Repository Index

A blade runner for your network. Detects shadow AI agents before they go rogue.

Run basic functions from stripped binaries cross platform

Mobile runtime detection workbench for AI (iOS and Android)

• frida
• reverse-engineering
• android-security-tools
• frida-gadget

Run arbitrary code by patching OAT files

• android
• android-app
• kotlin
• kotlin-android

A honeypot proxy for mongodb. When run, this will proxy and log all traffic to a dummy mongodb server.

• mongodb
• proxy
• honeypot
• security

eBPF Security Monitoring and Sandboxing Agent Based on Aya

• aya
• bpf
• ebpf
• security

Fragscapy is a command-line tool to fuzz network protocols by automating the modification of outgoing network packets. It can run multiple successive tests to determine which options can be used to evade firewalls and IDS.

• fuzzing
• network
• ids
• firewall

Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise

• detection
• splunk
• bpfdoor
• vulnerability

EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.

Simple Polymorphic x86_64 Runtime Code Segment Cryptor

Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.

• bpf
• ebpf
• forensics
• golang

🛡️ Free AI that blocks hackers while you sleep. Runs on cheap hardware. When someone in Tokyo gets attacked, you're protected in 30 seconds. No fees. No experts needed. Just protection. One node's detection → everyone's protection.

• ai-security
• cybersecurity
• ids
• iot-security

Based on the Volatility framework, this script will run various plugins as well as create a timeline, or use YARA/ClamAV/VirusTotal to find badness.

Troje is a honeypot built around lxc containers. It will run each connection with the service within a seperate lxc container.

Local-first policy gateway for coding agents. Allow, review, or block MCP, shell, SQL, GitHub, and HTTP actions with scoped credentials and signed evidence.

• golang
• observability
• opentelemetry
• policy-engine

Encrypts 64-bit elf files that decrypt at runtime.

• elf64
• linux
• elf-binaries
• elf-parser

Simple ELF runtime packer for creating self-protecting binaries

Detect whether a site is running behind Cloudflare.

• cloudflare
• waf
• detection
• nodejs

Docker container running cowrie with DShield output enabled.

Very simple but effective honeypot to detect port scanning on your network