Thomas Patzke

elk-detection-lab. An ELK environment containing interesting security datasets.

WASE. The Web Audit Search Engine - Index and Search HTTP Requests and Responses in Web Application Audits with ElasticSearch

android-nfc-paycardreader. NFC card reader Android app. Currently reads the german GeldKarte and some credit cards.

Log4Pot. A honeypot for the Log4Shell vulnerability (CVE-2021-44228).

logstash-linux. Logstash Configuration for Linux Logs (Authentication, Apache, Mail)

POODLEAttack. PoC implementation of the POODLE attack

EQUEL. An Elasticsearch QUEry Language

Burp-SessionAuthTool. Burp plugin which supports in finding privilege escalation vulnerabilities

sigma-workshop. Elasticsearch/Kibana environment and log data for Sigma workshop

Clickjacking-Exploit. Clickjacking Proof-of-Concept Exploit

Burp-MissingScannerChecks. Collection of scanner checks missing in Burp

NastyWebHackme. Broken web app intentionally built with pentesting obstacles

mordor. Re-play Adversarial Techniques

sigma-workshop-operationalization. Workshop "Operationalization of Sigma Rules with Processing Pipelines"

BrowserCrasher. Crash browsers with opensource test suites

dfirtrack. DFIRTrack - The Incident Response Tracking Application

awesome-threat-detection. A curated list of awesome threat detection and hunting resources

Demo-ClientsideWebAttacks. Demonstration of some client-side web application vulnerabilities (DOM XSS, Clickjacking) and wrong usage of local storage.

HELK. The Hunting ELK

CSRF-Multistep. Framework for building multistep CSRF Proof of Concepts

Burp-Randomizer. Randomize parts of requests with a session handling rule action.

infosec-notebooks. Jupyter notebooks for threat hunting and incident response

cycat-taxonomy. CyCAT.org taxonomies

APTSimulator. A toolset to make a system look as if it was the victim of an APT attack

postfix-grok-patterns. Logstash configuration and grok patterns for parsing postfix logging

hashextension. Implementation of the hash extension attack

evtx2es. Import Windows Eventlogs(.evtx) to ElasticSearch.

PoodleCheck. A standalone check for the POODLE vulnerability based on the PolarSSL library.

IntelligentProcessLifecycle. The Intelligent Process Lifecycle of Active Cyber Defenders

sleepy-puppy. Blind Cross-site Scripting Collector and Manager

misp-objects. Definition, description and relationship types of MISP objects

mod0BurpUploadScanner. HTTP file upload scanner for Burp Proxy

MISP. MISP (core software) - Open Source Threat Intelligence and Sharing Platform (formely known as Malware Information Sharing Platform)

OwnTwitterFilterBubble. Build your Own Twitter Filter Bubble with Deep Learning

AVR-RandomStuff. Some tiny programs I coded for Atmel AVR microcontrollers. Sense&pointless, but possibly useful for someone.

logstash-mail-log. Logstash patterns and config for postfix, cbpolicyd and spamd.

ImageSearch. Script collection that makes my photos searchable

testssl.sh. Testing TLS/SSL encryption

detection-engineering-with-sigma. Detection Engineering with Sigma workshop (2025)