Security

A comprehensive guide with diagrams and best practices for implementing corporate network segmentation across four security maturity levels.

An open-source penetration testing framework for developing and executing exploit code against remote targets.

A Linux packet crafting tool for generating attack signatures to test IDS/IPS and network security.

A curated list of tools, add-ons, articles, and exploits that use the Scapy packet manipulation library.

Performs in-depth attack surface mapping and external asset discovery using open source intelligence and active reconnaissance.

A coroutines-driven Low & Slow traffic generator for penetration testing, written in Rust.

Legion is a semi-automated network penetration testing framework for discovery, reconnaissance, and exploitation.

A professional-grade web security scanner for penetration testing with intelligent, context-aware scanning and proof-based vulnerability detection.

A Python tool for fast subdomain enumeration using OSINT and bruteforce, designed for penetration testers and bug hunters.

A modern, fast port scanner that finds all 65k ports in 3 seconds and features a scripting engine for extensibility.

A fast and flexible HTTP fuzzer for content discovery, credential bruteforcing, and security testing.

Discover internet-wide misconfigurations in services like Elasticsearch, databases, and web servers using high-speed scanning tools.

Open source CNAPP that hunts for threats in cloud native platforms, ranks them by risk, and visualizes attack paths.

A standalone tool that finds unprotected secrets like passwords and API keys in container images and file systems.

A Python script that implements security testing attacks against AWS Cognito, including account oracle and privilege escalation.

A fully open-source audit logs service with an embeddable UI, designed for easy deployment to your own Kubernetes cluster.

A Windows security tool for real-time adversary tradecraft detection, memory scanning, and forensics via behavior-driven rules.

An interactive GNU/Linux application firewall that monitors and controls outbound network connections.

An open-source unified XDR and SIEM platform for threat prevention, detection, and response across endpoints and cloud workloads.

An open source, serverless security data lake for AWS that normalizes logs, enables detection-as-code, and supports petabyte-scale threat hunting.

A data pipeline engine for security teams to collect, transform, enrich, and route telemetry data at scale.

A serverless toolkit for routing, normalizing, and enriching security event and audit logs in AWS.

Automatically converts Sigma detection rules to Kusto Query Language (KQL) for Microsoft Defender and Sentinel.

Automatically converts Sigma detection rules into Splunk SPL queries for security monitoring and threat hunting.

Automates conversion of Sigma rules to Terraform and Sentinel YAML for detection engineering in Microsoft Sentinel.

An Intrusion Prevention System (IPS) for SSH that blocks brute force attacks using iptables and optional nmap/dig probes.

An open-source, participative security engine that detects and blocks malicious IPs using crowdsourced threat intelligence.

An open-source unified XDR and SIEM platform for threat prevention, detection, and response across endpoints and cloud workloads.

A curated list of free and open-source honeypot resources, tools, and related components for cybersecurity research.

A low to medium interaction honeypot written in Python, designed for easy deployment and extensibility.

A Python-based low-interaction honeypot with sophisticated emulation for malware collection and analysis.

A medium interaction SSH honeypot that logs brute force attacks and attacker shell interactions.