FireBreak is an open-source security tool designed to help users map the connections between their online accounts and understand how account recovery and sign-in relationships might impact their security. It allows users to explore account dependencies, review security recommendations, and simulate breach scenarios to inspect potential recovery paths. The tool aims to improve awareness of how the compromise of one account could affect others linked through recovery mechanisms.
This content describes an open-source phishing forensics engine named phish-zero that claims 98.32% accuracy and operates with a zero-egress architecture to avoid leaking corporate click data. It uses local neural phishing detection, character n-gram TF-IDF vectorizers, and flags for TLD abuse. The post is a community share on Reddit and includes a link to the GitHub repository. There is no indication of a security vulnerability or active threat associated with this tool itself.
This is a promotional post seeking testers for an open-source tool designed to ingest multiple vulnerability feeds and prioritize CVEs based on exploitation risk and other factors. The tool aims to help users rank vulnerabilities for remediation efforts more effectively. It is currently implemented as a Cloudflare worker with plans for a Docker version.
This content describes a free, comprehensive, and open-source exploit development curriculum covering C programming, x86-64 assembly, reverse engineering, and advanced exploitation techniques. It is intended as an educational resource for beginners and security researchers to learn exploit development from the ground up. The curriculum is not a vulnerability or exploit itself but a learning tool.
CyclePatrol is a Bash-based Wi-Fi security assessment tool designed to run on Linux and Android (Kali NetHunter). It continuously scans nearby Wi-Fi networks while the user moves around, collecting information about access points and performing authorized security tests such as WPS, PMKID, handshake captures, and WPA2/WPA3 assessments. The tool saves detailed evidence and generates HTML reports. It requires root privileges and is intended for use only on networks where the user has permission to test. CyclePatrol orchestrates multiple standard wireless security tools and modules to provide comprehensive Wi-Fi security checks.
This is a conceptual open-source project proposing a passive, drop-in defense kit for small websites to detect, slow down, and persuade misbehaving autonomous AI agents. It aims to provide small sites, which typically lack dedicated security teams, with tools such as unique bait files, canary credentials, embedded stop notices, and logging to identify automated misuse without active countermeasures. The project is in early planning stages with no production-ready code yet and builds on existing tools like Canarytokens and Nepenthes. It does not represent a vulnerability or exploit but rather a security tool concept addressing emerging AI agent threats.
Cusimanse is a declarative, composable YAML framework designed to facilitate agent-operated security research on disposable compute environments. It enables researchers to declare contracts, requirements, capabilities, and policies to create reproducible research workflows. The project is in beta and actively developed, emphasizing responsible AI-assisted development and secure execution boundaries. It is not a vulnerability or exploit but a security research tool framework.
Kumo is an open-source domain OSINT and reconnaissance framework designed to automate and centralize external domain reconnaissance. It runs 27 modules in parallel to gather DNS, port, certificate, subdomain, technology stack, leaked credentials, vulnerability checks, and other publicly available information about a target domain. It requires no API keys or elevated privileges and provides both CLI and web interfaces for scanning and reporting. Kumo is intended for use on domains the user is authorized to test and does not itself represent a vulnerability or exploit.
TV Box Sentinel v2.0 is an open-source network monitoring and heuristic threat detection tool designed to identify compromised Android TV boxes and IoT devices. It targets malware preinstalled in the /system partition of uncertified Android TV boxes and botnet loaders such as Badbox, Peachpit, Triada, and Guerrilla. The tool analyzes network traffic captures and router logs to detect indicators of compromise like beaconing, anomalous traffic, C2 communications, lateral movement, and cryptojacking. It generates automated mitigation rules for firewalls and DNS sinkholes and provides executive reports and a graphical user interface for ease of use.
This is an open-source tool named log-generator that creates realistic synthetic SIEM logs simulating multi-stage cyberattacks. It is designed for security professionals to test detection capabilities and security stacks without requiring real breaches or exposing sensitive data. The tool supports multiple log formats and integrates easily with common SIEM platforms. It does not represent an actual vulnerability or active threat but rather a resource for defensive testing.
Suri Oculus 4.0 is an open-source network monitoring and analysis platform built on top of Suricata, designed to provide host behavior profiling and anomaly analysis. It aggregates network data such as flows, DNS, TLS, ports, and Suricata alerts to build behavioral profiles for hosts, enabling detection of deviations from normal activity. The platform uses a combination of C++, Python, Redis, and web technologies to deliver high-performance log management and analysis. It is intended to complement Suricata's signature-based detection with statistical anomaly detection using Isolation Forest. Pre-built packages are available for multiple Linux distributions. This is a security tool project, not a vulnerability or exploit.
