Inventory every tool installed across your package managers and loose-binary directories, then rank them by what you actually use — blending shell history, agent transcripts, GNOME app usage and access times, each signal showing its work. Annotate the gaps a loopback-only dashboard surfaces; adapt it to any Linux box with one config file. Go standard library only.
A self-hostable out-of-band interaction catcher in a single Go binary: authoritative DNS plus HTTP/HTTPS and FTP listeners, token-correlated capture into SQLite, a live cockpit, turnkey wildcard HTTPS via an ACME DNS-01 self-solve, and webhook alerts. Point a domain at it and catch your blind bugs on your own box, with your own data and no third party in the middle. Ships with beaconcheck, a companion that probes your collector from the outside to prove a real browser actually executed the beacon.
A fully-local, deliberately-vulnerable lab for practicing out-of-band / blind bugs by hand: a believable SaaS ("Deskmoor") plus a callback collector ("Huginn"), 10 OOB classes (SSRF, SSTI, cmd-injection, XXE, stored/blind XSS, host-header to ATO, CSS-exfil, log4shell, deserialization, OOB SQLi), OOB-native CTF scoring, and DVWA-style difficulty tiers. Everything stays on the oob.range lab TLD inside Docker; nothing leaves the host.
Replays the interleaved valid/invalid login attack against a login endpoint you control and asserts the target account actually locks out. A regression test that the failure counter isn't being reset. Needs requests.
Detects username enumeration through account-lockout responses by comparing a real vs. a made-up account. Flags whether your login endpoint leaks which usernames exist. Needs requests.
Start or stop an AWS EC2 instance (toggle its state) via boto3. Handy for spinning a self-hosted password vault up and down to keep costs down. Needs boto3.
Safely toggle the /etc/nologin maintenance lockout, with a guardrail that warns before you lock yourself out when root SSH login is disabled.
Rewrite an entry in the binary /var/log/lastlog to simulate account inactivity. Handy for testing dormant-account detection in a fresh lab.
Lock a user account and append a timestamped entry to an audit log, with argument checking and success/failure reporting.
Prove a per-user nproc (process) limit is actually enforced by spawning processes until the cap trips, with logging to confirm the ceiling.
Compare md5 hashes between a primary and a shadow log and flag any mismatch. A cron-able tamper check that turns basic tooling into a lightweight SIEM primitive.
No matches — try a different search.
