tiptiptip

pownie. The agent harness for offsec. It's a plugin for Claude Code packed with skills, hooks, memory system that works best for using Claude Code to achieve autonomous pentest/ctf

auto-southwest-check-in. A Python script that automatically checks in to your Southwest flight 24 hours beforehand.

deep-threat-model. Deep-TreatModel uses multi-agents to craft comprehensive and reliable threat models.

Insider-Threat. Creating a resource to help build and manage an Insider Threat program.

beanshooter. JMX enumeration and attacking tool.

RsyncOSX_archived. A macOS GUI for rsync.

opencti. Open Cyber Threat Intelligence Platform

terraform-provider-esxi. Terraform-provider-esxi plugin

awesome-api-security-essentials. Awesome API Security: A Curated Collection of Resources for Bulletproof API Protection!

Mythic. A collaborative, multi-platform, red teaming framework

MemLabs. Educational, CTF-styled labs for individuals interested in Memory Forensics

sliver. Adversary Emulation Framework

MachOView. MachOView fork

poseidon. Poseidon is a Golang agent targeting Linux and macOS

hayabusa. Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

SysmonForLinux. Sysmon for Linux

SuperMem. A python script developed to process Windows memory images based on triage type.

BOPFunctionRecognition. This python/jython script is used as plugin to BinNavi tool to analyze a x86 binanry file to find buffer overflow prone functions. Such functions are important for vulnerability analysis.

2021. Files and Folders for BSides Splunk 2021

EDRs. C

ScareCrow. ScareCrow - Payload creation framework designed around EDR bypass.

SpoolSample. PoC tool to coerce Windows hosts authenticate to other machines via the MS-RPRN RPC interface. This is possible via other protocols as well.

kube-forensics. Go

DotNetToJScript. A tool to create a JScript file which loads a .NET v2 assembly from memory.

diffy. :no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.

All_NTLM_leak.

IOXIDResolver. IOXIDResolver.py from AirBus Security

ExploitRemotingService. A tool to exploit .NET Remoting Services

jwt_tool. :snake: A toolkit for testing, tweaking and cracking JSON Web Tokens

PEASS-ng. PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)

CRT. Contact: CRT@crowdstrike.com

at-ps. Adversary Tactics - PowerShell Training

red_team_tool_countermeasures. YARA

plaso. Super timeline all the things

KapeFiles. This repository serves as a place for community created Targets and Modules for use with KAPE.

pcodedmp. A VBA p-code disassembler

leonidas. Automated Attack Simulation in the Cloud, complete with detection use cases.

ingest_eval_examples. Jupyter Notebook

report_examples. Example reports from prior years of the Collegiate Penetration Testing Competition

Java-Deserialization-Cheat-Sheet. The cheat sheet about Java Deserialization vulnerabilities

marshalsec. Java

ABD. Course materials for Advanced Binary Deobfuscation by NTT Secure Platform Laboratories

k8s-ctf-rocks. Kubernetes Easter CTF

krane. Kubernetes RBAC static analysis & visualisation tool

kubeaudit. kubeaudit helps you audit your Kubernetes clusters against common security controls

dive. A tool for exploring each layer in a docker image

www-project-kubernetes-security-testing-guide. OWASP Kubernetes Security Testing Guide

ida-plugins. A collection of my IDA plugins

kubernetes-goat. Kubernetes Goat is a "Vulnerable by Design" cluster environment to learn and practice Kubernetes security using an interactive hands-on playground 🚀

go-audit. go-audit is an alternative to the auditd daemon that ships with many distros

splunk-operator. Splunk Operator for Kubernetes

attack_range. A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk

SANS2019-HolidayHackChallenge. SANS 2019 Holiday Hack Challenge - KringleCon 2.0 - Turtle Doves Writeup

k-rail. Kubernetes security tool for policy enforcement

handouts. materials we hand out

DVIA-v2. Damn Vulnerable iOS App (DVIA) is an iOS application that is damn vulnerable. Its main goal is to provide a platform to mobile security enthusiasts/professionals or students to test their iOS penetration testing skills in a legal environment. This project is developed and maintained by @prateekg147. The vulnerabilities and solutions covered in this app are tested up to iOS 11. The current version is writen in Swift and has the following vulnerabilities.

splunk-connect-for-kubernetes. Helm charts associated with kubernetes plug-ins

nebula. A scalable overlay networking tool with a focus on performance, simplicity and security

alerting-detection-strategy-framework. A framework for developing alerting and detection strategies for incident response.

