NetworkAssessment

NetworkAssessment: Network Compromise Assessment Tool The Network Compromise Assessment Tool is designed to analyze pcap files to detect potential suspicious network traffic. This tool focuses on spotting abnormal activities in the network traffic and searching for suspicious keywords. Features D...

ThunderDNS

ThunderDNS This tool can forward TCP traffic over DNS protocol. Non-compile clients + socks5 support. Run Setting up NS records on our domain: Please wait for clearing DNS-cache. Simple server run: python3 ./server.py --domain oversec.ru Simple server run Dockerfile: docker run -e DOMAIN='' Simpl...

Network_Assessment

Network Assessment With Wireshark or TCPdump, you can determine whether there is harmful activity on your network traffic that you have recorded on the network you monitor. This Python script analyzes network traffic in a given .pcap file and attempts to detect the following suspicious network...

rita

RITA Real Intelligence Threat Analytics If you get value out of RITA and would like to go a step further with hunting automation, futuristic visualizations, and data enrichment, then take a look at AC-Hunter. Brought to you by Active Countermeasures. Sponsored by BHIS. RITA is an open source...

rita

RITA Inteligencia de Amenazas en Tiempo Real Si RITA te resulta útil y deseas ir un paso más allá con automatización de caza, visualizaciones futuristas y enriquecimiento de datos, echa un vistazo a AC-Hunter. Presentado por Active Countermeasures. Patrocinado por BHIS. RITA es un marco de trabaj...

iodine

iodine - https://code.kryo.se/iodine This is a piece of software that lets you tunnel IPv4 data through a DNS server. This can be usable in different situations where internet access is firewalled, but DNS queries are allowed. COMPILING Iodine has no configure script. There are two optional...

dnscat2

NOTE: The password for the .zip downloads are all "password"! Introduction Welcome to dnscat2, a DNS tunnel that WON'T make you sick and kill you! This tool is designed to create an encrypted command-and-control C&C channel over the DNS protocol, which is an effective tunnel out of almost every...

dns-black-cat

DNS-Black-CatDBC Multi-platform toolkit for an interactive C2C DNS shell, by using DNS-Black-Cat, you will be able to execute system commands in shell mode over a fully encrypted covert channel. Server ported as a python script, which acts as DNS server with required functionalities to provide...

siphondns

SiphonDNS A PoC for techniques described in this research. Implements data exfiltration via non-standard sections of DNS. Server: root@kitploit: $ ./siphondns-server -method ecs Starting DNS server cmd id Command received Receiving...

DNS-Shell

DNS-shell DNS-Shell is an interactive Shell over DNS channel. The server is Python based and can run on any operating system that has python installed, the payload is an encoded PowerShell command. Understanding DNS-Shell The Payload is generated when the sever script is invoked and it simply...

DNS-Tunnel-Keylogger

DNS Tunnel Keylogger This post-exploitation keylogger will covertly exfiltrate keystrokes to a server. These tools excel at lightweight exfiltration and persistence, properties which will prevent detection. It uses DNS tunelling/exfiltration to bypass firewalls and avoid detection. Server Setup T...

DNS_Tunneling

Intro Inspired by recent work I did involving Cobalt Strike DNS beacons, in conjunction with a mission statement to try and evade Microsoft Defender for Endpoint, I spent some time looking into how DNS might be used to transfer a payload to a target machine. I further wanted to challenge myself b...

Pulsar

Pulsar Pulsar is a tool for data exfiltration and covert communication that enable you to create a secure data transfer, a bizarre chat or a network tunnel through different protocols, for example you can receive data from tcp connection and resend it to real destination through DNS packets 🎉...

dnschan

dnschan This is a trojan that runs over DNS. You can: handle multiple agents very slowly upload files fetch files from the web run processes...

flightsim

网络飞行模拟器 flightsim 是一个轻量级工具，用于生成恶意网络流量，帮助安全团队评估安全控制和网络可见性。该工具执行测试以模拟 DNS 隧道、DGA 流量、向已知活跃 C2 目的地的请求以及其他可疑流量模式。 安装 从 GitHub Releases 页面下载适用于您操作系统的最新 flightsim 二进制文件。或者，可以在任何环境（例如 Linux、macOS、Windows）中使用 Golang 构建该工具，如下所示： root@kitploit: go install github.com/alphasoc/flightsim/v2@latest 运行网络飞行模拟器...

DNSlivery

DNSlivery Easy files and payloads delivery over DNS. DNSlivery Acknowledgments Description TL;DR What problem are you trying to solve? How does it work? Requirements Setup DNS Zone DNSlivery Usage Server Target Acknowledgments This project has been originally inspired by PowerDNS and Joff Thyer's...

dnscat2-powershell

dnscat2 is a DNS covert channel tool by @iagox86 Ron Bowes which is used to transfer data over DNS requests. This is a powershell version of the dnscat2 C client. Click here for a blog post that gives a more detailed breakdown of the purpose of this script, and how to use it. To use this script,...

DNSlivery

DNSlivery Easy files and payloads delivery over DNS. DNSlivery Acknowledgments Description TL;DR What problem are you trying to solve? How does it work? Requirements Setup DNS Zone DNSlivery Usage Server Target Acknowledgments This project has been originally inspired by PowerDNS and Joff Thyer's...

Malicious code in techportal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d947d5b4ddaa0ea6a25488fb5b5a66b3afc5c8f56d5ac38fb2e95e4b23242f3 package.json declares a preinstall hook node beacon.js that fires automatically on npm install. beacon.js reads os.hostname, os.userInfo.username, an...

MAL-2026-15561 Malicious code in techportal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d947d5b4ddaa0ea6a25488fb5b5a66b3afc5c8f56d5ac38fb2e95e4b23242f3 package.json declares a preinstall hook node beacon.js that fires automatically on npm install. beacon.js reads os.hostname, os.userInfo.username, an...