Open-source alternatives to Rita

nDPI is a deep packet inspection toolkit and network protocol classifier designed to identify protocols and detect security threats through packet payload inspection. It functions as a network security monitor and a traffic analysis framework used to determine the services originating network flows. The system utilizes a modular dissector architecture and a sequence-based dissector chain to interpret network traffic. It supports custom protocol definition and protocol dissector extensions, allowing for the identification of proprietary or new network protocols. The toolkit provides capabilit

Endlessh is an SSH tarpit and network honeypot designed to mitigate automated SSH brute force attacks. It acts as a defensive layer that protects servers by diverting malicious connection attempts into a slow-motion trap. The project implements a tarpit by sending endless, throttled banners to clients, which keeps connections open indefinitely to occupy attacker resources and slow down network scans. The service includes connection rate limiting to prevent system resource exhaustion and provides monitoring through connection activity and diagnostic data logging to system logs. Process manage

This project is a Python command-line security tool and malware analysis framework designed for threat intelligence aggregation and incident triage. It functions as an aggregator that orchestrates queries across multiple security services and sandboxes to analyze hashes, IP addresses, and domains. The tool distinguishes itself by incorporating an intelligence layer that uses language models to provide automated risk assessments and framework mappings. It also includes specialized capabilities for extracting indicators of compromise from unstructured text, documents, and web pages, as well as

A self-hosted sandbox for red teams to test payloads against modern detection before deployment. MCP integration lets an LLM agent drive analysis end to end.

Collection of android malware samples

x86 emulation and shellcode detection

A Libemu Cython wrapper

A tool for studying JavaScript malware.

Repository containing IOCs, CSV and MISP JSON from our blogs

Arkime is a distributed packet analysis platform and full packet capture system designed for recording raw network traffic, indexing metadata, and performing network forensics. It functions as a network traffic indexer and security tool that enables the monitoring, querying, and browsing of large-scale network traffic across multi-cluster architectures. The platform distinguishes itself through its ability to manage distributed capture clusters from a centralized administrative dashboard. It integrates external data feeds with internal traffic logs to identify known threats and provides a pro

Contributed by Check Point Software Technologies LTD. Programmed by Yaraslau Harakhavik

Respounder detects presence of responder in the network.

YARA rule metadata specification and validation utility / Spécification et validation pour les règles YARA

droidefense (originally named atom: a nalysis t hrough o bservation m achine)* is the codename for android apps/malware analysis/reversing tool. It was built focused on security issues and tricks that malware researcher have on they every day work. For those situations on where the malware has…

DRAKVUF Sandbox - automated hypervisor-level malware analysis system