Blueteam Open Source Projects

E-mails, subdomains and names Harvester - OSINT

GTFOBins is a curated list of Unix-like executables that can be used to bypass local security restrictions in misconfigured systems.

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

Cyber Security ALL-IN-ONE Platform

One place for all the default credentials to assist the Blue/Red teamers identifying devices with default password 🛡️

A collection of awesome security hardening guides, tools and other resources

An Information Security Reference That Doesn't Suck; https://rmusser.net/git/admin-2/Infosec_Reference for non-MS Git hosted version.

Kubernetes Goat is a "Vulnerable by Design" cluster environment to learn and practice Kubernetes security using an interactive hands-on playground 🚀

ffffffff0x 团队维护的安全知识框架,内容包括不仅限于 web安全、工控安全、取证、应急、蓝队设施部署、后渗透、Linux安全、各类靶机writup

Tools and Techniques for Blue Team / Incident Response

Snoop — инструмент разведки на основе открытых данных (OSINT world)

Rapidly Search and Hunt through Windows Forensic Artefacts

Investigate malicious Windows logon by visualizing and analyzing Windows event log

Free copy of The Cyber Plumber's Handbook - The definitive guide to Secure Shell (SSH) tunneling, port redirection, and bending traffic like a boss.

HardeningKitty and Windows Hardening Settings

红蓝对抗以及护网相关工具和资料，内存shellcode（cs+msf）和内存马查杀工具

Tools & Interesting Things for RedTeam Ops

Attack Graph Visualizer and Explorer (Active Directory) ...Who's *really* Domain Admin?

The goal of this repository is to document the most common techniques to bypass AppLocker.

HardeningKitty - Checks and hardens your Windows configuration

You didn't think I'd go and leave the blue team out, right?

Awesome Security lists for SOC/CERT/CTI

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

WADComs is an interactive cheat sheet, containing a curated list of offensive security tools and their respective commands, to be used against Windows/AD environments.

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

一款适用于红蓝对抗中的仿真钓鱼系统

Bloodhound Reporting for Blue and Purple Teams

Active Directory data ingestor for BloodHound Legacy written in Rust. 🦀

A list of vulnerabilities or design flaws that Microsoft does not intend to fix. Since the number is growing, I decided to make a list. This list covers only vulnerabilities that came up in July 2021 (and SpoolSample ;-))

Hunting queries and detections

Purple Team Exercise Framework

Slack Enumeration and Extraction Tool - extract sensitive information from a Slack Workspace

Practical Windows Forensics Training

A tool that shows detailed information about named pipes in Windows

Open Source Cloud Security

用于Linux应急响应，快速排查异常用户登录情况和入侵信息排查，准确定位溯源时间线，高效辅助还原攻击链。

TweetFeed collects Indicators of Compromise (IOCs) shared by the infosec community at Twitter. Here you will find malicious URLs, domains, IPs, and SHA256/MD5 hashes.

Awesome list of keywords and artifacts for Threat Hunting sessions

Scan your code for security misconfiguration, search for passwords and secrets. :mag:

一些关于渗透测试的Tips

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

Data leak checker & OSINT Tool

bXSS is a utility which can be used by bug hunters and organizations to identify Blind Cross-Site Scripting.

🍓📡🍍Monitor illegal wireless network activities. (Fake Access Points), (WiFi Threats: KARMA Attacks, WiFi Pineapple, Similar SSID, OPN Network Density etc.)

Living Off the Orchard: macOS Binaries (LOOBins) is designed to provide detailed information on various built-in "living off the land" macOS binaries and how they can be used by threat actors for malicious purposes.

Uses Sharphound, Bloodhound and Neo4j to produce an actionable list of attack paths for targeted remediation.

Redeye is a tool intended to help you manage your data during a pentest operation

一个基于网络空间搜索引擎的攻击面管理平台，可定时进行资产信息爬取，及时发现新增资产，本项目聚合了 Fofa、Hunter、Quake、Zoomeye 和 Threatbook 的数据源，并对获取到的数据进行去重与清洗

RPC Monitor tool based on Event Tracing for Windows

Slack enumeration and exposed secrets detection tool

This repository contains full code examples from the book Gray Hat C#

Find cloud assets that no one wants exposed 🔎 ☁️

Web Application Secure Coding Handbook resource.

This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.

MAL-CL (Malicious Command-Line)

A JavaScript and VBScript Based Empire Launcher, which runs within their own embedded PowerShell Host.

ETWProcessMon2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detection by VirtualMemAlloc Events (in-memory) etc.

红蓝对抗跨平台远控工具

Awesome Incident Response

Test Blue Team detections without running any attack.