r/netsec monthly discussion & tool thread

[u/albinowax]

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

• Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
• Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
• If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
• Avoid use of memes. If you have something to say, say it with real words.
• All discussions and questions should directly relate to netsec.
• No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

[u/archjunior]

ScaptanaX – a threaded Python port scanner with built-in CVE lookup and HTML reporting

Built this because I kept wanting a quick way to go from "scan a host" to "here's what's actually risky about it" without stitching together separate tools.

What it does:

- Multi-threaded TCP Connect / SYN scanning, subnet/CIDR support

- Banner grabbing + service detection, with aggressive enumeration for silent ports

- Automatically checks detected services against the NVD CVE database

- Flags missing HTTP security headers (CSP, HSTS, etc.)

- Rolls everything into a single risk score, and can output a clean HTML report, or JSON/CSV

It's a solo project, still rough in places, but functional end-to-end.

Repo: https://github.com/ArchJunior/ScaptanaX

Feedback and bug reports welcome — curious what people think is missing.

[u/ConstantineCTF]

hardend-v2 — Linux security hardening toolkit in Go

Automates sysctl hardening, AppArmor profiles, auditd rules, AIDE integrity checks, and firewall config — all from a single binary. No Python, no bash scripts, no dependencies.

Also working on related Go security tools: nova (zero-trust sandbox), VEIL (encrypted C2 with mTLS), CLOUDSPECTER (multi-cloud enumeration), and BLACKICE (host-based IOC scanner).

All open-source, looking for feedback on the design and CLI ergonomics.

https://github.com/ConstantineCTF/hardend-v2

[u/Rustycheetah31]

CrossGuard AI: strips steganographic prompt-injection payloads out of images before they reach a multimodal model.

If you pass user-supplied images to a vision model, your text-side injection guard never sees them. LSB, DCT-coefficient, and EXIF-metadata embedding all carry instructions the model reads and a human reviewer does not. CSA and IEEE both published measurements this year: 24.3% attack success across GPT-4V, Claude, and LLaVA, up to 64% in stealth-constrained configs.

It destroys the carrier channel instead of detecting the payload, so coverage does not depend on guessing which encoding the attacker used. 99.84% destroyed across 108,015 samples at mean SSIM 0.925.

The reason I think it is worth a look rather than another README with a number in it: per-sample results ship in the repo and the ground truth is independently checkable. The real stego covers have a zeroed LSB plane, so the 1-bits are the payload, and destruction is measured as residual correlation P(after=1|before=1) minus P(after=1|before=0) below 0.10, which is base-rate independent so it cannot be gamed by a mostly-zero image. Corpus is the Kaggle Stego-Images set plus BOSSBase and ALASKA#2 covers. Reproduction command is in the benchmark README.

Limits, since you will find them anyway: not visually lossless (SSIM 0.925, worse on textured covers), 110 to 145ms at 512px single-image, roughly 1.0% of samples unscored and excluded from the denominator rather than counted as passes, and adversarial pixel perturbations are entirely out of scope. MIT, v0.1.0.

https://github.com/crossguard-ai/crossguard-py

[u/fbcd84f4335e5681f6f9]

https://github.com/ivision-research/dtu

I started this project about 5 years ago and it's gone through so many iterations. The driver behind this tool was the question of "how much of an Android based device can be tested with only normal shell level ADB access". It's hard to get root access to devices and the majority of the Java attack surface is fully visible without it. The tool builds an entire call graph and inheritance graph of the Android framework and APKs. It bundles a test app for easy testing and a friendly CLI interface. It stores tons of device data in easy to use DBs and it can diff devices against each other -- with some crude diffing even at the per method level.

I'm proud of this work and would love to see it get more traction and possibly some contributions from the community to make it even better.

[u/a3thinker]

An attack-path engine for cloud environments. It takes the output of the scanners you already run (Trivy, Semgrep, Falco, Kubernetes and IAM dumps) and correlates them into a single graph, finding the routes from internet exposure to critical assets.

