2023 - a Year of Tools and Stuff in Cyber Security and AI

A list of the most interesting tools and stuff I was using from 2023, as a present for the Cyber Community for New 2024 Year.

AI/LLM:

• Alternatives for ChatGPT 4 API for free github.com/xtekky/gpt4free.
• AnoMark – an algorithm using NLP based on Markov Chains and n-grams to train on command lines to detect malicious ones. https://github.com/ANSSI-FR/AnoMark.
• Attacks on LLMs. https://github.com/llm-attacks/llm-attacks  https://llm-attacks.org/zou2023universal.pdf.
• A multi-tool for EDR service disruption got a few add-ons: Added GodFault (the same result without the use of any vulnerable drivers) and a Procmon driver https://github.com/gabriellandau/EDRSandblast-GodFault.
• Hack(AI)Bot - AI-powered cybersecurity chatbot designed to provide helpful and accurate answers to your cybersecurity-related queries and also do code analysis and scan analysis, based on Llama2. https://github.com/morpheuslord/HackBot.
• OSINT platform using OpenAI’s GPT https://github.com/estebanpdl/osintgpt.
• Cross-platform command-line interface (CLI) tool that allows you to use ChatGPT 3.5 in your Terminal - nice for automation. https://github.com/aandrew-me/tgpt.
• Cybersecurity incident response testing tool that leverages the power of LLM and the MITRE ATT&CK framework. https://github.com/mrwadams/attackgen.
• An open-source toolkit for attacks and defenses in LLM-integrated applications, which enables easy implementation, evaluation, and extension of attacks, defenses, and LLMs. https://github.com/liu00222/Open-Prompt-Injection.
• LLM in the Shell: Generative Honeypots https://github.com/stratosphereips/shelLM.
• Prompt injection is a type of security vulnerability that can be exploited to control the behavior of a ChatGPT instance. PromptMap automatically tests prompt these injection attacks. https://github.com/utkusen/promptmap.
• SLIPS (StratosphereLinuxIPS) is a powerful endpoint behavioral intrusion prevention and detection system that uses machine learning to detect malicious behaviors in network traffic. Slips threat detection is based on a combination of machine learning models trained to detect malicious behaviors, 40+ threat intelligence feeds, and expert heuristics. https://github.com/stratosphereips/StratosphereLinuxIPS.
• Pentest Muse is an AI agent that can automate parts of pen-testing jobs and provide live suggestions to pen-testers using AI/LLM. Chat accessible at http://www.pentestmuse.ai/. https://github.com/pentestmuse-ai/pentest-muse-cli.
• k8sgpt is a tool for scanning your Kubernetes clusters, diagnosing, and triaging issues with LLM/AI enrichment and assistance. The nice bonus that is has a built-in integration with most of the LLMs: OpenAI, Azure, Cohere, Amazon Bedrock and local models. https://github.com/k8sgpt-ai/k8sgpt.
• Very cool Subdomain and Exploit hunter powered by AI – Puncia. It's not 100% accurate but greatly improves the time consumption. https://github.com/ARPSyndicate/puncia.

Security:

• Detect EDRs' and AVs' exclusions tool, written in Rust https://github.com/Kudaes/Bin-Finder.
• ReverseKit - a helper for reversers https://github.com/zer0condition/ReverseKit.
• InDirecet syscalls evasion implemented in Go https://github.com/f1zm0/acheron.
• Next-Gen Virtualization-based obfuscators https://conference.hitb.org/hitbsecconf2023ams/session/the-next-generation-of-virtualization-based-obfuscators/.
• POC for a new approach to completely prevent DLLs from being loaded into a newly spawned process https://github.com/S3cur3Th1sSh1t/Ruy-Lopez.
• Hypobrychium EDR/AV bypass, written in Delphi. A local admin is required. https://github.com/foxlox/hypobrychium.
• Implementation of named pipes with Cobalt https://github.com/EspressoCake/BetterPipename.
• Amsi bypass by patching AmsiOpenSession https://github.com/senzee1984/Amsi_Bypass_In_2023.
• AMSI Bypass using DebugActiveProcess https://github.com/MzHmO/DebugAmsi.
• Shellcode encryptor written in Go and supports several languages https://github.com/nickvourd/Supernova.
• Splitting the provided file until an AV does not detect it anymore. It will show which parts of the file are being detected https://github.com/dobin/avred.
• Sophisticated way to blind AV and EDR. https://github.com/myzxcg/RealBlindingEDR.
• Driver DLL Injector is a powerful tool that allows users to load unsigned drivers of their choice using their preferred mapper. https://github.com/lleon1435/Kernel_VADInjector.
• Not an easy-to-use but useful reverse engineering toolkit with a bunch of built-in functionality https://github.com/byte2mov/codecave-hook.
• A coverage-guided Fuzzer that is targeting Windows Kernel Driver to uncover Windows driver vulnerabilities https://github.com/0dayResearchLab/msFuzz.
• EDR Silencer is expected to block the outbound traffic of running EDR processes using Windows Filtering Platform (WFP) APIs, supporting more than 10 top EDR software. https://github.com/netero1010/EDRSilencer.
• Another EDR service disruption tool using BYOVD (rentdrv2.sys) named GhostDriver and is written in Rust. The same BYOVD was used by an Iranian APT attacking Israeli sectors. https://github.com/BlackSnufkin/GhostDriver.
• Obfusheader.h is a portable header file for C++14 and higher that implements multiple features for compile-time obfuscation for example string & and decimal encryption, control flow and call hiding. It has no external dependencies, works on both Windows and Unix platforms. https://github.com/ac3ss0r/obfusheader.h.

