Vuls is an open-source, agentless vulnerability scanner based on information from uses multiple vulnerability databases NVD, JVN, OVAL, RHSA/ALAS/ELSA/FreeBSD-SA and Changelogs. The latest versions detect vulnerabilities that patches have not been published from distributors. Runs on a single machine, does its job over SSH, no need for installing and managing agent software. Runs anywhere you set it up. Remote scan mode is required to only setup one machine that is connected to other scan target servers via SSH. If you don't want the central Vuls server to connect to each server by SSH, you can use Vuls in the Local Scan mode. Fast scan mode scans without root privilege, no internet access, almost no load on the scan target server. Deep scan mode scans in more detail. It is possible to detect vulnerabilities in non-OS packages, such as something you compiled by yourself, language libraries and frameworks, that have been registered in the CPE.
Sh_d_n is a free, lightweight website for IP and domain enrichment offered by Shodan. It's optimized for performance and size to focus on just doing one thing: fast lookups for specific resources (IPs and domains). The website is powered by Rust, Axum and the SQLite datasets provided by Shodan Enterprise. We're excited to have reduced the size for most of the pages on this website to less than 10kb, including the CSS stylesheet. If you have the stylesheet cached on the browser then most pages are less than 1 kb!
Sh_d_n is available for free with the caveat that the data isn't as fresh as the regular Shodan API/ website and doesn't include all the banner data that the crawlers collect. The underlying SQLite datasets are normally updated daily but Sh_d_n is only updated once a month. If you want fresher data, an API or access to the underlying datasets for extremely fast IP/ domain enrichment then consider checking out the various Shodan offerings.
Tools to scan OS distributions for backdoor indicators.
The toolkit used for the xz-utils backdoor is far too sophisticated to be a first draft. Were there earlier iterations of this, that shared some things in common but were slightly simpler, injected into other projects? Can we detect the style/"fist" of the author elsewhere? Moreso the delivery mechanics than the contents of the extracted+injected malicious .so.
These scripts unpack the source packages for all of a distro repo's current packages, then scan them for content similar to the malware that was added to xz-utils.
Running over the unpacked source trees of ~19k Gentoo packages and ~40k Debian packages gives a manageable amount of results (~hundreds of hits), digestable by a human. So far the only confirmed malicious results are... from the backdoored xz-utils versions.
Home of the world's largest radio/scanner frequency database. Celebrating 28 years of no ads and no subscriber fees.
This service dates back to the BBS days.
The security helper tool was created to help you reduce the probability of a security violation in a new code, infrastructure or IAM configuration by providing a fast and easy tool to conduct preliminary security check as early as possible within your development process.
It is not a replacement of a human review nor standards enforced by your team/customer. It uses light, open source tools to maintain its flexibility and ability to run from anywhere. ASH is cloning and running different open-source tools, such as: git-secrets, bandit, Semgrep, Grype, Syft, nbconvert, npm-audit, checkov, cdk-nag and cfn-nag. Please review the LICENSE file before use.
OpenSCAP represents both a library and a command line tool which can be used to parse and evaluate each component of the SCAP standard. The library approach allows for the swift creation of new SCAP tools rather than spending time learning existing file structure. The command-line tool, called oscap, offers a multi-purpose tool designed to format content into documents or scan the system based on this content. Whether you want to evaluate DISA STIGs, NIST‘s USGCB, or Red Hat’s Security Response Team’s content, all are supported by OpenSCAP.
If your main goal is to perform configuration and vulnerability scans of a local system then oscap can be the right tool for you. It can evaluate both XCCDF benchmarks and OVAL definitions and generate the appropriate results. The tool supports SCAP 1.2 and is backward compatible with SCAP 1.1 and 1.0.
OpenSCAP is available on various Linux distributions, including Red Hat Enterprise Linux, Fedora and Ubuntu. Since version 1.3.0 OpenSCAP supports also Microsoft Windows.
sudo apt-get install libopenscap8
Does not require root access to run. Can generate reports as HTML or XML.
Welcome to SDRx, where you can remotely connect to RTL-SDR devices and stream live, raw I/Q data. Radio stations are tunneled and can be controlled remotely through a distributed server network.
The previous service hosted at SDRx was suspended due to a lack of interest from the community (nobody contacted us to add any receiver in a month). However, we are thinking about a new concept that would suit the interests of the community better, more specifically as a directory or meta-directory service. So stay tuned and come back here in a few weeks! In the meantime, our local SDR receiver is still online.
Python Code for an FM Scanner using a Raspberry Pi and rtlsdr SDR.
A collection of manuals for Tandy and Radio Shack branded stuff. Size of archive: Over 12,500 separate documents.
Get an insight into the inner-workings of a given website: uncover potential attack vectors, analyse server architecture, view security configurations, and learn what technologies a site is using.
Currently the dashboard will show: IP info, SSL chain, DNS records, cookies, headers, domain info, search crawl rules, page map, server location, redirect ledger, open ports, traceroute, DNS security extensions, site performance, trackers, associated hostnames, carbon footprint. Stay tuned, as I'll add more soon!
The aim is to help you easily understand, optimize and secure your website.
Typescript webshit.
Trunk Recorder is able to record the calls on trunked and conventional radio systems. It uses 1 or more Software Defined Radios (SDRs) to do this. The SDRs capture large swathes of RF and then use software to process what was received. GNURadio is used to do this processing because it provides lots of convenient RF blocks that can be pieced together to allow for complex RF processing. The libraries from the amazing OP25 project are used for a lot of the P25 functionality. Multiple radio systems can be recorded at the same time.
Trunk Recorder currently supports the following:
- Trunked P25 & SmartNet Systems
- Conventional P25 & analog systems, where each group has a dedicated RF channel
- P25 Phase 1, P25 Phase 2 & Analog voice channels
SDRs supported
- RTL-SDR dongles
- HackRF
- Ettus USRP B200, B210, B205
- BladeRF
- Airspy
Radio equipment dealer. Personal and business-related radio equipment for sale, new. Also, shortwave receivers, scanners, software-defined radios, radio accessories and stuff for kids.
rtl_power_fftw is a program that obtains a power spectrum from RTL devices using the FFTW library to do FFT.
It is inspired by the program rtl_power in librtlsdr. However, the said program has several deficiencies that limit its usage in demanding environments, such as radio astronomy. An inspection of rtl_power in hope of modifying it and obtaining better performance resulted in the conclusion that it would be an infeasible task. Measurements of FFT performance showed that the leading library in the field of FFT - fftw - makes mincemeat of the routine used in rtl_power, even on simple processors such as raspberryPi.
The website of an international group of numbers stations enthusiasts. Has a forum, a blog, a podcast (good luck finding the RSS feed), live streams...
This is a site that aims to collect and sort out information about some of the more unusual shortwave anomalies, like UVB-76, the more powerful numbers stations, the XM Whales, and other mysteries. Seems pretty solid, without much in the way of conspiracy, just necessary speculation.
A voice inversion descrambler (and scrambler). Can invert live signals in realtime. Has commonly used inversion carriers as presets.