gozi banking malware activity. Resources: The RAR files this package looks for were discussed in the following articles: https://unit42.paloaltonetworks.com/march-wireshark-gozi-answers/...

shfz

shfz A scenario-based web application fuzzng tool that supports fuzz generation by genetic algorithm. Features Easy to customize fuzzing test by scripting fuzzing scenario in JavaScript / TypeScript Third-party packages can be used in fuzzing scenario script Genetic algorithm fuzz generation...

ProHunter

📋 Overview This project is a core module of the ProHunter system, primarily designed to perform malicious judgment on threat graphs sampled from the PPG module. The main idea of this methods is that uses inexact graph vector matching to calculate vector similarity between threat graphs and attack...

hexora

hexora Hexora is a static analysis tool designed to detect malicious and harmful patterns in Python code. It combines a rule-based static analysis engine with a machine-learned model that scores entire source files to classify them as malicious or benign. It can be used to: Audit project...

freedomfighting

Freedom Fighting scripts This repository contains scripts which may come in handy during your freedom fighting activities. It will be updated occasionally, when I find myself in need of something I can't find online. Everything here is distributed under the terms of the GPL v3 License...

sigint-hombre

sigint-hombre Author: John Page — malvuln aka hyp3rlinx Copyright c 2026 Purpose: Generate derived Suricata detection rules from live URLhaus threat indicators at runtime and deploy them to the Security Onion platform for high-coverage real-time network monitoring. Current Version v2.0 • Major...

beacon-hunter

Beacon Hunter Detecting Non-Periodic Structured C2 via Additive Recurrence Beacon Hunter detects command-and-control beaconing that uses phi-compatible additive recurrence scheduling — a growing, non-periodic timing pattern where each inter-connection interval approximately equals the sum of the...

xsshunter

DEPRECATED - TRY THE NEW EXPRESS VERSION See here for more info: https://github.com/mandatoryprogrammer/xsshunter-express XSS Hunter Source Code This is a portable version of the source code running on https://xsshunter.com. It is designed to be easily-installable on any server for security...

soc-automation-lab

SOC Automation Lab This repository documents the design, detection logic, automation workflows, and lessons learned from building an automated SOC demo using open-source tools. The project focuses on how alerts move from detection to investigation and notification , and what breaks along the way...

FuckJsonp-RCE-CVE-2022-26809-SQL-XSS-FuckJsonp

The tracing method of this honeypot targets red team members using mobile hotspots. The honeypot directly obtains the attacker's phone number for tracing. It catches them every time. Red team members, be careful. First, when you open the website, it monitors whether the F12 console is opened. If...

autoSource

AutoSource AutoSource is an automated source code review framework integrated with SonarQube which is capable of performing static code analysis/reviews. It can be used for effectively finding the vulnerabilities at very early stage of the SDLCSoftware Development Life Cycle. The user can scan th...

brutus

Brutus "Et tu, Brute?" — The last words before credentials fall. Modern credential testing tool in pure Go Installation • Quick Start • Pipeline • Protocols • Enumeration • Proxy • Library Overview Brutus is a multi-protocol authentication testing tool designed to address a critical gap in...

CVE-2020-0688-Scanner

CVE-2020-0688-Scanner This script scans an IP/range/CIDR and outputs the Microsoft Exchange Servers and Versions discovered. The specified IP/range/CIDR will be scanned with masscan on port tcp/443. After a successful scan it tries to HTTP GET "/owa/auth/logon.aspx" with curl to grab the Outlook...

vulnrepro-benchmark

VulnRepro A benchmark that checks if an AI model can actually review vulnerable code, or if it just sounds confident. Most security benchmarks ask one question: can the model find the bug? That is only half the job. The other half, the part that actually wears you down in real review work, is not...

BerrySentinel

🫐 Berry Sentinel Real-time behavioral C2 Command & Control connection detector Zero-signature · Bulletproof Collection · Deep Scan · Kill Engine What is it? Berry Sentinel monitors all active network connections on your system and analyzes the behavior of the processes that generate them to detec...

CVE-2024-1086-checker

CVE-2024-1086-checker This is a simple checker script to detect the kernel configuration which is vulnerable to exploitation. A result of "kernel config not vulnerable" from this script only means that the vulnerability is not exploitable with currently known paths. How to Use curl -s...