CyberCodex v3.2: Zero-dependency CLI engine unifying 22 free Threat Intel, Infostealer, and OSINT feeds (EPSS, CISA KEV, HIBP, Hudson Rock, Shodan InternetDB, RIPE BGP) with an offline APT & Incident Codex
Source Reddit BlueTeam
Discussion
CyberCodex v3.2 is an open-source, zero-dependency command-line interface (CLI) tool that aggregates 22 free threat intelligence, infostealer telemetry, and OSINT feeds. It enables security teams to perform domain and credential exposure checks, infrastructure and DNS telemetry, and offline cyber warfare correlation with detection rule generation. The tool integrates data from sources such as HaveIBeenPwned, Hudson Rock, Shodan InternetDB, RIPE BGP, EPSS, and CISA KEV, providing a unified interface without requiring API keys or external dependencies.
r/blueteamsec (opens in a new tab)u/Traditional_Bear54920 points0 comments
Hi r/blueteamsec,
During SOC triage and domain exposure checks, I got tired of opening 20 browser tabs across Shodan, HaveIBeenPwned, Hudson Rock, crt.sh, RIPE BGP, FIRST EPSS, and CISA KEV, or hitting paywalls requiring expensive API keys.
So I built CyberCodex (v3.2), an open-source, terminal-first Threat Intelligence and OSINT CLI engine built purely with the Python standard library (zero external dependencies, 0 API keys, $0 cost).
What it pulls in parallel with a single command:
- Domain & Credential Exposure (leak command):
- HaveIBeenPwned (HIBP v3): Extracts the most recent breach date, largest historical breach volume (PwnCount), compromised DataClasses, and chronological timeline for any domain.
- Hudson Rock Cavalier Infostealer Telemetry: Separates server-side database breaches from client-side RedLine, Raccoon, Vidar, and Lumma stealer infections, showing compromised employee vs user counts, exact login URLs where credentials were stolen, password strength metrics, and bypassed Antiviruses.
- ProxyNova COMB & HIBP K-Anonymity: Checks password exposure across 850M+ records by sending only the first 5 SHA-1 hex characters.
- Infrastructure, DNS & Crypto Telemetry (intel / cve / ioc commands):
- Shodan InternetDB & RIPE BGP: Open ports, CPEs, hostnames, exposed CVEs, BGP CIDR prefixes, Origin ASNs, and Tor Exit Node verification.
- Cloudflare DoH (RFC 8484) & DMARC Auditor: Queries MX, NS, SPF, and _dmarc records to output an automated Email Spoofing Risk Verdict (LOW / MODERATE / HIGH).
- Live TLS/SSL X.509 Socket Inspector: Extracts cipher suites and SHA-256 certificate thumbprints, and flags self-signed or default Cobalt Strike C2 certificates.
- FIRST.org EPSS + CISA KEV + GitHub PoC Hunter: Combines CVSS scores with 30-day exploitation probability (%) and live public exploit repositories.
- Offline Cyber Warfare Codex & SIEM Rule Generator:
- Auto-correlates live findings against 10 major historical operations (Stuxnet, SolarWinds SUNBURST, NotPetya, Log4Shell, XZ Utils Backdoor, Volt Typhoon, Lazarus) and generates Wazuh XML, Sigma, Sentinel KQL, and Splunk SPL detection rules.
GitHub Repository (MIT Licensed):
https://github.com/prox0959/CyberCodex
Feedback and suggestions from blue teamers are very welcome!