anteon

eBPF-powered Kubernetes Monitoring and Performance Testing Anteon automatically generates Service Map of your K8s cluster without code instrumentation or sidecars. So you can easily find the bottlenecks in your system. Red lines indicate the high latency between services. Documentation • Ddosify...

Singularity

Singularity - Stealthy Linux Kernel Rootkit "Shall we give forensics a little work?" Singularity is a powerful Linux Kernel Module LKM rootkit designed for modern 6.x kernels. It provides comprehensive stealth capabilities through advanced system call hooking via ftrace infrastructure. Full...

Furtex

Furtex Post-exploitation and evasion research toolkit for Linux, built around iouring and eBPF. No liburing, no frameworks, raw syscalls throughout. More tools soon. PRs are welcome. 🇧🇷 Join in Rootkit Researchers https://discord.gg/66N5ZQppU7 For authorized research and red team engagements only...

CVE-2020-27194

CVE-2020-27194 my exp for CVE-2020-27194, tested on linux kernel 5.8.14. More details : https://ama2in9.top/2020/12/14/CVE-2020-27194/ reference CVE-2020-8835 pwn2own 2020 ebpf 提权漏洞分析 CVE-2020-8835 pwn2own 2020 ebpf 通过任意读写提权分析...

buzzer

Buzzer - An eBPF Fuzzer toolchain Buzzer is a fuzzer toolchain that allows to write eBPF fuzzing strategies. A Fuzzing strategy is a way to generate random eBPF Programs and then validate that they don't have unexpected behaviour. To run the fuzzer follow the next steps 1. Install bazel. 2. Insta...

rex

| | \ / / | | | | | | | | \ / | | \ / / / \ ' / | |/ | ' / | | | || / | | \ \ | | | | \ \ || \//\ |//\\|| ||/|/|| ||/ Rex Kernel Extensions Table of Contents What is Rex Example program Build and run Documentations Why Rex License What is Rex Rex is a safe and usable kernel extension...

blackpill

BlackPill BlackPill is a stealthy Linux rootkit made in Rust. Features The rootkit is composed of multiple modules talking about Rust modules, not kernel modules: defense evasion : hide files, processes, network connections, etc. hooking : hook syscalls and IDT hypervisor : create a virtual machi...

ecapture

eCapture 旁观者 Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. English · 汉字 !IMPORTANT Supports Linux on x8664 kernel 4.18+, aarch64 kernel 5.5+, and LoongArch64 loong64 kernel 6.6+. Android supports x8664 and aarch64 with the existing kernel minimums. Requires root...

owLSM

🛡️ owLSM aspires to become the gold standard for prevention and detection for Linux 🛡️ owLSM is an eBPF LSM agent that implements a stateful Sigma rules engine focused on prevention. What is the project: owLSM focuses on three main things: 1 Prevention capabilities using a Sigma Rules Engine...

tracee

Before moving on, please consider giving us a GitHub star ⭐️. Thank you! About Tracee Tracee is a runtime security and observability tool that helps you understand how your system and applications behave. It is using eBPF technology to tap into your system and expose that information as events tha...

kubeshark

Network Observability for SREs & AI Agents Live Demo · Docs Kubeshark indexes cluster-wide network traffic at the kernel level using eBPF — delivering instant answers to any query using network, API, and Kubernetes semantics. What you can do: Download Retrospective PCAPs — cluster-wide packet...

TripleCross

TripleCross TripleCross is a Linux eBPF rootkit that demonstrates the offensive capabilities of the eBPF technology. TripleCross is inspired by previous implant designs in this area, notably the works of Jeff Dileo at DEFCON 271, Pat Hogan at DEFCON 292, Guillaume Fournier and Sylvain Afchain als...

cilium

.. raw:: html |cii| |go-report| |clomonitor| |artifacthub| |slack| |go-doc| |rtd| |apache| |bsd| |gpl| |fossa| |gateway-api| |codespaces| Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It provides a simple flat Layer 3 network with the ability to span...

CVE-2017-16995

Vulnerability Description Ubuntu is an open-source GNU/Linux operating system primarily used on desktops, based on Debian GNU/Linux. Recently, a white-hat hacker disclosed a local privilege escalation vulnerability in the latest version of Ubuntu Ubuntu 16.04, assigned CVE-2017-16995. This...

boopkit

================================================================ ██████╗ ██████╗ ██████╗ ██████╗ ██╗ ██╗██╗████████╗ ██╔══██╗██╔═══██╗██╔═══██╗██╔══██╗██║ ██╔╝██║╚══██╔══╝ ██████╔╝██║ ██║██║ ██║██████╔╝█████╔╝ ██║ ██║ ██╔══██╗██║ ██║██║ ██║██╔═══╝ ██╔═██╗ ██║ ██║ ██████╔╝╚██████╔╝╚██████╔╝██║ ██║...

tetragon

Cilium’s new Tetragon component enables powerful real-time, eBPF-based Security Observability and Runtime Enforcement. Tetragon detects and is able to react to security-significant events, such as Process execution events System call activity I/O activity including network & file access When used...

CVE-2017-16995

Linux Kernel Version 4.14 - 4.4 Ubuntu && Debian Description This vulnerability exists in the eBPF bpf2 system call in the Linux kernel. When a user provides a malicious BPF program that causes a calculation error in the eBPF verifier module, it leads to arbitrary memory read/write issues...

pamspy

pamspy -- Credentials Dumper for Linux pamspy leverage eBPF technologies to achieve an equivalent work of 3snake. It will track a particular userland function inside the PAM Pluggable Authentication Modules library, used by many critical applications to handle authentication like: sudo sshd passw...

ayaFlow

ayaFlow ayaFlow is a Rust + eBPF network traffic analyzer built with Aya. It runs one agent per Linux node, attaches a TC classifier at ingress and egress, and exposes live traffic data, historical SQLite-backed history, and Prometheus metrics. What It Does Captures IPv4, IPv6, TCP, and UDP traff...

guardd

Guardd Behavioral anomaly detection for Linux, powered by eBPF and machine learning. Guardd learns how a Linux host normally behaves and flags activity that differs from that baseline. Kernel sensors collect process executions and outbound TCP connection attempts; an Isolation Forest scores the...