cometadata/datacite-titles-descriptions-related-identifiers huggingface dataset:
DOI: 10.23721/100/1504382
title: Android Malware Genome Project

description: This project has managed to collect more than 1,200 malware samples that cover the majority of existing Android malware families, ranging from their debut in August 2010 to recent ones in October 2011. In addition, the samples are systematically characterized them from their various aspects, including their installation methods, activation mechanisms as well as the nature of carried malicious payloads. The characterization and a subsequent evolution-based study of representative families reveal that they are evolving rapidly to circumvent the detection from existing mobile anti-virus software. Based on the evaluation with four representative mobile security software, the experiments in November, 2011 show that the best case detects 79.6% of them while the worst case detects only 20.2% in the dataset. These results clearly call for the need to better develop next-generation anti-mobile-malware solution
DOI: 10.23721/100/1504388
title: diffy

description: Diffy is a digital forensics and incident response (DFIR) tool developed by Netflix's Security Intelligence and Response Team (SIRT). Diffy allows a forensic investigator to quickly scope a compromise across cloud instances during an incident, and triage those instances for followup actions. "Diffy" helps human investigators identify the differences between instances. Diffy is currently focused on Linux instances running within Amazon Web Services (AWS), but owing to our plugin structure, could support multiple platforms and cloud providers. Diffy is a differencing engine for digital forensics and incident response (DFIR) in the cloud. Collect data across multiple virtual machines and use variations from a baseline, and/or clustering, to scope a incident. Features: - Efficiently highlights outliers in security-relevant instance behavior. For example, you can use Diffy to tell you which of your instances are listening on an unexpected port, are running an unusual process, include a strange crontab entry, or have inserted a surprising kernel module. - Uses one, or both, of two methods to highlight differences: Collection of a "functional" baseline from a "clean" running instance, against which your instance group is compared, and Collection of a "clustered" baseline, in which all instances are surveyed, and outliers are made obvious. - Uses a modular plugin-based architecture. The program includes plugins for collection using osquery via AWS Systems Manager (formerly known as Simple Systems Manager or SSM).
DOI: 10.23721/100/1504389
title: Digital Forensics Artifact Repository

description: The first version of the artifact definitions originated from the GRR project, where it is used to describe and quickly collect data of interest, e.g. specific files or Windows Registry keys. The goal of the format is to provide a way to describe the majority of forensic artifacts in a language that is readable by humans and machines. The format is designed to be simple and straight forward, so that a digital forensic analysist is able to quickly write artifact definitions during an investigation without having to rely on complex standards or tooling. The format is intended to describe forensically-relevant data on a machine, while being tool agnostic. In particular we intentionally avoided adding IOC-like logic, or describing how the data should be collected since this various between tools. The artifact definitions are YAML -based. Understanding this format is the only requirement to be able to use the data. The Python code in this project is only used to validate all the artifacts to make sure they follow the specification. As of 2019-06-10 the repository contains 1013 file paths covered, 635 registry keys covered, and 525 total artifacts.
DOI: 10.23721/100/1504390
title: Turbinia

description: Turbinia is intended to automate running of common forensic processing tools (i.e. Plaso, TSK, strings, etc) to help with processing evidence in the Cloud, scaling the processing of large amounts of evidence, and decreasing response time by parallelizing processing where possible. Turbinia is composed of different components for the client, server and the workers. These components can be run in the Cloud, on local machines, or as a hybrid of both. The Turbinia client makes requests to process evidence to the Turbinia server. The Turbinia server creates logical jobs from these incoming user requests, which creates and schedules forensic processing tasks to be run by the workers. The evidence to be processed will be split up by the jobs when possible, and many tasks can be created in order to process the evidence in parallel. One or more workers run continuously to process tasks from the server. Any new evidence created or discovered by the tasks will be fed back into Turbinia for further processing. Communication from the client to the server is currently done with either Google Cloud PubSub or Kombu messaging. The worker implementation can use either PSQ (a Google Cloud PubSub Task Queue) or Celery for task scheduling.
DOI: 10.23721/100/1504391
title: Darknet Neural Network

description: Darknet apply a single neural network to the full image. This network divides the image into regions and predicts bounding boxes and probabilities for each region. These bounding boxes are weighted by the predicted probabilities. Darknet has several advantages over classifier-based systems. It looks at the whole image at test time so its predictions are informed by global context in the image. It also makes predictions with a single network evaluation unlike systems like R-CNN which require thousands for a single image. This makes it extremely fast, more than 1000x faster than R-CNN and 100x faster than Fast R-CNN.
DOI: 10.23721/100/1504363
title: tcpdump

description: Tcpdump uses libpcap, a system-independent interface for user-level packet capture. The program is loosely based on SMI's "etherfind" although none of the etherfind code remains. It was originally as part of an ongoing research project to investigate and improve tcp and internet gateway performance. The parts of the program originally taken from Sun's etherfind were later re-written. To insure that there would be no vestige of proprietary code in tcpdump, these pieces were written from the specification given by the manual entry, with no access to the source of tcpdump or etherfind.
DOI: 10.23721/100/1504392
title: Nishang

