Repository Index

Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64 and arm64.

• golang
• ebpf
• tls
• ssl

In-depth attack surface mapping and asset discovery

• go
• dns
• subdomain
• enumeration

A cross-platform programmable network tool

• proxy
• vpn
• linux
• macos

Scapy: the Python-based interactive packet manipulation program & library.

• scapy
• python
• network
• network-analysis

hydra

• penetration-testing
• password-cracker
• network-security
• hydra

eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.

• kubernetes
• golang
• rest
• grpc

🍯 T-Pot - The All In One Multi Honeypot Platform 🐝

• honeypot
• security
• docker
• elk

Blazing-fast remote access

• cloud
• vpn
• security
• wireguard

Lightweight network IP scanner written in Go. With notifications, history, export to Grafana

• arp-scan
• self-hosted
• selfhosted
• arp-scanner

Centralized network visibility and continuous asset discovery. Monitor devices, detect change, and stay aware across distributed networks.

• network-security
• selfhosted
• wifi-network
• wifi-security

Next generation web scanner

• security
• web
• scanner
• ruby

Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, build your taylor-made EASM tool, collect and analyse network intelligence from your sensors, and much more! Uses Nmap, Masscan, Zeek, p0f, ProjectDiscovery tools, etc.

• bro
• scans
• nmap
• network

Best practices for segmentation of the corporate network of any company

• segmentation-network
• network-segmenation
• network-security
• firewalling

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

• network-security
• pcap
• security
• arkime

A Suricata based NDR distribution

• suricata
• network
• security
• monitoring

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.

• github-actions
• actions
• supply-chain-security
• hardening

NFStream: a Flexible Network Data Analysis Framework.

• data-science
• data-analysis
• data-mining
• network-analysis

Scriptable local traffic workbench for inspecting, intercepting, replaying, and rewriting HTTP/HTTPS and WebSocket traffic.

• mitm
• proxy
• rust
• cli

Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8 languages. / Moniteur réseau temps réel + pare-feu sortant, agent de flotte Rust, exports SIEM. 100 % local.

• cybersecurity
• d3js
• electron
• fastapi

Scirius is a web application for Suricata ruleset management and threat hunting.

• python
• security
• management
• interface

Skills and career roadmap for various security roles like application security, cloud security, DevSecOps, security engineer, security researchers, pentesting, api security, network security, mobile security and so on with helpful resources, guidelines

• security-tools
• security-automation
• aws-security
• cloud-security

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

• network-security
• security
• arkime
• cybersecurity

Respounder detects presence of responder in the network.

• responder
• golang
• network-security-monitoring
• network-security

gonids is a library to parse IDS rules, with a focus primarily on Suricata rule compatibility. There is a discussion forum available that you can join on Google Groups: https://groups.google.com/forum/#!topic/gonids/

• suricata
• parse
• security-tools
• network-security