CVE-2020-2978

CVE-2020-2978 CVE-2020-2978 refrence link for PoC: https://databasesecurityninja.wordpress.com/2020/12/01/cve-2020-2978-rman-audit-table-point-in-time-recovery-not-logged/...

rekor

Rekor Rekór - Greek for “Record” Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. Rekor will enable software maintainers and build systems to record signed metadata to an immutable record. Other parties can then query...

EvtMute

EvtMute This is a tool that allows you to offensively use YARA to apply a filter to the events being reported by windows event logging. Usage Grap the latest verison from here. EvtMuteHook.dll contains the core functionality, once it is injected it will apply a temporary filter which will allow a...

ImpossibleTravelLogAnalysis

Impossible Travel Log Analysis by NCC Group About Basic log analysis tool to detect impossible travel via IP address geographic information Expected Data Format A CSV file with the following headers When,User,Event,IP With the following format 2019-04-09...

CVE-2023-21839-metasploit-scanner

CVE-2023-21839-metasploit-scanner Usage git clone https://github.com/kurehalin/CVE-2023-21839-metasploit-scanner cd CVE-2023-21839-metasploit-scanner mkdir -p /.msf4/modules/auxiliary/scanner/http cp weblogiciioprce.py /.msf4/modules/auxiliary/scanner/http chmod +x...

Crassus

Crassus Windows privilege escalation discovery tool Quick start 1. In Process Monitor, select the Enable Boot Logging option. 2. Reboot. 3. Once you have logged in and Windows has settled, run Process Monitor once again. 4. When prompted, save the boot log, e.g., to raw.PML. 5. Reset the default...

titus

Titus: High-Performance Secrets Scanner Titus is a high-performance secrets scanner that detects credentials, API keys, and tokens in source code, files, and git history. It ships with 487 detection rules covering hundreds of services and credential types, drawn from NoseyParker and Kingfisher...

SuricataLog

SuricataLog When I started learning how to use Suricata quickly found that I needed a tool to inspect the eve.json file; Most of the tutorials and documentation out there suggested installing a stack to do the following tasks: 1. Store the logs in a central location 2. Normalize and enrich the...

massdns

MassDNS A high-performance DNS stub resolver MassDNS is a simple high-performance DNS stub resolver targeting those who seek to resolve a massive amount of domain names in the order of millions or even billions. Without special configuration, MassDNS is capable of resolving over 350,000 names per...

lazarus-sigma-rules

Lazarus Sigma Rules The Sigma rules in this repository were created by the F-Secure Countercept Detection and Response Team to provide detection coverage for the Tools, Techniques and Procedures recently used by the Lazarus Group. The blog posts discussing the creation of these Sigma rules can be...

ossec-hids

OSSEC v4.3.0 Information about OSSEC OSSEC is a full platform to monitor and control your systems. It mixes together all the aspects of HIDS host-based intrusion detection, log monitoring and SIM/SIEM together in a simple, powerful and open source solution. Visit our website for the latest...

log4j

Log4J Zero-Day Compilation of log4j OSINT findings, including Detection, Attack Surface, Mitigation, IoCs. I. Overview Summary This vulnerability makes it possible for any attacker who can inject text into log messages or log message parameters into server logs to load code from a remote server...

hijackthis

Download Latest build v3.x - Release Stable build v2 outdated - not updated anymore this is beta-version - major changes are in progress; although it is definitely safe to use HiJackThis+ HiJackThis+ Plus previously called: HiJackThis Fork v3 is a fork and a continuation of the original Trend Mic...

msticpy

MSTIC Jupyter and Python Security Tools Microsoft Threat Intelligence Python Security Tools. msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks. It includes functionality to: query log data from multiple sources enrich the data with Threat Intelligence, geolocations a...

ollydbg-binary-execution-visualizer

This repository does not have a README...

S1EM

Objectives Today, cyber attacks are more numerous and cause damage in companies. Nevertheless, many software products exist to detect cyber threats. The S1EM solution is based on the principle of bringing together the best products in their field, free of charge, and making them quickly...

Zeek-Endpoint-Enrichment

Zeek-Endpoint-Enrichment Enrich Zeek logs with host information To enrich all logs with an id field, use the tag ".-all". To enrich all logs with an id field, and the Known Entities, use the tag ".-known-all". To only enrich the conn.log, use the tag ".-conn". To only enrich the conn.log, and the...

nginx_log_check

nginxlogcheck Nginx log security analysis script Features Top 20 address statistics SQL injection analysis Scanner alert analysis Vulnerability exploitation detection Sensitive path access File inclusion attack Webshell Find Top 20 URLs by response length Find rare script file access Find 302...

mongobleed-detector

MongoBleed Detector Offline MongoDB Analysis Tool for CVE-2025-14847 MongoBleed A standalone Linux command-line tool that analyzes MongoDB data to identify likely exploitation of CVE-2025-14847 using multiple detection modules. Table of Contents Overview Detection Modules Requirements Installatio...

DeTTECT

Detect Tactics, Techniques & Combat Threats Latest version: 2.2.0 To get started with DeTT&CT, check out one of these resources: This page on the Wiki. This blog written by Renaud Frère from NVISO has a comprehensive and recent description on the capabilities of DeTT&CT. Blog:...