Awesome GitHub RepositoriesSecurity Lab Environments

Ansible is an agentless infrastructure automation engine designed to manage remote servers and network devices. It functions as a cross-platform orchestration tool that coordinates system updates, software installations, and service configurations from a centralized management workstation. By utilizing a declarative approach, it allows users to define desired system states through human-readable configuration files, ensuring consistency across distributed environments. The platform operates by establishing secure shell connections to target nodes, eliminating the need for persistent agent sof

Semgrep is a static analysis security testing tool designed to identify vulnerabilities and logic errors by matching source code against declarative patterns. It functions as an automated scanner that integrates into development workflows to detect insecure code patterns and enforce coding standards before deployment. The engine utilizes a language-agnostic intermediate representation and a modular parser architecture to normalize diverse programming languages into a unified format. This allows for consistent rule execution across different codebases, enabling users to perform custom structur

Ecapture is a suite of specialized auditing tools designed to capture plaintext database queries, log executed shell commands, forward packet captures, and decrypt TLS traffic. The system extracts plaintext content from encrypted communications and TLS master secrets without requiring CA certificates. It further monitors data interactions by capturing SQL queries from database instances and recording commands from shell environments for host-level auditing. The toolset includes capabilities for network traffic analysis, exporting captured data to pcapng files, and forwarding events to extern

Lynis is an automated security auditing and system hardening framework designed for UNIX-based operating systems. It functions as a command-line utility that inspects local system configurations to identify security vulnerabilities, configuration weaknesses, and compliance gaps. By executing a series of modular tests, the tool generates actionable reports and remediation suggestions to assist in strengthening system defenses. The project distinguishes itself through a highly modular architecture that relies on shell-script-based execution and native system inspection. Users can define custom

Wazuh is an integrated security platform that combines endpoint detection and response, security information and event management, and cloud workload protection. It functions as a centralized system for collecting telemetry, aggregating logs, and correlating events across distributed infrastructure to maintain security and integrity. The platform distinguishes itself through its active response orchestration, which allows for the automated execution of scripts on remote endpoints to neutralize threats in real time. It provides deep visibility into system activity through file integrity monito

Xpipe is a remote infrastructure management tool and cross-platform terminal orchestrator. It provides a centralized desktop interface for managing remote server connections, shell sessions, and secure tunneling. The system functions as a remote application gateway, streaming graphical applications to a local desktop via RDP, VNC, or X11. It also implements a Model Context Protocol server, which exposes server infrastructure and remote command execution capabilities to external AI agents. The tool covers several operational areas, including hierarchical connection management, remote file sys

Flare-VM ist eine Windows-Umgebung zur Malware-Analyse, die aus Installationsskripten besteht, welche die Bereitstellung einer virtuellen Maschine automatisieren. Sie bietet eine umfassende Suite an Reverse-Engineering-Werkzeugen, einschließlich Decompiler und Debugger, zusammen mit den notwendigen Systemkonfigurationen und Umgebungsvariablen für die Sicherheitsforschung. Das Projekt fungiert als Orchestrator für Images virtueller Maschinen und ermöglicht die automatisierte Erstellung, Verwaltung und den Export spezialisierter Analyse-Appliances. Es bietet eine konfigurationsgesteuerte Werkzeugauswahl und die Möglichkeit, die Installationslogik durch benutzerdefinierte Registry-Modifikationen und Systemlayout-Definitionen zu erweitern. Das System umfasst Funktionen für eine isolierte Netzwerkkonfiguration, um die externe Kommunikation über den Host-Only-Modus zu verhindern. Es verwaltet zudem den gesamten Lebenszyklus von Analyseständen durch Snapshot-basiertes Zustandsmanagement, einschließlich der Möglichkeit, Snapshots als verifizierte Appliance-Dateien zu bereinigen oder zu exportieren.

OpenCTI is a cyber threat intelligence platform and knowledge base used to store, manage, and analyze technical security data. It functions as a threat intelligence visualization tool and an enterprise security data orchestrator that maps relationships between threat actors, malware, and vulnerabilities. The platform utilizes the STIX and TAXII standards for data representation and exchange, allowing for the sharing and receiving of standardized intelligence bundles. It distinguishes itself by converting complex security information into visual relationship diagrams and geographic maps to ide

Maltrail is a malicious traffic detection system used for network intrusion detection. It consists of a network intrusion sensor for monitoring interfaces, a threat intelligence aggregator for syncing blacklists, and a detection engine that identifies security threats through signature matching and heuristic attack patterns. The system distinguishes itself through a distributed sensor architecture that collects traffic data from multiple remote probes and forwards events to a central analysis server. It employs heuristic behavioral analysis to identify unknown threats, such as port scanning o

GOAD is an Ansible-based automation tool and infrastructure orchestrator used to deploy pre-configured networks of vulnerable Windows virtual machines. It serves as a security training environment for practicing Active Directory penetration testing, privilege escalation, and lateral movement across various cloud platforms and local virtualization hypervisors. The project distinguishes itself through a multi-provider infrastructure model and a system of infrastructure recipes that simulate intentional security misconfigurations. It supports the deployment of varied attack scenarios, including

MISP is an open-source threat intelligence sharing platform designed for collecting, storing, and distributing structured threat indicators and intelligence. At its core, it provides a distributed synchronization protocol for transferring events between instances, an attribute-based correlation engine that links matching indicators across events, and a REST API with an OpenAPI specification for programmatic access to threat data. The platform uses formal data formats for JSON, taxonomy, galaxy, and object templates to enable compatibility across tools and communities. The platform distinguish

