Tools

gbrindisi/wordpot

A Wordpress Honeypot

r00t-3xp10it/redpill

Assist reverse tcp shells in post-exploration tasks

patrowl/patrowlhears

PatrowlHears - Vulnerability Intelligence Center / Exploits

pwndexter/invoke-edrchecker

PowerShell script that enumerates running processes, loaded DLLs, services, registry, and drivers to detect the presence of AV, EDR, and logging…

aau-network-security/riotpot

IoT and Operational Technology Honeypot

halildeniz/dnswatch

DNS traffic sniffer and analyzer for monitoring, filtering, and detecting anomalies in DNS queries. Features include PCAP export, DoH support, and a…

ssteelfactor-oss/kestrel

Low-observability Active Directory security enumeration tool using native ADSI/COM interfaces. Enumerates ACLs, delegation, trusts, ADCS, Kerberoast…

randomuserid/tylium

Primary data pipelines for intrusion detection, security analytics and threat hunting

rushyo/vindicatetool

LLMNR/NBNS/mDNS Spoofing Detection Toolkit

iamagarre/badexclusionsnwbo

BadExclusionsNWBO is an evolution from BadExclusions to identify folder custom or undocumented exclusions on AV/EDR

assurancemaladiesec/ad-description-password-finder

Retrieve AD accounts description and search for password in it

d4vinci/ssh-honeypot

Create Basic SSH Honeypot With Python

audibleblink/bothan

Is this IP a C2 server?

laugiov/scambuster

Defensive engagement & threat intelligence research laboratory. Converts inbound scam emails into actionable IOCs through controlled, policy-driven…

mziqudhd92/honeypot-auditor

Does This Look Like An Honeypot? (DTLLAH) Multi-protocol CLI that fingerprints whether a target IP behaves like a low-interaction honeypot — Shodan…

honeylabshq/spip-go

Spip network sensor written in Go

synacktiv/metamorph

A command-line utility for Windows written in C that creates and configures persistent Event Tracing for Windows (ETW) AutoLogger sessions.

lasq88/socgholish_finder

Scans websites for SocGholish JavaScript injections, deobfuscates malicious payloads, and reports shadowing domain URLs used in malvertising…