hxteam

hxteam's Stars

• secdev/scapy

  Scapy: the Python-based interactive packet manipulation program & library.

  Language:Python10.9k2k

• DominicBreuker/pspy

  Monitor linux processes without root permissions

  Language:Go5k515

• CISOfy/lynis

  Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.

  Language:Shell13.6k1.5k

• ANSSI-FR/bmc-tools

  RDP Bitmap Cache parser

  Language:Python48687

• jpr5/ngrep

  ngrep is like GNU grep applied to the network layer. It's a PCAP-based tool that allows you to specify an extended regular or hexadecimal expression to match against data payloads of packets. It understands many kinds of protocols, including IPv4/6, TCP, UDP, ICMPv4/6, IGMP and Raw, across a wide variety of interface types, and understands BPF filter logic in the same fashion as more common packet sniffing tools, such as tcpdump and snoop.

  Language:C907102

• simsong/tcpflow

  TCP/IP packet demultiplexer. Download from:

  Language:C++1.7k238

• corelight/zeek-community-id

  Zeek support for Community ID flow hashing.

  Language:Zeek3518

• salesforce/hassh

  HASSH is a network fingerprinting standard which can be used to identify specific Client and Server SSH implementations. The fingerprints can be easily stored, searched and shared in the form of a small MD5 fingerprint.

  Language:Python53374

• salesforce/ja3

  JA3 is a standard for creating SSL client fingerprints in an easy to produce and shareable way.

  Language:Python2.8k293

• vp777/Windows-Non-Paged-Pool-Overflow-Exploitation

  Techniques based on named pipes for pool overflow exploitation targeting the most recent (and oldest) Windows versions demonstrated on CVE-2020-17087 and an off-by-one overflow

  Language:C++18449

• corelight/community-id-spec

  An open standard for hashing network flows into identifiers, a.k.a "Community IDs".

  Language:Python17425

• 0x90/ss7-arsenal

  SS7 tools and scripts

  20280

• Yamato-Security/hayabusa-rules

  Curated Windows event log Sigma rules used in Hayabusa and Velociraptor.

  Language:Python14823

• reversinglabs/reversinglabs-yara-rules

  ReversingLabs YARA Rules

  Language:YARA777110

• SafeBreach-Labs/PoolParty

  A set of fully-undetectable process injection techniques abusing Windows Thread Pools

  Language:C++972136

• 0xor0ne/awesome-list

  Cybersecurity oriented awesome list

  1.5k165

• HavocFramework/Havoc

  The Havoc Framework

  Language:Go7k979

• gamozolabs/mesos

  Binary coverage tool without binary modification for Windows

  Language:Rust42943

• mvt-project/mvt

  MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.

  Language:Python10.6k1k

• danmar/cppcheck

  static analysis of C/C++ code

  Language:C++5.9k1.5k

• hasherezade/pe-sieve

  Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

  Language:C++3.2k439

• xuanxuan0/DripLoader

  Evasive shellcode loader for bypassing event-based injection detection (PoC)

  Language:C++738122

• janoglezcampos/DeathSleep

  A PoC implementation for an evasion technique to terminate the current thread and restore it before resuming execution, while implementing page protection changes during no execution.

  Language:Python50172

• Cobalt-Strike/CallStackMasker

  A PoC implementation for dynamically masking call stacks with timers.

  Language:C++25735

• klezVirus/SilentMoonwalk

  PoC Implementation of a fully dynamic call stack spoofer

  Language:C++72397

• JLospinoso/gargoyle

  A memory scanning evasion technique

  Language:C++845113

• arkime/arkime

  Arkime is an open source, large scale, full packet capturing, indexing, and database system.

  Language:JavaScript6.4k1k

• akamai/akamai-security-research

  This repository includes code and IoCs that are the product of research done in Akamai's various security research teams.

  Language:C47771

• MicrosoftDocs/windowsserverdocs

  Public content repository for Windows Server content.

  1.4k1.8k

• CCob/BeaconEye

  Hunts out CobaltStrike beacons and logs operator command output

  Language:C#894107