Securify

For Research & Learning Purpose Only!

[securify]

Vindicate is a tool which detects name service spoofing, often used by IT network attackers to steal credentials (e.g. Windows Active Directory passwords) from users. It’s designed to detect the use of hacking tools such as Responder, Inveigh, NBNSpoof, and Metasploit’s LLMNR, NBNS, and mDNS spoofers, whilst avoiding false positives. This can allow a Blue Team to quickly detect and isolate attackers on their network.

[securify]

firecall scripts are designed to automate sending commands to a Cisco ASA firewall. The intended purpose here is to eliminate the need to manually log in to a firewall to make changes. This code can be run directly via command line or it can be incorporated into other scripts

[securify]

DroidCarve is capable of analyzing an Android APK file and automate certain reverse engineering tasks. Features: + Code disassembling into Smali bytecode. + APK signature extraction. + AndroidManifest parsing: permissions, services, intents, package information etc.

[securify]

ph0neutria is a malware zoo builder that sources samples straight from the wild. Everything is stored in Viper for ease of access and manageability.

This project was inspired by Ragpicker (https://github.com/robbyFux/Ragpicker, formerly known as “Malware Crawler”). However, ph0neutria aims to:

+ Limit the scope of crawling to only frequently updated and reliable sources. + Maximise the effectiveness of individual indicators. + Offer a single, reliable and well organised storage mechanism. + Not do work that can instead be done by Viper.

[securify]

hcxdumptool is a Small tool to capture packets from wlan devices. Tools Description: + hcxdumptool: Raw socket version of wlandump-ng + pioff: Turns Raspberry Pi off via GPIO switch

Requirements + Operatingsystem: archlinux (strict), Kernel >= 4.14 (strict) + libpthread and pthread-dev installed + Raspberry Pi: additionally libwiringpi and wiringpi dev installed (Raspberry Pi GPIO support) + Chipset must be able to run in monitor mode (strict by: ip and iw). Recommended: RALINK chipset (good receiver sensitivity), rt2x00 driver (stable and fast) + Raspberry Pi A, B, A+, B+ (Recommended: A+ = very low power consumption or B+), but notebooks and desktops could work, too. + GPIO hardware mod recommended

[securify]

PhishingDetect is A simple machine learning model to identify phishing pages by looking at: + HTML text + HTML structure + IMAGE text

[securify]

mdharvest is a Perl and Python code to harvest discovery metadata using OAI-PMH, OpenSearch and OGC CSW. Not all protocols are fully supported yet. Harvesting is coupled with filtering of records harvested according to GCMD Science keywords and latitude/longitude

[securify]

prefetchkit A powerful forensics commandline tool for analyzing and extracting information from Microsoft Prefetch files.

It fully supports the following Prefetch version: + Windows XP/2003 + Windows Vista/7 + Windows 8/8.1 If partially supports the following Prefetch version: Windows 10.

[securify]

sqhunter is a Threat hunter based on osquery, Salt Open and Cymon API. Features + query open network sockets and check them against threat intelligence sources + issue ad-hoc or distributed queries using salt and osqueryi, without the need for osqueryd’s tls plugin

[securify]

usbrip is a A tiny command line forensic tool for tracking USB device artifacts (history of USB events) on Linux.

Hardware and System Support: + Linux 2.2.7 kernel or Higher + USB v2.0

[securify]

remediation is a Tools and utilities for remediation and incident-response handling. JewelRunner is intended to quickly analyze tcp/ip traffic for a target host and create host-based firewall rules in support of micro segmentation activities. In its current form it will: + Parse pcap files and summarize tcp/ip traffic to and from a target IP; + Parse ipFilter (Solaris) log files and generate firewall rules; and + Parse ipSec (AIX) logs and generate firewall rules.

[securify]

idsEventGenerator tools for Reads rules written in a Snort like syntax (as of Snort 2.9.11) from a rule file, puts parsed rule content in a struct and (optionally) prints the rule. It than (optionally) constructs HTTP requests that are sent to the configured host (possibly a webserver) that trigger events on a listening IDS related to the parsed rules. “Snort like” means it accepts Snort rules, but does not require all fields of a Snort rule.

[securify]

Dr. Mine is a node script written to aid automatic detection of in-browser cryptojacking. The most accurate way to detect things that happen in a browser is via browser itself. Thus, Dr. Mine uses puppeteer to automate browser thingy and catches any requests to online cryptominers.

[securify]

trackerjacker is python3 script for Finds and tracks wifi devices through raw 802.11 monitoring. dependencies: – Python 3.x – scapy-python3==0.21 and PyYAML==3.12 python3 library.

Example use-cases + Map out all the nearby wifi devices (and which devices are asspciated with which Access Points) + Track when a particular MAC is seen + Track when a particular MAC sends some threshold of data in some time period + Track when traffic is happening on a particular Access Point + Find/track all connections on a particular Access Point

[securify]

DroidCarve is capable of analyzing an Android APK file and automate certain reverse engineering tasks. Features: + Code disassembling into Smali bytecode. + APK signature extraction. + AndroidManifest parsing: permissions, services, intents, package information etc.

[securify]

RegParser (rp) is a python wrapper script for python-registry framework (@williballenthin [FireEye]). This command-line utility is designed to slightly extend and facilitate framework’s capabilities. In general it’s used to parse any offline windows registry hives during malware hunting or forensic investigations.

[securify]

+ droidstatx is a Python tool that generates an Xmind map with all the information gathered and any evidence of possible vulnerabilities identified via static analysis. + The map itself is an Android Application Pentesting Methodology component, which assists Pentesters to cover all important areas during an assessment. This was the main goal driving the tool development. + The tool also allows to add custom checks in a simple way, to confirm the existence of those patterns in the dalvik bytecode instructions.