#1Tools for blue team, defensive security, and threat protection.
Kitploit recommended
joda32/aditActive Directory recon and read-only security audit over ADWS (net.tcp/9389), in Go
roccoammon/active-directory-health-checkPowerShell GUI tool that runs 54 best-practice health and security checks against Active Directory, flagging Kerberoasting, DCSync, delegation and…
rorywag/hayabusa-bulk-runnerBulk-run Hayabusa across a folder of triage collections, one run per host, with per-host reports and a cross-host triage dashboard
ripits-sec/couchpotatoWindows privilege escalation tool that patches ETW and AMSI and uses indirect syscalls to abuse SeImpersonatePrivilege, escalating service accounts…
joda32/yowieFinds the SaaS services an organisation subscribes to, using only externally observable data. Built for shadow IT discovery.
nawaralseelawi/pvbrf-idSimulation code and results for a private, verifiable, Byzantine-robust federated intrusion detection protocol using secret sharing, Merkle audits…
yxf203/defense-as-skillRuntime guard skill that detects and blocks malicious skill-induced attacks in skill-augmented agents, with an MCTS loop that evolves the guard…
perplexityai/numbatVisibility into AI agent activity on endpoints, with on-device detection, optional pre-action blocking, and forensic reconstruction.
zentinelproxy/zentinelA security-first reverse proxy built to guard the free web.
cognis-digital/c2detectC2 server fingerprinter — Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel
swastiksagar/wazuhlabprojectHands-on Wazuh SIEM/XDR home lab covering OVA deployment, agent enrollment, file integrity monitoring, VirusTotal malware detection, and MITRE ATT&CK…
jev-sec/jev-idsBlazing-Fast Token-Efficient Intrusion Detection System (IDS) based on TypeSafe's Jev.
sk4r4b/ntdll-reconstructionA technique that mixes NTDLL unhooking and hellsgate gate varients
abraxas/vaultwarden-ip-header-spoofVaultwarden 1.37.3 default X-Real-IP trusted-local bypasses login rate limits on Docker NAT
dwexi/entropystripAlgorithmic PE de-obfuscator, Shannon entropy radar, and incident triage engine
abraxas/signal-server-dropwizard-adminSignal-Server v20261007.0.0 - High - Remote - Privilege leftover - unauth Dropwizard admin :8081
gmh5225/llm-guard-serviceA service to provide protection against prompt injection, jailbreak attacks, and harmful content when interacting with AI services..
abraxas/tomcat-rewrite-ns-loopApache Tomcat 11.0.27 - High - Remote - DoS - RewriteValve [NS] worker pin