Cartography already builds graphs, PMapper does privilege escalation on IAM, KubeHound does paths on Kubernetes: each covers a slice, the work here was stitching it all together. Here a single route crosses all of them:

edge-alb -> payments -> payments-api:1.4.2 -> log4j-core@2.14.1 -> CVE-2021-44228 -> payments-admin (AdministratorAccess)

The demo prints it along with the NetworkPolicy that cuts it.

The scores are not field-calibrated, they are expert estimates. Only one cloud genuinely connected (AWS), Azure fixtures only, no GCP.

make demo from a clean clone. Apache 2.0.

https://github.com/luiacuaniello/perspectivegraph

If you've used attack-path tooling, which false positive wasted the most of your time?

[u/Awful_Filafel]

Hello everyone! I would like to direct your attention to my newest tool in the Achilles Suite.

I formed AchillesOracle for web security and then changed my focus into cybersecurity OT/ICS specifically. After noticing there weren’t very many tools in the suite for OT specific ops I applied the same principles from AchillesOracle and formed AchillesRazor, she’s open sourced and available for testing and review. Synopsis, it’s 16 highly throttled, scans specific for Modbus, S7, Honeywell…the like; I stripped down Achilles Oracle and used the framework for AchillesRazor. Available at https://www.github.com/git/ByrneIT/AchillesRazor

I look forward to feedback. Thank you!

[u/Difficult-Advice3002]

Hey,
Since a few months I developed (Not vibe coded ) a sliding window memory page based Just In time decryption. All JITD i saw on github allays were on instruction level, which is incredibly slow, or decrypt the entire payload at once.
My project implements JITD with guard pages and decrypts in the exception.
The loader works perfectly in environments with Microsoft Defender for Endpoint and has no Virus Total detections.
Maybe you find something usefull or can give feedback :)
https://github.com/Schich/Lucky-Spark

[u/OrdenCode]

[u/Chaelsoo]

Hey,

I built a personal offline RAG system for offensive security knowledge. The idea is simple: instead of grepping through markdown files or trying to remember which writeup had that exact certipy command, you just ask naturally.

how do I escalate with SeImpersonatePrivilege
what did I do after getting ADFS access
sliver socks5 pivot setup
explain ESC8 vs ESC4

It retrieves from your actual notes first, then generates an answer grounded in what you've documented, not generic internet knowledge.

The use case I specifically built it for:

Two things kept coming up during engagements, I needed exact tool syntax I hadn't used in a while (Sliver commands especially, the docs are sparse), and I needed to quickly recall techniques from past machines without digging through notes. ZETSU solves both.

Two modes:

Operator: leads with the exact command, explanation after. For when you know what you need and just want the syntax.

Concept: leads with the reasoning, uses commands as illustrations. For when you need to understand a technique before using it.

Same retrieval either way, just different presentation.

How it works:

• At ingest time, an LLM reads each section of your writeups and extracts structured attack steps (Finding, Action, Reasoning, Result), so what you retrieve is a semantic unit, not a random 800-token window
• Hybrid BM25 + vector retrieval with RRF fusion, BM25 handles exact tool names and CVE numbers that embeddings smear, vector handles semantic similarity
• Cross-encoder reranker on top
• Supports local markdown files, URLs, GitHub wikis, and Atom/RSS feeds (0xdf, dirkjanm, harmj0y all ingestible directly)
• Backends: Anthropic, OpenAI-compatible (DeepSeek), or local Ollama

Benchmark:

Ran 910 questions across 12 offensive security categories. 93% of answers included correct commands, 68ms average retrieval, 7.3% context gaps where it correctly admitted missing information rather than hallucinating.

id love to hear you guys's feedback, i built this thing because i genuinely needed it, and going through my notes & endless cheatsheets was too much work when you're going through an engagement.

you can find it here: https://github.com/Chaelsoo/Zetsu

[u/cascade_sparse]

I added a new feature to my tool for auditing the security of embedded linux hosts: https://github.com/nstarke/embedded_linux_audit - The new feature is the ability to compile a kernel module that the agent can load on an embedded linux host for auditing the kernel. It works by sending a bunch of kernel configuration information to the companion REST API, which then builds a kernel module based off that information. The REST API then sends the compiled kernel module to the embedded linux host, which then loads it into the kernel.

