gooflabs Goto Github PK

acceptable_use_policy

ad_dns_to_elk

Install packetbeat on AD DNS servers, securely ship them to ELK, ??, visualize.

adaudit

Powershell script to do domain auditing automation

adfs2

Multi Vagrant environment with Active Directory

adsecurity-stats-grafana

ansible-1

Ansible playbooks for managing an elementary school IT infrastructure (mostly Windows desktops)

ansible-velociraptor

Ansible role for Velociraptor EDR

atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.

attack_range

A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk

azure_labs

build_a_phish

Ansible playbook to deploy a phishing engagement in the cloud.

cloud-hackbox

Create custom AMIs with Packer and Ansible to enable rapid provisioning of offensive infrastructure in AWS using Terraform.

credsleaker

Credsleaker allows an attacker to craft a highly convincing credentials prompt using Windows Security, validate it against the DC and in turn leak it via an HTTP request.

cyber-security

Cybersecurity for both the blue team and the red team, I guess.

detectionlab

Vagrant & Packer scripts to build a lab environment complete with security tooling and logging best practices

docker-openvpn

🔒 OpenVPN server in a Docker container complete with an EasyRSA PKI CA

drone

TTP0 Custom Python Client for SOC Work - Using TheHive Incident Management Platform

elk-hole

elasticsearch, logstash and kibana configuration for pi-hole visualiziation

elk-tls-docker

This repository contains code to create a ELK stack with certificates & security enabled using docker-compose

fleet

A flexible control server for osquery fleets

gau

Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl.

gophish-templates

GoPhish Templates which I have retired and used throughout various engagements.

graylog

GrayLog Extractors & More!

graylog2thehive

Create alerts in The Hive from your Graylog alerts, to be turned into Hive cases.

graylog_sysmon

Advanced configuration for Graylog w/Sysmon

gsvsoc_cybersecurity-incident-response-plan

Cybersecurity Incident Response Plan

gsvsoc_docker-system-of-record

A dockerized log server, that has plug and play capabilities.

gvm10-docker

Non Official - Greenbone Vulnerability Management version 10 Docker image

icebreaker

Gets plaintext Active Directory credentials if you're on the internal network but outside the AD environment

incident-response-plan

Boilerplate Incident Response Plan from "Starting Up Security"