description: Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming. Nishang is useful during all phases of penetration testing.
DOI: 10.23721/100/1504393
title: Commando VM

description: Born from our popular FLARE VM that focuses on reverse engineering and malware analysis, the Complete Mandiant Offensive VM (“Commando VM”) comes with automated scripts to help build penetration testing environment and ease the process of VM provisioning and deployment. Penetration testers commonly use their own variants of Windows machines when assessing Active Directory environments. Commando VM was designed specifically to be the go-to platform for performing these internal penetration tests. The benefits of using a Windows machine include native support for Windows and Active Directory, using your VM as a staging area for C2 frameworks, browsing shares more easily (and interactively), and using tools such as PowerView and BloodHound without having to worry about placing output files on client assets. Commando VM uses Boxstarter, Chocolatey, and MyGet packages to install all of the software, and delivers many tools and utilities to support penetration testing. This list includes more than 140 tools, including: Nmap Wireshark Covenant Python Go Remote Server Administration Tools Sysinternals Mimikatz Burp-Suite x64dbg Hashcat With such versatility, Commando VM aims to be the de facto Windows machine for every penetration tester and red teamer. For the blue teamers reading this, don’t worry, we’ve got full blue team support as well! The versatile tool sets included in Commando VM provide blue teams with the tools necessary to audit their networks and improve their detection capabilities. With a library of offensive tools, it makes it easy for blue teams to keep up with offensive tooling and attack trends.
DOI: 10.23721/100/1504394
title: subfinder

description: SubFinder is a subdomain discovery tool that discovers valid subdomains for websites by using passive online sources. It has a simple modular architecture and has been aimed as a successor to sublist3r project. SubFinder uses Passive Sources, Search Engines, Pastebins, Internet Archives, etc to find subdomains and then it uses a permutation module inspired by altdns to generate permutations and resolve them quickly using a powerful bruteforcing engine. It can also perform plain bruteforce if needed. The tool is highly customizable, and the code is built with a modular approach in mind making it easy to add functionalities and remove errors
DOI: 10.23721/100/1504395
title: MailSniper

description: MailSniper also includes additional modules for password spraying, enumerating users/domains, gathering the Global Address List from OWA and EWS, and checking mailbox permissions for every Exchange user at an organization. A full list of options that can be used are: ExchHostname – The hostname of the Exchange server to connect to if Autodiscover is failing. Mailbox – Email address of the current user the PowerShell process is running as (i.e. the only mailbox the account can search). Terms – Certain terms to search through each email subject and body for. By default the script looks for “*password*”,”*creds*”,”*credentials*”. ExchangeVersion – In order to communicate with Exchange Web Services the correct version of Microsoft Exchange Server must be specified. By default this script tries “Exchange2010”. Additional options to try are Exchange2007_SP1, Exchange2010, Exchange2010_SP1, Exchange2010_SP2, Exchange2013, or Exchange2013_SP1. OutputCsv – Outputs the results of the search to a CSV file. MailsPerUser – The total number of latest emails to search through in the mailbox. The default is set to the latest 100 emails in the inbox.
DOI: 10.23721/100/1504396
title: Sparta

description: SPARTA is a python GUI application which simplifies network infrastructure penetration testing by aiding the penetration tester in the scanning and enumeration phase. It allows the tester to save time by having point-and-click access to his toolkit and by displaying all tool output in a convenient way. If little time is spent setting up commands and tools, more time can be spent focusing on analysing results. Despite the automation capabilities, the commands and tools used are fully customisable as each tester has his own methods, habits and preferences.
DOI: 10.23721/100/1504397
title: USBGuard

description: The USBGuard software framework helps to protect your computer against rogue USB devices (a.k.a. BadUSB) by implementing basic whitelisting and blacklisting capabilities based on device attributes. Features: - Rule language for writting USB device authorization policies - Daemon component with an IPC interface for dynamic interaction and policy enforcement - Command line and GUI interface to interact with a running USBGuard instance - C++ API for interacting with the daemon component implemented in a shared library Supported Operating Systems: Currently, USBGuard works only on Linux. To enforce the user-defined policy, it uses the USB device authorization feature implemented in the Linux kernel since 2007.
DOI: 10.23721/100/1504398
title: cowrie

description: Features Choose to run as an emulated shell (default): Fake filesystem with the ability to add/remove files. A full fake filesystem resembling a Debian 5.0 installation is included Possibility of adding fake file contents so the attacker can cat files such as /etc/passwd. Only minimal file contents are included Cowrie saves files downloaded with wget/curl or uploaded with SFTP and scp for later inspection Or proxy SSH and telnet to another system For both settings: Session logs are stored in an UML Compatible format for easy replay with the bin/playlog utility. SFTP and SCP support for file upload Support for SSH exec commands Logging of direct-tcp connection attempts (ssh proxying) Forward SMTP connections to SMTP Honeypot (e.g. mailoney) JSON logging for easy processing in log management solutions
DOI: 10.23721/100/1504399
title: kippo

