Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64\arm64 and loong64.
Repository Index
47,133 repositories indexed
1–24 of 27 · Most stars
eBPF-based Security Observability and Runtime Enforcement
Kyanos is a networking analysis tool using eBPF. It can visualize the time packets spend in the kernel, capture requests/responses, makes troubleshooting more efficient.
Packet, where are you? -- eBPF-based Linux kernel networking debugger
eBPF implementation that runs on top of Windows
A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
Process-aware, eBPF-based tcpdump
- ebpf
- ebpf-tc
- tcpdump
- tcpdump-like
ebpfkit is a rootkit powered by eBPF
lightweight system-level observability for AI Agents
A collection of eBPF programs demonstrating bad behavior, presented at DEF CON 29
Alaz: Advanced eBPF Agent for Kubernetes Observability – Effortlessly monitor K8s service interactions and performance metrics in your K8s environment. Gain in-depth insights with service maps, metrics, and more, while staying alert to crucial system anomalies 🐝
- ddosify
- ebpf
- kubernetes
- metrics
LordOS — a free, fast and secure GNU/Linux distribution based on Debian, with its own desktop environment: display server and Wayland compositor in C, a React UI engine on QuickJS, and private native apps.
Prototyping kernel development work outside mainline
- kernel-modules
- kernel
- xdp
- ebpf-programs
The Linux port of the Sysinternals Sysmon tool.
Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities
- ebpf
- security
- linux-kernel
- linux-security-module
🔍 Function-level tracing tool for Seccomp profiling, with eBPF
- ebpf
- ebpf-programs
- golang
- seccomp
bpflock - eBPF driven security for locking and auditing Linux machines
Generic eBPF runtime
ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits
Red Canary's eBPF Sensor
eBPF Information Flow Enforcement for AI Agent safety, security and effectiveness
- ebpf
- harness
- ifc
- policy-engine
An EBPF based IPv4/IPv6 firewall with integrations for OpenZiti Zero-Trust Framework edge-routers and tunnellers
Jailer is an eBPF-based process jailing system that provides mandatory access control (MAC) for Linux. It tracks processes using BPF task_storage maps and enforces role-based policies on file access, network operations, and process execution.
Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.