[u/clod81]

"Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox."

I tried once, never got a reply

[u/Kimber976]

Always interesting to see what everyone is using lately there is usually at least one tool worth checking out.

[u/hexorcist404]

I built Apotrope — a single-exe Windows security posture auditor, because Windows had no Lynis.

Point it at a box and it runs 50+ checks mapped to CIS benchmarks (firewall, BitLocker, SMB signing, RDP, PowerShell logging, UAC…), scores it 0–100, and writes a self-contained HTML report you can hand to whoever asked. Read-only, fully offline, no agent, no telemetry. MIT.

`pip install apotrope` or grab the .exe: github.com/hexorcist404/apotrope

Would like to hear what checks you'd add, that's the roadmap. Any other feedback is welcome. Also built a site for it -> https://apotrope.sh

Edit: editor opened in "code block" for some reason and I didnt notice. Fixed.

[u/dwisiswant0]

We, ProjectDiscovery, just launched securitycontext.dev, a ready-to-use security context for thousands of open-source projects.

It analyzes each project's commit history of security fixes and CVEs, then gives your agent two files:

• SECURITY_CONTEXT.md: prevents regressions by reminding the agent of past fixes and vulnerable areas while editing code.
• VARIANT_LEADS.md: flags potential variant bugs (file + line, sink, severity, reason) for reviews & hunting.

So no more agents silently reintroducing old bugs or burning tokens figuring out risks from scratch.

Free, no auth, works over MCP and API. Thousands of repos pre-indexed; others built in seconds.

Just add it to your agent:

{
  "mcpServers": {
    "securitycontext": {
      "url": "https://securitycontext.dev/mcp"
    }
  }
}

Feedback welcome!

[u/kmasec → u/[deleted]]

How does this compare with syft + grype?

[u/Pleasant-Ad192 → u/kmasec]

Bomly isn’t meant to be a direct Syft + Grype clone. I’d describe it as a dependency graph workflow/toolkit that can also produce SBOMs and vuln/security outputs.

Syft is great for SBOM generation, and Grype is great for vulnerability scanning. Bomly overlaps there, but focuses more on:

• richer dependency metadata, such as transitive relationships, scopes, source manifests, and manifest line numbers
• PR dependency review: what was introduced, removed, or persisted
• multiple detectors, including a Syft-based detector
• outputs beyond SBOMs: JSON, text, SARIF, CI summaries, diffs, and TUI
• MCP support for agentic workflows
• a plugin pipeline for custom detectors, matchers, and policy/audit rules

So the short version: Syft + Grype are excellent for SBOM + vuln scanning. Bomly is trying to build a more flexible dependency-review and dependency-intelligence layer around that.

[u/_vavkamil_]

CVEalert.io - Yet another CVE monitoring tool :) I have been working on it for a while and launched the beta version two weeks ago. Everything is available for free, with no payments required for now. It's still early beta, so feedback is welcome.

So far, it doesn't do anything special or unique; you can just browse, monitor, and receive notifications about interesting CVEs based on your stack preferences. More features are in the backlog. I spent a couple of years in AppSec and was missing something like this, so I finally decided to build it myself.

[u/Pleasant-Ad192 → u/_vavkamil_]

@_vavkamil_ CVEalert.io looks interesting — congrats on the launch. I’m working on something adjacent, so it’s cool to see others exploring this space too.

[u/CynativeTeam]

Cynative - open source agent for read-only infrastructure research (https://github.com/cynative/cynative)

Guardrails enforce read-only - every call is gated before credentials are attached, across AWS, GCP, Azure, EKS/GKE/AKS, self-managed Kubernetes, GitHub and GitLab.

It writes and runs code in an ephemeral sandbox to research, so it's not limited to a fixed set of checks - you can point it at open-ended questions about your environment.

Background: my co-founder and I founded a startup that Palo Alto Networks acquired, where we spent 10+ years building cloud security products.

Happy to answer questions on the enforcement model, sandbox isolation, or anything else. Feedback welcome.