Daniel Roberson

ssh-honeypot. Fake sshd that logs ip addresses, usernames, and passwords.

rtfm. Cheat sheet and notes inspired by the book RTFM - Red Team Field Manual

ELFcrypt. Simple ELF crypter. Uses RC4 encryption.

icmp-backdoor. Backdoor that listens for specially crafted ICMP packets and spawns reverse shells.

sshunt. SSH proxy with HASSH firewalling capabilities

Awesome-anti-forensic. Tools and packages that are used for countering forensic activities, including encryption, steganography, and anything that modify attributes. This all includes tools to work with anything in general that makes changes to a system for the purposes of hiding information.

ELFappend. PoC to append and extract data at the end of an ELF file

pastebin-scrape. Utilize Pastebin's scraping API to find interesting pastes.

greylost. DNS logging, detection, ...

curl-portscan. Crappy shell script that port scans using curl

thefuzz. Various fuzzers written in Python. Currently has a TCP server for fuzzing client software, and a CLI fuzzer to use against programs ran from the command line.

harness. execute stuff in memory

yararules. misc yara rules

hammertime. PoC LKM to force run cleanup_module() on other LKMs

break-web-scanners. Its like GORILLAS.BAS, just different. Creates a bunch of bogus files/directories to deceive web vulnerability scanners.

gokiller. LKM to detect + kill golang bins

exec-logger. LD_PRELOAD library to log all execve() calls to syslog

pycompiler. Compile .py files as ELF using Cython

rdpy-rdpfingerprint. OS Fingerprinting based on RDP login screen.

ELFparasite. Simple parasite for ELF binaries using the concatenation method.

noawareness. no awareness, swift as gold

SLAE. SecurityTube Linux Assembly Expert exercises

linux_amd64_static_tools. static linked bash, coreutils, and binutils for Linux/amd64

papa-shango. ptrace injection

sshady. SSH key monkeyshines.

dotfiles. My dotfiles.

usb-watch. Use Python's pyudev to monitor for USB events. Sends SMS texts using Twilio if a USB device is added or removed from your machines.

syscallslol. Linux LKM that detects sys_call_table[] manipulation

million_dollar_dream. EVERY MAN HAS A PRICE

syslog_spoof. Sends spoofed syslog packets using scapy

pinger. continuously ping hosts and make the data available via an HTTP API

userlandexec. userland exec for Linux x86_64

artillery. The Artillery Project is an open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.

stroke. Updated "stroke" tool from Building Open Source Network Security Tools book by Mike Schiffman.

natlas. Scaling Network Scanning

scorebot. Scoring Engine for CTF competitions

droberson. Too legit 2 quit.

pattern. Recreation of Metasploit pattern_create.rb and pattern_offset.rb scripts.

rehash. rehash

meltdown-exploit. C

notify. Notify is a Go-based assistance package that enables you to stream the output of several tools (or read from a file) and publish it to a variety of supported platforms.

lilt. The littlest network watcher - libnids example

merlin. Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.

pypacket. Parse packets

gscript. Scriptable dynamic runtime execution of malware

PcapPlusPlus. PcapPlusPlus is a multiplatform C++ library for capturing, parsing and crafting of network packets. It is designed to be efficient, powerful and easy to use. It provides C++ wrappers for the most popular packet processing engines such as libpcap, WinPcap, DPDK and PF_RING.

crappy_identd. SUPER AWESOME IDENT SERVER. RFC1413

radare2. unix-like reverse engineering framework and commandline tools

subrute. /bin/su brute forcer using pexpect.