Atomic-Red-Team-C2

説明 ARTC2は、単一および複数の侵害ポイントターゲットからの攻撃シナリオ実行をスケーリングするための最新の実行フレームワークです。セキュリティ製品とインシデント対応の効果を向上させる、実用的な攻撃インテリジェンスを生成することを目的としています。 対応OS Windows OS 機能 ARTC2のコア機能はSILENTTRINITYから提供され、Booを通じて実行されるアトミックテストはATOMIC-RED-TEAMから提供されています。その他の機能強化は、運用上のクラフト、俊敏性、スケーラビリティ、迅速な実行が損なわれないように構築されています。...

kubernetes-goat

Kubernetes Goat ✨ The Kubernetes Goat is designed to be an intentionally vulnerable cluster environment to learn and practice Kubernetes security 🚀 🙌 Refer to https://madhuakula.com/kubernetes-goat for the guide 📖 🧰 Setting up Kubernetes Goat Ensure you have admin access to the Kubernetes cluster...

redteam-ai-benchmark

Red Team AI ベンチマーク ロシア語版: README.ru.md Red Team AI Benchmarkは、CLIのモデル評価ベンチマーク です。これは、LLMがレッドチームの質問やセキュリティシナリオをどのように理解し応答するかを測定します。これらの活動を実行するためのツールではありません。バージョン2では、1つの正解に対してのみ回答を評価するのではなく、ルーブリックベースのデータセットを使用しています。 デフォルトのv2スイートは、datasets/v2/benchmark.jsonlに60の質問を含み、ドメインと難易度でグループ化されています。 リポジトリのステータ...

telegram-osint-lib

Telegram OSINT 场景库 描述 网上有很多 Telegram API 库，但没有任何一个库演示如何执行复杂场景，例如从频道下载所有照片、监控用户在线状态或注册新账户。本项目旨在改善这一现状：现在您可以轻松创建新场景，并一键执行现有场景。 使用官方 Android 客户端的 Telegram API。 设计原理 Telegram 协议 https://core.telegram.org/ 提供了技术详尽且完整的文档，但并未涵盖使用场景。我们的目标是制作一个库，实现一些真实的 OSINT 使用场景，包括： 在特定群组中搜索用户； 解析群组成员； 监控用户在线状态； 从频道下载照片...

hyenae-ng

Hyenae NG Hyenae NG Next Generation is a re-write of the original Hyenae tool which was originally published back in the year 2010. Besides switching from C to C++, using modern design concepts, Hyenae NG was just like the original Hyenae written with maximum portability in mind. Since the origin...

HazProne

Hazprone HazProne 是一个云渗透测试框架，通过部署按需易受攻击的 AWS 资源来模拟接近真实世界的场景，使您能够渗透测试其中的漏洞，从而更好地理解可能出现的问题及其原因！！ 该框架有助于获得实用的 AWS 渗透测试知识/技能。 它包含多个被称为“Quests”的、接近真实世界的易受攻击场景。每个任务包含一个 flag，用户需要找到该 flag 才能完成任务。 通过这种方式，可以更深入地了解不同类型的漏洞以及利用 AWS 资源的方法。 截至目前，该框架包含四个不同的任务，并保证在不久的将来会增加更多任务。...

AgentCyTE

CORE TopoGen Genera topologías de red CORE reproducibles a partir de archivos XML de escenarios mediante una GUI web completa o una interfaz de línea de comandos. Tabla de contenidos Aspectos destacados Capturas de pantalla Inicio rápido Requisitos previos Instalar dependencias Iniciar la interfa...

pwnspoof

pwnSpoof from Punk Security generates realistic spoofed log files for common web servers with customisable attack scenarios. Every log bundle is unique and completely customisable, making it perfect for generating CTF scenarios and for training serials. Can you find the attacker session and build...

automatic-api-attack-tool

Automatic API Attack Tool Imperva's customizable API attack tool takes an API specification as an input, and generates and runs attacks that are based on it as an output. The tool is able to parse an API specification and create fuzzing attack scenarios based on what is defined in the API...

metta

Metta Metta is an information security preparedness tool. This project uses Redis/Celery, python, and vagrant with virtualbox to do adversarial simulation. This allows you to test mostly your host based instrumentation but may also allow you to test any network based detection and controls...

Certi-Bhai

Certi-Bhai: Kit de Explotación de AD CS Certi-Bhai es una colección completa de herramientas de explotación en PowerShell para atacar vulnerabilidades de Servicios de Certificados de Active Directory AD CS. Este kit implementa varios Escenarios de Escalada ESC que demuestran configuraciones de...

CVE-2026-82747 Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor

Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor. When a resource has an accesstype :runtime read policy a check evaluated per record rather than compiled to a filter, Ash.Policy.Authorizer decides each record in checkresult/1...

What SecureIQLab Cloud WAAP 5.0 means for your application security

You cannot verify a vendor’s security claims from their own datasheet, including ours. That is why independent validation matters. In our recent guide to the best WAAP solutions Best WAAP Solutions 2026: Enterprise Buyer Guide, we argued that every serious shortlist should include independent...

Google’s synchronized passkeys can be stolen in ‘Pass‑ta‑key’ attacks

Passkeys were supposed to make stolen passwords a thing of the past. No password to phish, no secret to reuse, and no string of characters sitting in a database waiting to be leaked. Over time, it's thought that passkeys will replace passwords entirely. But what happens when malware steals the...

MacBook Neo vs Windows Laptops for Cybersecurity Tasks

There is no one-size-fits-all cybersecurity laptop. We’ll examine real-world work scenarios, tool compatibility, and trade-offs that impact a security professional’s day-to-day work...

Turn specs into evals for any agent with ASSERT

Today, we’re releasing Adaptive Spec-driven Scoring for Evaluation and Regression Testing ASSERT, an open-source framework for turning natural-language behavior specifications into executable evaluations. Every team building an AI system starts with a clear intention for the behaviors they want t...

Bridging the Smart City Cybersecurity Data Gap through AI-Driven Synthetic Dataset Generation

Smart cities rely on interconnected cyber-physical systems that integrate sensors, IoT devices, cloud platforms, and AI-driven services and decision-making. While these systems enhance city services, they also introduce complex cybersecurity challenges due to their large attack surfaces,...

Smart_Contract_Researcher_POC

Smart Contract Security Research Portfolio hailthelord...

CRESS: Quantifying Vulnerabilities of Attack Scenarios in Hardware Reverse Engineering

The safety, security, and reliability of microelectronic systems depend on a trustworthy, secured supply chain and design flow. Globally distributed supply chains or unintentional design weaknesses leave the door open for attacks on the hardware level. These scenarios encompass counterfeiting,...

A New Framework for Cybersecurity Refusals in AI Agents

Agentic scaffolds have dramatically improved LLM performance on complex, long-horizon tasks, yielding both broad benefits and amplified risks in domains like cybersecurity. Existing benchmarks for AI agents in cybersecurity focus mainly on measuring proficiency--how effectively agents can complet...