Back to the catalog
published by mukul975
50 tools
- analyzing-mft-for-deleted-file-recoveryAnalyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT,36,139 stars
- building-soc-escalation-matrixBuild a structured SOC escalation matrix defining severity tiers, response36,139 stars
- exploiting-excessive-data-exposure-in-apiTests APIs for excessive data exposure (OWASP API3:2023) by intercepting raw API responses and comparing them against what the UI actually r36,139 stars
- exploiting-mass-assignment-in-rest-apisDiscovers and exploits mass assignment (autobinding) in REST APIs by injecting unexpected or hidden parameters (e.g. role, isAdmin, plan) in36,139 stars
- implementing-epss-score-for-vulnerability-prioritizationQueries FIRST's Exploit Prediction Scoring System (EPSS) API to fetch exploitation-probability and percentile scores for CVEs, then uses tho36,139 stars
- implementing-container-image-minimal-base-with-distrolessReduces container attack surface by building application images on Google distroless base images that ship only the application runtime - no36,139 stars
- building-soc-metrics-and-kpi-tracking'Builds SOC performance metrics and KPI tracking dashboards measuring36,139 stars
- detecting-lateral-movement-with-splunkDetect adversary lateral movement across networks using Splunk SPL queries36,139 stars
- hunting-for-scheduled-task-persistenceRuns a hypothesis-driven threat hunt for Windows Scheduled Task persistence (T1053), guiding SIEM/EDR queries against task creation events (36,139 stars
- analyzing-ransomware-payment-wallets'Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.36,139 stars
- deploying-cloudflare-access-for-zero-trustDeploys Cloudflare Access with Cloudflare Tunnel for zero trust access to self-hosted apps, configuring identity-aware policies, device post36,139 stars
- conducting-memory-forensics-with-volatility'Performs memory forensics analysis using Volatility 3 to extract evidence36,139 stars
- detecting-qr-code-phishing-with-email-securityDetect and prevent QR code phishing (quishing) attacks that embed36,139 stars
- performing-red-team-with-covenantConducts red team operations using the Covenant C2 framework for authorized36,139 stars
- implementing-network-intrusion-prevention-with-suricataDeploys and configures Suricata as an inline network intrusion prevention system,36,139 stars
- hunting-for-living-off-the-land-binariesProactively hunts for adversary abuse of legitimate, signed system binaries36,139 stars
- extracting-memory-artifacts-with-rekall'Uses Rekall memory forensics framework to analyze memory dumps for process36,139 stars
- exploiting-vulnerabilities-with-metasploit-frameworkUses the Metasploit Framework (msfconsole and its exploit, auxiliary,36,139 stars
- performing-threat-emulation-with-atomic-red-team'Executes Atomic Red Team tests for MITRE ATT&CK technique validation36,139 stars
- scanning-infrastructure-with-nessusTenable Nessus is the industry-leading vulnerability scanner used to36,139 stars
- performing-second-order-sql-injectionDetect and exploit second-order SQL injection vulnerabilities where malicious36,139 stars
- implementing-aws-security-hub-compliance'Deploy AWS Security Hub, backed by AWS Config, to aggregate findings36,139 stars
- detecting-dns-exfiltration-with-dns-query-analysisDetect data exfiltration via DNS tunneling (tools like iodine, dnscat2, dns2tcp) by analyzing query entropy, subdomain length, query volume 36,139 stars
- auditing-foundry-smart-contract-securityPre-deployment security audit of Solidity smart contracts in a Foundry project. Combines static analysis (Slither, Aderyn), symbolic executi36,139 stars
- conducting-pass-the-ticket-attackPerform Pass-the-Ticket (PtT) lateral movement by extracting Kerberos TGT/TGS tickets from LSASS memory on a compromised host and injecting 36,139 stars
- implementing-vulnerability-management-with-greenboneDeploy and operate Greenbone/OpenVAS vulnerability management using the36,139 stars
- performing-active-directory-compromise-investigationInvestigate Active Directory compromise by analyzing authentication logs,36,139 stars
- implementing-aqua-security-for-container-scanningDeploy Aqua Security's Trivy scanner to detect vulnerabilities, misconfigurations,36,139 stars
- performing-access-review-and-certificationDesigns and runs access review and certification campaigns-scoping,36,139 stars
- performing-arp-spoofing-attack-simulation'Simulates ARP spoofing/cache-poisoning attacks in authorized lab or36,139 stars
- coercing-authentication-with-coercer-petitpotamTrigger machine account authentication with PetitPotam (MS-EFSR) and Coercer (MS-RPRN, MS-DFSNM, MS-FSRVP, MS-EVEN) via Coercer's scan/coerc36,139 stars
- configuring-zscaler-private-access-for-ztna'Configures Zscaler Private Access (ZPA) to replace traditional VPN36,139 stars
- performing-static-malware-analysis-with-pe-studioPerforms static analysis of Windows PE malware samples using PEStudio to examine file headers, imports, strings, and resources without execu36,139 stars
- detecting-compromised-cloud-credentials'Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing36,139 stars
- performing-agentless-vulnerability-scanningConfigure and execute agentless vulnerability scanning using network36,139 stars
- deploying-ransomware-canary-filesDeploys and monitors ransomware canary files using Python's watchdog library, placing decoy files mimicking high-value targets (financial re36,139 stars
- exploiting-websocket-vulnerabilitiesTesting WebSocket implementations for authentication bypass, cross-site36,139 stars
- hunting-for-webshell-activityRuns a hypothesis-driven threat hunt for web shell deployment (T1505.003) on internet-facing servers by analyzing file creation in web direc36,139 stars
- detecting-aws-iam-privilege-escalationDetect AWS IAM privilege escalation paths using boto3 and Cloudsplaining36,139 stars
- implementing-ransomware-backup-strategy'Designs a ransomware-resilient backup strategy using the 3-2-1-1-036,139 stars
- performing-memory-forensics-with-volatility3-pluginsAnalyze memory dumps using Volatility3 plugins to detect injected code,36,139 stars
- detecting-exfiltration-over-dns-with-zeekDetect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy36,139 stars
- collecting-threat-intelligence-with-mispDeploy MISP, configure threat feeds (MISP community, freetext, TAXII, CSV), and use the PyMISP API to programmatically fetch, add, and searc36,139 stars
- building-cloud-siem-with-sentinelDeploy Microsoft Sentinel as a cloud-native SIEM/SOAR by configuring multi-cloud data connectors (AWS, Azure, GCP), writing KQL detection an36,139 stars
- exploiting-kerberoasting-with-impacketPerforms Kerberoasting (MITRE ATT&CK T1558.003) using Impacket's GetUserSPNs.py to request Kerberos TGS tickets for SPN-registered service a36,139 stars
- configuring-hsm-for-key-storageConfigures Hardware Security Modules for cryptographic key storage36,139 stars
- performing-clickjacking-attack-testTesting web applications for clickjacking vulnerabilities by assessing36,139 stars
- building-c2-redirector-infrastructureBuild dumb-pipe and traffic-filtering C2 redirectors with nginx (proxy_pass) and Apache (mod_rewrite), deriving filter rules from a Malleabl36,139 stars
- validating-backup-integrity-for-recoveryValidates backup integrity through cryptographic hash verification,36,139 stars
- hunting-for-persistence-via-wmi-subscriptionsHunts for adversary persistence via WMI event subscriptions (MITRE T1546.003)36,139 stars
Looking for something else?QuestionsContact