CyberCodex v3.2 is an open-source Python CLI tool designed to aggregate cyber threat intelligence (CTI) from 22 public sources without requiring API keys. It provides live enrichment of indicators of compromise (IOCs) and hashes, vulnerability prioritization using MITRE CVE data combined with exploitation probability scores, and telemetry on infostealers and breaches. The tool also includes offline encyclopedic data on advanced persistent threat (APT) operations and actor profiles, supporting multiple languages and exporting data in Markdown or JSON formats.
CyberCodex v3.2 is an open-source, zero-dependency command-line interface (CLI) tool that aggregates 22 free threat intelligence, infostealer telemetry, and OSINT feeds. It enables security teams to perform domain and credential exposure checks, infrastructure and DNS telemetry, and offline cyber warfare correlation with detection rule generation. The tool integrates data from sources such as HaveIBeenPwned, Hudson Rock, Shodan InternetDB, RIPE BGP, EPSS, and CISA KEV, providing a unified interface without requiring API keys or external dependencies.
ubuntils v2.0.0 is a Python-based forensic triage tool for live Ubuntu systems designed to automate artifact collection, persistence detection, and timeline correlation. It replaces manual incident response commands with a fast, automated process that collects data from multiple system sources, detects 15 persistence and tampering techniques, and correlates events into a timeline. The tool supports offline analysis by splitting collection and analysis phases, includes confidence scoring for findings, and offers guided remediation with dry-run and confirm modes. It integrates with Wazuh for automated reporting and operates fully offline without network calls. ubuntils aims to improve the speed and accuracy of initial forensic triage on Ubuntu hosts.
MemGuard is a lightweight, open-source Python tool designed to detect and mitigate unauthorized LSASS memory access and credential dumping attempts on Windows endpoints. It audits handle tables to identify processes with suspicious access rights to lsass.exe, inspects process command lines for known LOLBin dumping techniques, and can freeze suspect processes to preserve forensic artifacts. The tool operates without dependencies, using native Windows APIs and kernel structures. It targets the MITRE ATT&CK technique T1003.001 (OS Credential Dumping via LSASS memory).
fad-checker is a standalone, air-gapped dependency auditing tool designed for professional code audits across multiple ecosystems without requiring build tools or network access. It supports scanning Maven, Gradle, npm, PyPI, NuGet, Go, Ruby, and more, identifying vulnerabilities, deprecated packages, private/internal dependencies, and committed cryptographic material. The tool produces detailed reports including CVE prioritization, license information, and supply chain risk indicators. It is intended to simplify and improve the accuracy of audits in complex, multi-module, polyglot codebases.
RCEKit is an open-source toolkit designed to detect and confirm remote code execution (RCE) vulnerabilities during authorized penetration testing and security research. It uses multiple methods to distinguish confirmed RCE from weaker signals or false positives by generating unique tokens and verifying their presence in target responses or out-of-band callbacks. The tool has been tested against real-world CVEs such as Webmin CVE-2019-15107, Apache Struts2 S2-001, and Log4Shell CVE-2021-44228, demonstrating its ability to confirm or classify RCE findings accurately. RCEKit does not report uncertain cases as confirmed, instead assigning them lower confidence tiers. It supports testing via URLs or captured HTTP requests and offers various probing methods, including reflected, eval, time-based, lookup, and deserialization injection techniques. The tool is intended for use only on authorized targets and requires careful configuration due to the high volume of requests it generates.
This content describes an open-source self-hosted threat intelligence aggregator tool designed to collect, deduplicate, and correlate threat intelligence feeds from over 60 sources. It includes features such as IOC extraction, ATT&CK mapping, integration with asset inventories, and detection engineering capabilities. The tool can run locally or integrate with Azure environments and supports optional AI triage. It is not a vulnerability or exploit but rather a security tool release.
atomicvulns is an open-source educational project providing a collection of small, intentionally vulnerable web applications, each demonstrating a single OWASP Top 10 2021 vulnerability. It includes 38 isolated apps ('atoms'), each with a vulnerable and fixed version, plus walkthroughs for exploitation and remediation. The project is designed for pentest and AppSec learners to study and practice exploiting and fixing common web vulnerabilities in a focused, hands-on manner. It is not a vulnerability or exploit itself but a learning tool.
Vectra is an offline vulnerability and exploitation intelligence engine designed for use in terminal environments. It provides fast local search capabilities across over 25,000 CVEs and integrates a database of 3,608 GTFOBins privilege escalation payloads for Unix binaries. The tool supports service and version matching, vulnerability classification, and includes a user-friendly interactive terminal interface with autocompletion and visual CVSS scoring. It is intended for penetration testers, red teamers, and CTF players who may have limited or no internet access. Vectra is open source and container-ready, facilitating easy deployment and offline usage.