Tools

supermhel/fengarde

Open-source, self-hosted security pipeline for IT, AI and OT. Logs in. Evidence out.: OCSF normalization, 46 detection rules…

0xajstrike/emsign-trust-scan

Offline scanner for the October 2026 eMudhra/emSign CA key compromise, finds affected certificates across OS trust stores, CA bundles, Java cacerts,…

apaonum/brotli-cve-check

Agent skill + script to scan projects for CVE-2026-111497 (Brotli), rate criticality and suggest fixes

asngs/agenttriage-open-source

Cross-agent tracing and security-diagnosis system for tool-using LLM agents: normalizes trace events, builds provenance graphs, extracts…

seclog-open/seclog

Collects multi-source security logs from reproducible Docker attack scenarios, builds attack chains, and provides the SecLog-Bench-216 benchmark for…

neo23x0/process-watcher

A process monitoring tool that tries to detect exploitation

jaksi/sshesame

An easy to set up and use SSH honeypot, a fake SSH server that lets anyone in and logs their activity

boredhackerblog/plex2shell_pcap

Packet capture artifacts of plex2shell exploitation against Plex, including lab and in-the-wild traffic, for building and validating detection…

0xmfbk/ebpf-container-escape-framework

Audit only eBPF EDR for Linux 5.15+ LTS: 14 kernel hooks, 15 actions (13 MITRE techniques), process lineage, SIEM export, K8s/Docker ready.

fazmin/cve-intel

Local security intelligence for CVE triage - 40 data sources and 41 tools, risk scores and an MCP server for AI agents, all in native Rust. Private…

vigiloss/vigil

AI harness for long-running code audits, web pentests, and bug bounty hunting, built around how real investigations fail: anchored hypotheses, false…

rdelasierra-uy/portfolio

Vitrina profesional: writeups de Hack The Box, informes, casos de estudio GRC (ISO 27001/27002/27005/27035, ISO 31000 + MAGERIT), scripts de…

vulncheck-oss/cisco-ios-xe-implant-scanner

Go-based scanner that detects implanted Cisco IOS XE systems by sending crafted HTTP requests to identify compromised devices and vulnerable versions.

opposum0112/cusimanse

Composable research-contract and YAML-recipe framework for agent-operated security experiments on disposable compute

opposum0112/decretum

Contract LinkML compiler for a security researchers

si13nttt/cve-2025-32432

Python PoC exploiting CVE-2025-32432, an unauthenticated RCE in Craft CMS via Yii DI gadget injection, with assetId scanning, reverse shell, and…

ndaal_open_source/ndaal_public_auditd

Best-practice Linux Auditd rule set with 14,956 MITRE ATT&CK-mapped rules, Ansible deployment role, and lint/test tooling for security monitoring and…