acharaf06/cve-2017-5638-attack-and-defenseDocker-based security lab demonstrating Apache Struts2 S2-045 (CVE-2017-5638) exploitation and defense, featuring vulnerable and patched applications…
pbssubhash/h0neytr4pEasy to configure Honeypot for Blue Team
wazuh/wazuhOpen-source XDR and SIEM platform for threat detection, log analysis, file integrity monitoring, vulnerability assessment, and compliance management…
dinosn/pack2theroot-labCTF-style Docker lab for CVE-2026-41651 (Pack2TheRoot): PackageKit permissive-polkit local privilege escalation
shcesama/cve-2023-4863-analysisEducational analysis of CVE-2023-4863 (libwebp heap buffer overflow) with Blue Team detection tools, static WebP scanner, defensive Java validator,…
praetorian-inc/capability-sdkShared Go SDK defining a standard capability interface for security scanners, with multi-format finding output (terminal, JSON, NDJSON, Markdown,…
eliangonzi00/pockeycloakcve-2023-0264Proof-of-concept exploit for CVE-2023-0264 (Keycloak OIDC session hijacking) with a frontend for session_id substitution and an agent that detects…
nvidia/openshellSandboxed runtime for autonomous AI agents with declarative YAML policies enforcing filesystem, network, and process constraints, plus endpoint-bound…
zephrfish/ludus-defender-labMDE/MDI Defender setup for Ludus
anthropics/oss-scannerService that builds enrolled open-source repositories in isolated offline VMs and scans them for security vulnerabilities, emailing findings with…
pompelmi/pompelmiClamAV antivirus scanning for Node.js — scan file uploads with a single function call. Zero dependencies. Typed Symbol verdicts. Local or…
0xmfbk/ebpf-container-escape-frameworkAudit only eBPF EDR for Linux 5.15+ LTS: 14 kernel hooks, 15 actions (13 MITRE techniques), process lineage, SIEM export, K8s/Docker ready.
fabacab/awesome-cybersecurity-blueteam:computer:🛡️ A curated collection of awesome resources, tools, and other shiny things for cybersecurity blue teams.
aquasecurity/traceeLinux Runtime Security and Forensics using eBPF
prismorsec/prismorSelf-hosted runtime control plane for AI agents. Observe or HITL approve or Block rogue tool calls before it executes: secret leaks, prompt…
linux-lock/bpflockeBPF-driven security tool for locking and auditing Linux machines. Restricts kernel features, blocks fileless execution, protects memory, and hardens…
gen0sec/jailerJailer is an eBPF-based process jailing system that provides mandatory access control (MAC) for Linux. It tracks processes using BPF task_storage…
division-36/z-jailA lightweight, multi-layer Linux sandbox combining namespaces, pivot_root, seccomp-bpf, capability dropping, and an evidence-based verdict engine…