My-CTF-Web-Challenges. Collection of CTF Web challenges I made

ThreatHunter-Playbook. A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

sysmon-config. Sysmon configuration file template with default high-quality event tracing

CVE-2019-8978. Banner Web Tailor and Banner Enterprise Identity Services Vulnerability Disclosure

Hands-On-AWS-Penetration-Testing-with-Kali-Linux. Hands-On AWS Penetration Testing with Kali Linux published by Packt

vulnerable-node. A very vulnerable web site written in NodeJS with the purpose of have a project with identified vulnerabilities to test the quality of security analyzers tools tools

pytm. A Pythonic framework for threat modeling

GLSE. GoLang Scripting Expert, a repo for template scripts regarding basic golang functions, many with a security focus

ctf-2019-release. BSidesSF CTF 2019 release

cuckoo. Cuckoo Sandbox is an automated dynamic malware analysis system

winafl. A fork of AFL for fuzzing Windows binaries

honggfuzz. Security oriented software fuzzer. Supports evolutionary, feedback-driven fuzzing based on code coverage (SW and HW based)

sanitizers. AddressSanitizer, ThreadSanitizer, MemorySanitizer

docker-py. A Python library for the Docker Engine API

splunk-ansible. Ansible playbooks for configuring and managing Splunk Enterprise and Universal Forwarder deployments

botsv2. Splunk Boss of the SOC version 2 dataset.

moby. The Moby Project - a collaborative project for the container ecosystem to assemble container-based systems

docker-logging-plugin. Splunk Connect for Docker is a Docker logging plugin that allows docker containers to send their logs directly to Splunk Enterprise or a Splunk Cloud deployment.

exploits. Some of my exploits.

alloc8. Write-up for alloc8 untethered bootrom exploit for iPhone 3GS

canvas-data-sdk. Python SDK and command-line tool for working with the Canvas Data API

nudge-python. A tool to help users with pre-existing devices upgrade their OS version.

ysoserial. A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

vim-splunk. Syntax highlighting for Splunk .conf files

router_badusb. BadUSB in Routers

ghidra. Ghidra is a software reverse engineering (SRE) framework

gotraining. Go Training Class Material :

ScoutSuite. Multi-Cloud Security Auditing Tool

krbrelayx. Kerberos relaying and unconstrained delegation abuse toolkit

merlin. Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.

gscript. framework to rapidly implement custom droppers for all three major operating systems

laforge. Competition Infrastructure Management

CrackMapExec. A swiss army knife for pentesting networks

splunk-tableau-wdc. Splunk Tableau Web Data Connector (WDC) Example

scoringengine. Scoring Engine for Red/White/Blue Team Competitions

DarkSpiritz. :moon: Official Repository for DarkSpiritz Penetration Framework | Written in Python :snake:

config_explorer. Config viewer and file editor for Splunk. Based on VSCode.

DetectionLab. Automate the creation of a lab environment complete with security tooling and logging best practices

windows-event-forwarding. A repository for using windows event forwarding for incident detection and response

pwndb. Search for leaked credentials

OWASP_MobileMalwareSession.

presentations. various slides and presentations I've worked on

awesome-web-security. 🐶 A curated list of Web Security materials and resources.

pocs. Proof of Concepts (PE, PDF...)

kaggle_Microsoft_Malware. code for kaggle competition Microsoft malware classification

HEVD-Python-Solutions. Python solutions for the HackSysTeam Extreme Vulnerable Driver

HackSysExtremeVulnerableDriver. HackSys Extreme Vulnerable Driver (HEVD) - Windows & Linux

playbooks. Phantom Community Playbooks

sandbox-attacksurface-analysis-tools. Set of tools to analyze Windows sandboxes for exposed attack surface.

botsv1.

ember. Elastic Malware Benchmark for Empowering Researchers

LightGBM. A fast, distributed, high performance gradient boosting (GBT, GBDT, GBRT, GBM or MART) framework based on decision tree algorithms, used for ranking, classification and many other machine learning tasks.