sf

Malcom is a tool designed to analyze a system's network communication using graphical representations of network traffic, as well as cross-reference them amongst known malware sources. This comes handy when analyzing how sure enough malware species endeavour to communicate amongst the exterior world. What is Malcom? Malcom tin flame assistance you: detect primal command as well as command (C&C) servers understand peer-to-peer networks observe DNS fast-flux infrastructures quickly create upwardly one's heed if a network artifact is 'known-bad' The aim of Malcom is to brand malware analysis as well as intel gathering faster past times providing a human-readable version of network traffic originating from a given host or network. Convert network traffic information to actionable intelligence faster. Check the wiki for a Quickstart amongst closed to dainty screenshots as well as a tutorial on how to add together your ain feeds . If yous demand closed...

theHarvester is a tool for gathering subdomain names, electronic mail addresses, virtual hosts, opened upward ports/ banners, too employee names from unlike world sources (search engines, pgp fundamental servers). Is a actually uncomplicated tool, but really effective for the early on stages of a penetration examination or but to know the visibility of your companionship inward the Internet. The sources are: Passive : threatcrowd: Open source threat intelligence - https://www.threatcrowd.org/ crtsh: Comodo Certificate search - www.crt.sh google: google search engine - www.google.com (With optional google dorking) googleCSE: google custom search engine google-profiles: google search engine, specific search for Google profiles bing: microsoft search engine - www.bing.com bingapi: microsoft search engine, through the API (you require to add together your Key inward the discovery/bingsearch.py file) dogpile: Dogpile search engine - www.dogpile.com ...

SpiderFoot is an opened upwards source intelligence (OSINT) automation tool. Its finish is to automate the procedure of gathering word close a given target, which may endure an IP address, domain name, hostname, network subnet, ASN or person's name. SpiderFoot tin dismiss endure used offensively, i.e. every bit purpose of a black-box penetration test to assemble information close the target or defensively to position what information your organisation is freely providing for attackers to utilization against you. What is SpiderFoot? SpiderFoot is a reconnaissance tool that automatically queries over 100 populace information sources (OSINT) to assemble word on IP addresses, domain names, electronic mail addresses, names in addition to more. You merely specify the target yous desire to investigate, selection which modules to enable in addition to and thus SpiderFoot volition collect information to construct upwards an agreement of all the entities in addition to how...

R3con1z3r is a lightweight Web information gathering tool amongst an intuitive features written inwards python. it provides a powerful surround inwards which opened upwards source intelligence (OSINT) web-based footprinting tin give the axe endure conducted speedily too thoroughly. Footprinting is the get-go stage of ethical hacking, its the collection of every possible information regarding the target. R3con1z3r is a passive reconnaissance tool amongst built-in functionalities which includes: HTTP header flag, Traceroute, Whois Footprinting, DNS information, Site on same server, Nmap port scanner, Reverse Target too hyperlinks on a webpage. The tool, subsequently existence provided amongst necessary inputs generates an output inwards HTML format. Screenshots Installation r3con1z3r supports Python 2 too Python 3 . $ git clone https://github.com/abdulgaphy/r3con1z3r.git $ cd r3con1z3r $ pip install -r requirements.txt Optional for Linux users $ sudo chmod +x r3c...

Conpot is an ICS honeypot alongside the destination to collect intelligence almost the motives as well as methods of adversaries targeting industrial command systems Documentation The construct of the documentations source tin flaming survive flora here . There you lot volition likewise honour the instructions on how to install conpot as well as the FAQ . Easy install using Docker Via a pre-built image Install Docker Run docker push clit honeynet/conpot Run docker run -it -p 80:80 -p 102:102 -p 502:502 -p 161:161/udp --network=bridge honeynet/conpot:latest /bin/sh Finally run conpot -f --template default Navigate to http://MY_IP_ADDRESS to confirm the setup. Build docker paradigm from source Install Docker Clone this repo alongside git clone https://github.com/mushorg/conpot.git as well as cd conpot/docker Run docker construct -t conpot . Run docker run -it -p 80:8800 -p 102:10201 -p 502:5020 -p 161:16100/udp -p 47808:47808/udp -p 623:6230/udp -p 21:2121 -...

IoT-Home-Guard is a projection to attention people discovery malware inwards smart habitation devices. For users the projection tin forcefulness out attention to abide by compromised smart habitation devices. For safety researchers it is also useful inwards network analysis together with malicious hehaviors detection. In July 2018 nosotros had completed the get-go version. We volition consummate the minute version yesteryear Oct 2018 amongst improvement of user sense together with increased expose of identifiable devices. The get-go generation is a hardware device based on Raspberry Pi amongst wireless network interface controllers. We volition customize novel hardware inwards the minute generation. The organization tin forcefulness out hold out educate amongst software purpose inwards laptops subsequently essential environs configuration. Software purpose is available inwards software_tools/. Proof of principle Our approach is based on the detection of malicious network tra...

This tool is used to collect diverse intelligence sources for hosts. Hostintel is written inwards a modular fashion together with thus novel tidings sources tin survive easily added. Hosts are identified past times FQDN host name, Domain, or IP address. This tool exclusively supports IPv4 at the moment. The output is inwards CSV format together with sent to STDOUT together with thus the information tin survive saved or piped into to a greater extent than or less other program. Since the output is inwards CSV format, spreadsheets such equally Excel or database systems volition easily survive able to import the data. I created a brusque introduction for this tool on YouTube: https://youtu.be/aYK0gILDA6w This industrial plant alongside Python v2, only it should also locomote alongside Python v3. If you lot detect it does non locomote alongside Python v3 delight post service an issue. Help Screen: $ python hostintel.py -h usage: hostintel.py [-h] [-a] [-d] [-v] [-p] [-s] [-c] [-t...

Just-Metadata is a tool that tin give notice last used to get together intelligence information passively close a large lay out of IP addresses, as well as movement to extrapolate relationships that mightiness non otherwise last seen. Just-Metadata has "gather" modules which are used to get together metadata close IPs loaded into the framework across multiple resources on the internet. Just-Metadata also has "analysis" modules. These are used to analyze the information loaded Just-Metadata as well as perform diverse operations that tin give notice position potential relationships betwixt the loaded systems. Just-Metadata volition allow yous to speedily honour the Top "X" lay out of states, cities, timezones, etc. that the loaded IP addresses are located in. It volition allow yous to search for IP addresses yesteryear country. You tin give notice search all IPs to honour which ones are used inwards callbacks equally identified yesteryear VirusTotal....

Machinae is a tool for collecting tidings from world sites/feeds nearly diverse security-related pieces of data: IP addresses, domain names, URLs, electronic mail addresses, file hashes, together with SSL fingerprints. It was inspired past times Automater , about other first-class tool for collecting information. The Machinae projection was born from wishing to amend Automater inwards four areas: Codebase - Bring Automater to python3 compatibility piece making the code to a greater extent than pythonic Configuration - Use a to a greater extent than human readable configuration format (YAML) Inputs - Support JSON parsing out-of-the-box without the ask to write regular expressions, but even hence back upward regex scraping when needed Outputs - Support additional output types, including JSON, piece making extraneous output optional Installation Machinae tin live installed using pip3: pip3 install machinae Or, if you're feeling adventurous, tin live installed stra...