RedELK

RedELK The Red Team's SIEM - a tool for Red Teams for tracking and alarming about Blue Team activities as well as enhanced usability in long term operations. 1. Enhanced usability and overview for the red team operators by creating a central location where all relevant operational logs from...

reversemap

reversemap Analyse SQL injection attempts in web server logs The program can either be run in batch mode or interactive mode. In batch mode the program will accept Apache web server logs and will deobfuscate requested URLs from the logs. In interactive mode the program will prompt for user input...

csf

ArmourBird CSF - Container Security Framework Note: The CSF Client is under active development and is getting converted into GoLang for better performace and architecture Table of Contents 1. About 2. Architecture Diagram 3. APIs-CSF Server 4. Installation/Usage 5. Building Docker Images 6. Sneak...

terraform-aws-secure-baseline

terraform-aws-secure-baseline Terraform Module Registry A terraform module to set up your AWS account with the reasonably secure configuration baseline. Most configurations are based on CIS Amazon Web Services Foundations v1.4.0 and AWS Foundational Security Best Practices v1.0.0. See Benchmark...

Malcolm

Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based...

ketshash

Ketshash A little tool for detecting suspicious privileged NTLM connections, in particular Pass-The-Hash attack, based on event viewer logs. The tool was published as part of the "Pass-The-Hash detection" research - more details on "Pass-The-Hash detection" are in the blog post:...

ALEAPP

Android 日志、事件与 Protobuf 解析器 如果你想贡献代码，请在此联系我：https://abrignoni.github.io 博客文章请见：https://leapps.org/blog 环境要求 Python 3.10 或更高版本 依赖项 你的 Python 环境所需的依赖项列在 requirements.txt 中。请使用以下命令安装它们。请确保 py 部分与你的环境匹配，例如 py、python 或 python3 等。 py -m pip install -r requirements.txt 或 pip3 install -r requirements.txt...

log4j-ioc-detector

log4j Linux IoC 检测器 一个基础的 Bash 脚本，用于检测 Linux 中的 log4j 入侵指标（IoC）。 使用方法 1. 克隆此仓库： root@kitploit: git clone https://github.com/santosomar/log4j-ioc-detector 2. 如下所示，运行 log4jiocdetector.sh 脚本： root@kitploit: bash sudo log4jiocdetector.sh A basic Bash script to detect log4j Indicator of Compromise IoC...

kippo

NOTE: For more recent development, check out Michel Oosterhof's fork Kippo Kippo is a medium interaction SSH honeypot designed to log brute force attacks and, most importantly, the entire shell interaction performed by the attacker. Kippo is inspired, but not based on Kojoney. Demo Some interesti...

CVE-2022-47966_checker

CVE-2022-47966checker ManageEngine CVE-2022-47966のIOCを検索するための簡易PowerShellスクリプトです。このスクリプトは、ME HTTPアクセスログ内のリクエストを解析します。特徴的なSAMLリクエストが見つかった場合、攻撃者のペイロードをデコードして抽出しようとします。結果は C:\aceresponderCVE-2022-47966checker.csv に書き込まれます。管理者として実行してください。...

killshot

This project is no longer maintained ! KILLSHOT A Penetration Testing Framework, Information gathering tool & Website Vulnerability Scanner Why KillShot? You can use this tool to spider your website, gather important information, and automate data collection using tools such as WhatWeb, Host,...

DeepBlueCLI

DeepBlueCLI DeepBlueCLI - Windowsイベントログを介した脅威ハンティングのためのPowerShellモジュール Eric Conrad, Backshore Communications, LLC deepblue at backshore dot net Twitter: @ericconrad http://ericconrad.com サンプルのEVTXファイルは.\evtxディレクトリにあります 注:...

CVE-2021-40223

CVE-2021-40223 应用 : Rittal CMC PU III Web management 设备 : CMC PU III 7030.000 软件版本 : V3.11.002 硬件版本 : V3.00 攻击类型 : 存储型XSS 解决方案 : 更新到软件版本 V3.17.10 或更高版本 摘要 :...

uac

Unix-like Artifacts Collector UAC About • Documentation • Main Features • Supported Operating Systems • Usage • Contributing • Support • License 🔎 About UAC UAC Unix-like Artifacts Collector is a powerful and extensible incident response tool designed for forensic investigators, security analysts...

octosuite

Terminal-based toolkit for GitHub data analysis. root@kitploit: $ octosuite user torvalds root@kitploit: from pprint import pprint import octosuite user = octosuite.Username="torvalds" exists, profile = user.exists if exists: pprintprofile Installation root@kitploit: pip install octosuite Usage T...

APT-Hunter

APT-Hunter APT-Hunterは、Windowsイベントログ向けのThreat Huntingツールであり、パープルチームの考え方に基づいて設計されています。Windowsイベントログの海に隠れたAPTの動きを検出し、疑わしいアクティビティを発見するまでの時間を短縮します。APT-Hunterは事前定義された検出ルールを使用し、統計に焦点を当てて異常を明らかにします。これは侵害評価において非常に効果的です。出力はタイムラインとともに生成され、Excel、Timeline Explorer、Timesketchなどで直接分析できます。...

Malcolm

Malcolm Malcolm 是一个强大的网络流量分析工具套件，旨在实现以下目标： 易于使用 – Malcolm 接受全包捕获（PCAP）文件、Zeek 日志和 Suricata 警报形式的网络流量数据。这些工件可以通过简单的基于浏览器的界面上传，或使用轻量级转发器被动捕获并实时转发给 Malcolm。无论哪种方式，数据都会被自动标准化、丰富并关联以进行分析。 强大的流量分析 – 通过两个直观的界面提供网络通信的可见性：OpenSearch Dashboards（一种灵活的数据可视化插件，提供数十个预置仪表板，可一目了然地查看网络协议）和...

EUVD-2026-77516

Description The Logviewer offers logs.users and logs.groups so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer...

CVE-2026-82437

Apache Storm Logviewer fails to enforce its configured logs.users and logs.groups access controls for daemon logs . The root cause is twofold: the access-decision logic discarded the authorizer's result whenever the "daemon log" flag was set, and the daemon log page and download endpoints reached...

CVE-2026-82437 Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer

Description The Logviewer offers logs.users and logs.groups so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer...