0x4D31

awesome-threat-detection

✨ A curated list of awesome threat detection and hunting resources 🕵️‍♂️

awesome-oscp

A curated list of awesome OSCP resources

fatt

FATT /fingerprintAllTheThings - a pyshark based script for extracting network metadata and fingerprints from pcap files and live network traffic

honeyLambda

honeyλ - a simple, serverless application designed to create and monitor fake HTTP endpoints (i.e. URL honeytokens) automatically, on top of AWS Lambda and Amazon API Gateway

burpa

Burp-Automator: A Burp Suite Automation Tool with Slack Integration. It can be used with Jenkins and Selenium to automate Dynamic Application Security Testing (DAST).

galah

Galah: An LLM-powered web honeypot.

deception-as-detection

Deception based detection techniques mapped to the MITRE’s ATT&CK framework

honeybits

A PoC tool designed to enhance the effectiveness of your traps by spreading breadcrumbs & honeytokens across your systems to lure the attacker toward your honeypots

salt-scanner

Linux vulnerability scanner based on Salt Open and Vulners audit API, with Slack notifications and JIRA integration

detection-and-response-pipeline

✨ A compilation of suggested tools/services for each component in a detection and response pipeline, along with real-world examples. The purpose is to create a reference hub for designing effective threat detection and response pipelines. 👷 🏗

honeyku

A Heroku-based web honeypot that can be used to create and monitor fake HTTP endpoints (i.e. honeytokens).

hassh-utils

hassh-utils: Nmap NSE Script and Docker image for HASSH - the SSH client/server fingerprinting method (https://github.com/salesforce/hassh)

honeybits-win

Windows version of honeybits - a PoC tool to create breadcrumbs and honeytokens, to lead the attackers to your honeypots!

quick

QUICk - a go library based on gopacket for analyzing QUIC CHLO messages

Presentations

Some of the presentations given by me

awesome-honeypots

an awesome list of honeypot resources

cve-2024-6387_hassh

HASSH fingerprints for identifying OpenSSH servers potentially vulnerable to CVE-2024-6387 (regreSSHion).

Notes

cowrie

Cowrie SSH/Telnet Honeypot

0x4d31.github.io

hassh

HASSH is a network fingerprinting standard which can be used to identify specific Client and Server SSH implementations. The fingerprints can be easily stored, searched and shared in the form of a small MD5 fingerprint.

checkpot

Checkpot Honeypot Checker

glutton

Generic Low Interaction Honeypot

ja3

JA3 is a standard for creating SSL client fingerprints in an easy to produce and shareable way.

rdfp

cryptoAUS_honeytoken_workshop

CryptoAUS Honeytoken Workshop

eql

gopacket

Provides packet processing capabilities for Go