Threat Intel and General:

• A nice WinAPI cheatsheet https://github.com/snowcra5h/windows-api-function-cheatsheets.
• Very powerful Rootkit, expected to work even with DSE enabled. https://github.com/XaFF-XaFF/Black-Angel-Rootkit.
• Leaked RAIDForums DB, Dark Market closed
• Alcatraz x64 binary obfuscation, featuring several techniques https://github.com/weak1337/Alcatraz.
• Firefox decrypt (passwords extractor) releases a new version and stops support of Python 2 https://github.com/unode/firefox_decrypt.
• One more HTML Smuggling tool https://github.com/De3vil/HtmlSmuggling.
• Visual ProcMon! Known as Vision ProcMoc https://github.com/forensicxlab/VISION-ProcMon.
• Updated Exe to DLL, supporting 64 and 32 bit. https://github.com/hasherezade/exe_to_dll.
• Web-based, all-in-one (lots of integrated services) OSINT tool https://github.com/dev-lu/osint_toolkit.
• POC for bypassing the credential Guard via patching WDigest memory https://github.com/wh0amitz/BypassCredGuard.
• Growing repo for sharing Ransomware TTPs, IOCs… https://github.com/crocodyli/Ransomwares-TTP.
• DeepFake Offensive ToolKit - real-time, controllable deepfakes ready for virtual camera injection. https://github.com/sensity-ai/dot.
• Updated Phishlets, including a course. Extensive collection of dynamic phishing templates designed to be used with Evilginx3 (Advanced Phishing platform made for “pen testers”) https://github.com/simplerhacking/Evilginx3-Phishlets.
• ETW Monitor version 2 https://github.com/DamonMohammadbagher/ETWProcessMon2/tree/main/ETWPM2Monitor2.
• New Tor Scraper. https://github.com/rly0nheart/tor2tor.
• Kubernetes attack graph tool allows automated calculation of attack paths between assets in a cluster. https://github.com/DataDog/KubeHound.
• Comprehensive OSINT reconnaissance framework for researching, investigating, and scraping Telegram. https://github.com/sockysec/Telerecon.
• A tool to find “secrets” and PII (updated) https://github.com/deepfence/SecretScanner.
• “All in one” tool for threat hunting (updated). https://github.com/alexandreborges/malwoverview.
• Nicely organized Ransomware groups info sheet. https://github.com/StrangerealIntel/Shadow-Pulse/blob/main/Ransomlist.csv.
• Very nice Auth Log Parser for Linux: https://github.com/YosfanEilay/AuthLogParser.
• A tool for validation of leaked API tokens/Keys. May be used by attackers to easily test combo lists together with the secret scanner above. https://github.com/rohsec/LEAKEY/.
• Secrets scanner, that does work nicely with code. https://github.com/ntoskernel/deepsecrets.
• A CI/CD Security Analyzer able to identify and report security vulnerabilities of repositories hosted on GitHub. https://github.com/CycodeLabs/raven.
• New Kali release including Raspberry Pi 5 support and availability in Azure and Amazon marketplace, latest GNOME, ~15 new tools. https://www.kali.org/blog/kali-linux-2023-4-release/.
• CATSploit is an automated penetration testing tool using Cyber Attack Techniques Scoring (CATS) method that can be used without a pentester and includes full attack scenarios using Metasploit API. https://github.com/catsploit/catsploit.
• Positive Technologies sandbox software leaked with a keygen https://www.ptsecurity.com/ww-en/products/sandbox/.
• BlackCat’s – the second largest Ransomware - leak site was taken down several times by the FBI and a decryption tool was published by the FBI. https://www.cybersecuritydive.com/news/alphv-ransomware-infrastructure-takedown/702961/.

Let’s play a game – Guess the number of Ransomware victims in 2024:

Disclaimer:

The staff provided on this platform is for informational purposes only. I am not responsible for any outcomes or consequences arising from the use of this staff. Users are responsible for exercising their own judgment and discretion when employing the staff in any context.