.. SPDX-FileCopyrightText: 2014 Upi Tamminen .. SPDX-FileCopyrightText: 2014-2025 Michel Oosterhof .. .. SPDX-License-Identifier: BSD-3-Clause

Cuckoo is an open-source automated malware analysis system that executes suspicious files inside isolated virtual machines and produces structured behavioral reports. The platform captures system calls, file operations, and network activity during execution, compiling them into comprehensive analysis documents for programmatic consumption. The system operates through a modular analysis pipeline that processes behavioral data, applying YARA signature patterns against captured artifacts to identify known malware families. Each analysis run starts from a clean virtual machine snapshot to ensure

Katoolin ist ein Debian-Software-Repository-Manager und ein Automatisierungstool für Sicherheits-Toolsets. Es fungiert als Skript zur Automatisierung des Hinzufügens von Repositories und der Installation von Sicherheitstools aus Kali Linux auf anderen Debian-basierten Systemen. Das Projekt konzentriert sich auf die Automatisierung der Bereitstellung von Penetration-Testing- und Forensik-Software. Es bietet eine Methode zur Verwaltung von Softwarequellen Dritter und zur Bereitstellung von Sicherheitslaboren mit Tools für Netzwerk- und Systemtests, ohne eine vollständige Betriebssysteminstallation zu erfordern. Das Tool enthält ein interaktives CLI zur Navigation durch Tool-Kategorien und zur Verwaltung von Softwarepaketen durch einen Shell-gesteuerten Prozess. Es organisiert Software in modularen Gruppierungen, um die Installation spezifischer Teilmengen oder vollständiger Tool-Suiten zu ermöglichen.

Security Onion ist eine Plattform für Security Information and Event Management (SIEM) sowie eine Suite für die Netzwerksicherheitsüberwachung. Sie fungiert als Intrusion-Detection-System und Tool zur Netzwerktraffic-Analyse, um böswillige Aktivitäten und Eindringversuche durch signaturbasierte Erkennung und hostbasierte Überwachung zu identifizieren. Die Plattform integriert ein Security-Case-Management-System, um Untersuchungen durch die Nachverfolgung von Erkennungen und die Gruppierung zusammengehöriger Sicherheitsereignisse zu organisieren. Sie bietet Funktionen für Full-Packet-Capture, die Extraktion von Netzwerk-Metadaten sowie das Sammeln und Indizieren von Sicherheits-Logs aus verschiedenen Quellen. Das System deckt ein breites Spektrum an Sicherheitsoperationen ab, darunter die Untersuchung von Sicherheitsvorfällen, Threat-Hunting-Workflows und die Aggregation von Sicherheits-Logs. Es nutzt eine einheitliche Web-Konsole zur Analyse von Sicherheitsereignissen und Alerts und integriert künstliche Intelligenz zur Unterstützung bei der Untersuchung von Sicherheitsdaten.

Pikachu ist eine Plattform für Web-Sicherheitstraining und eine Sandbox für verwundbare Webanwendungen. Sie bietet eine containerisierte Laborumgebung, die für das Üben von Penetrationstests und das Identifizieren häufiger Sicherheitslücken konzipiert ist. Das Projekt dient als OWASP Top 10-Übungslabor und bietet eine Simulationssuite für kritische Risiken. Es enthält spezifische Szenarien zum Üben der Ausnutzung von SQL-Injection, Cross-Site-Scripting, Remote Code Execution und fehlerhafter Zugriffskontrolle. Die Umgebung deckt ein breites Spektrum an Sicherheitstest-Simulationen ab, einschließlich Directory Traversal, Server-Side Request Forgery, unsicherer Datei-Uploads und XML External Entity-Angriffen. Sie verfügt zudem über ein administratives Backend zur Verwaltung von Phishing-Simulationen und zur Überwachung erfasster Session-Payloads. Die gesamte Plattform wird über ein containerisiertes Image bereitgestellt, das automatisch das Datenbankschema initialisiert und die Umgebung mit Seed-Daten füllt.

Tracee is a cloud-native runtime security and forensics tool that uses eBPF to capture system calls and kernel events in real time. It operates as a standalone binary or a Helm-deployable agent for Kubernetes, normalizing system calls, network events, and container activities into a unified event pipeline for consistent analysis. The tool distinguishes itself through policy-driven event filtering using YAML-based rules, allowing users to target specific workloads and reduce noise during monitoring. It includes built-in threat detection signatures that flag suspicious behavioral patterns witho

Harden-Windows-Security is a security hardening tool and framework designed to reduce the attack surface of the Windows operating system through policy enforcement. It provides a collection of security presets and templates to implement official hardening standards across multiple devices. The project distinguishes itself through a comprehensive execution control system, featuring a manager for Windows Application Control and a kernel protection suite. It implements strict trust models, including kernel-mode driver whitelisting, signed policy implementation on the EFI partition, and code inte

Malware Configuration And Payload Extraction

OpenCanary is a network service simulator and honeypot designed for network intrusion detection. It functions as a security decoy that creates fake server personalities and open ports to identify unauthorized users scanning a private network. The system uses deception technology to mimic various server protocols, luring attackers into revealing their presence and activity. When a simulated service is accessed, it acts as an intrusion alerting gateway, transmitting notifications via email or webhooks. The project covers internal network monitoring and intrusion source tracking to identify the