IntelOwl is a production-grade, open-source threat intelligence platform that automates the analysis of observables (IPs, domains, URLs, hashes) and files (PE, PDF, APK, etc.) through a pluggable plugin system. The backend is built with Django REST Framework, Celery for asynchronous task execution, and Django Channels for real-time WebSocket updates. The frontend is a React single-page application using react-router, react-flow for pipeline visualizations, and Zustand for state management. The system supports multi-tenancy, organizations, role-based access, and integrates with dozens of external threat intelligence APIs and open-source analysis tools via containerized microservices. The architecture is centered around a plugin framework with five plugin types: analyzers (file and observable), connectors (push results to external systems), visualizers (render reports), pivots (create child jobs from analysis results), and ingestors (pull threat feeds). Playbooks bundle these plugins into repeatable analysis workflows. A data model manager normalizes analyzer outputs into structured evaluations with reliability scores, and a user event system allows manual verdict overrides with decay logic. The platform also includes an AI chatbot assistant powered by a local Ollama LLM and LangGraph, enabling natural-language queries and one-click analysis launches. Key operational features include a comprehensive REST API, token-based authentication with optional OAuth/LDAP/RADIUS, Elasticsearch for BI reporting, and Docker-based deployment with separate containers for specialized analyzers. The codebase is actively maintained with extensive unit and integration tests, CI/CD pipelines, and a large community (4695 stars). While the migration system is somewhat repetitive, the overall architecture is clean, modular, and demonstrates strong software engineering practices.
This repository is the infrastructure-as-code backbone for Security Onion, a free and open Linux distribution for threat hunting, enterprise security monitoring, and log management. It contains over 1,700 files of SaltStack states, Jinja templates, shell scripts, and Python modules that orchestrate the deployment, configuration, and lifecycle management of a distributed grid of security monitoring nodes. The code manages the entire Elastic Stack (Elasticsearch, Logstash, Kibana), network sensors (Zeek, Suricata), file analysis (Strelka), endpoint monitoring (Elastic Fleet/Agent), authentication (Kratos/Hydra), messaging (Kafka/Redis), metrics (Telegraf/InfluxDB), and the Security Onion Console (SOC) web UI. It is not a standalone application but a deployment and configuration system that transforms a bare OS into a fully operational security operations center. The repository is actively maintained with frequent commits, versioned releases, and a large community. Key architecture patterns include role-based state inclusion via `allowed_states`, consistent Docker container management, Jinja-based configuration merging, and event-driven reactors for rule pushes. Notable reusable components include a self-contained threat intelligence analyzer framework, a YAML manipulation CLI tool, and polling-based beacons that avoid inotify leaks.
The exifLooter is a command-line application written in Go that extracts EXIF metadata, particularly GPS coordinates, from image files. It relies on the external exiftool command-line utility to perform the actual metadata extraction and provides a user-friendly interface for analyzing single images, directories of images, or images downloaded from URLs via stdin. The tool also offers functionality to remove all metadata from images and to generate OpenStreetMap URLs from GPS coordinates found in images. The architecture is a standard CLI tool built using the Cobra library for command parsing and the fatih/color library for colored terminal output. The main entry point is in main.go, which delegates to the command defined in cmd/root.go. The core functionality involves invoking exiftool via os/exec, parsing its output to detect GPS-related tags, and presenting the results with color-coded warnings when geolocation data is detected. Additional features include downloading images from URLs (with validation of content type) for batch processing in a pipe mode. While the tool fulfills its intended purpose, the codebase exhibits some areas for improvement: the pipe mode's image validation step is inefficient (rescanning the entire directory for each download), the OpenStreetMap URL generation function incorrectly handles southern and western hemisphere coordinates, and there is a lack of automated tests. Despite these issues, the project is actively maintained with recent commits and uses dependency management via Go modules.
DuplexSpyCS is a full-featured Remote Access Trojan (RAT) command-and-control (C2) framework written in C# (.NET WinForms). It consists of a server-side management console and multiple payload variants (winClient48, winClient48DLL, Tipoff, etc.) that provide comprehensive post-exploitation capabilities: file manager, remote desktop, keylogger, webcam/microphone streaming, registry editor, process/task manager, remote shell (including xterm via WebView2), SOCKS5 proxy, and a plugin system for credential theft (Chrome, Edge, Firefox, MobaXterm). Communication uses a custom binary protocol (clsDSP) over TCP, TLS, or HTTP with RSA-AES hybrid encryption. The payloads employ persistence via registry/startup, UAC bypass, process injection (APC, EarlyBird, CreateRemoteThread, etc.), and fileless execution. The codebase is extensive but exhibits significant code duplication across payload projects, many incomplete or stub features, and outdated dependencies (AForge, NAudio, SharpPcap). It is explicitly designed for offensive security research and learning, but carries high risk of misuse.
This repository is a curated 'awesome list' of cybersecurity resources, not a software application. It contains a single README.md file that categorizes and links to external tools, certifications, blogs, training platforms, and security operating systems. There is no executable code, API endpoints, or data pipelines. The project serves as a reference index rather than a functional system. As such, it does not demonstrate software craftsmanship or reusability in the traditional sense. The content is community-driven and updated periodically.