description: Features of Kippo: -Fake filesystem with the ability to add/remove files. A full fake filesystem resembling a Debian 5.0 installation is included -Possibility of adding fake file contents so the attacker can 'cat' files such as /etc/passwd. Only minimal file contents are included -Session logs stored in an UML Compatible format for easy replay with original timings -Just like Kojoney, Kippo saves files downloaded with wget for later inspection Trickery; ssh pretends to connect somewhere, exit doesn't really exit, etc
DOI: 10.6073/pasta/ace475607c93dba8b94b1936bdea6b69
title: MCR LTER: Coral Reef: Ocean Currents and Biogeochemistry: salinity, temperature and current at CTD and ADCP mooring FOR05 from 2005 ongoing

description: Moored and bottom mounted instrumentation (ADCP, CTD, thermistors, wave-tide meters) sampled year-round on the reef of Moorea Island, French Polynesia at site FOR05. Sampling began in 2005. All data have been interpolated onto a 20 min grid. ADCP data are orgainized into 1-meter bins, measured as height from the bottom, to a maximum of 20 bins. All bins may not be filled, and although post processing attempted to exclude data from bins 'above the surface', users need to exercise caution with the near surface bins. CTD parameters include Pressure, Temperature, Conductivity, Salinity and Density. The two moored CTD packages are located approximately 5 and 14 meters above the bottom, and there are up to 5 additional temperature thermistors spaced vertically along the mooring line and 2 bottom mounted thermistors in the vicinity of the mooring at 10 and 20 meter depth. A bottom mounted wave-tide meter provides a measure of significant wave height and dominant wave period at a 2 hour sampling interval. Tide related data may be calculated from bottom-mounted pressure sensor data. This material is based upon work supported by the U.S. National Science Foundation under Grant No. OCE 16-37396 (and earlier awards) as well as a generous gift from the Gordon and Betty Moore Foundation. Research was completed under permits issued by the French Polynesian Government (Délégation à la Recherche) and the Haut-commissariat de la République en Polynésie Francaise (DTRT) (Protocole d'Accueil 2005-2018). This work represents a contribution of the Moorea Coral Reef (MCR) LTER Site.
DOI: 10.23721/100/1504400
title: conpot

description: ConpotFS designed to have “safe to use” os.* wrappers that could be used by protocols. We cannot allow chmod() like commands that may allow attackers to make arbitrary system calls. At the same time - protocols such as FTP need chmod() like methods. Same goes for stat() etc. For this reason, we needed a file system that can operate on a layer above the actual file system and still provide the flexibility/robustness. The Conpot’s file system solves this problem by proxying the actual files kept at a controlled location.
DOI: 10.23721/100/1504401
title: Honeytrap Opensource System

description: Features of HoneyTrap: Combine multiple services to one honeypot, eg a LAMP server Honeytrap Agent will download the configuration from the Honeytrap Server Use the Honeytrap Agent to redirect traffic out of the network to a seperate network Deploy a large amount agents while having one Honeytrap Server, configuration will be downloaded automatically and logging centralized Payload detection to determine which service should handle the request, one port can handle multiple protocols Monitor lateral movement within your network with the Sensor listener. The sensor will complete the handshake (in case of tcp), and store the payload Create high interaction honeypots using the LXC or remote hosts directors, traffic will be man-in-the-middle proxied, while information will be extracted Extend honeytrap with existing honeypots (like cowrie or glutton), while using the logging and listening framework of Honeytrap Advanced logging system with filtering and logging to Elasticsearch, Kafka, Splunk, Raven, File or Console Services are easily extensible and will extract as much information as possible Low- to high interaction Honeypots, where connections will be upgraded seamless to high interaction
DOI: 10.23721/100/1504402
title: Justniffer

description: Justniffer can emulate Apache web server log files, track response times and extract all "intercepted" files from the HTTP traffic. It lets you interactively trace tcp traffic from a live network or from a previously saved capture file. Justniffer's native capture file format is libpcap format, which is also the format used by tcpdump and various other tools. Justniffer captures reassembles and reorders TCP packets, performs IP packet defragmentation and displays the tcp flow in the standard output. It is useful for logging network traffic in a 'standard' (web server like) or in a customized way. It can log network services performances (e.g. web server response time , application server keep alive behaviour, etc.). Output format can be customized using the log format option.
DOI: 10.23721/100/1504404
title: Moloch

description: Moloch augments your current security infrastructure to store and index network traffic in standard PCAP format, providing fast, indexed access. An intuitive and simple web interface is provided for PCAP browsing, searching, and exporting. Moloch exposes APIs which allow for PCAP data and JSON formatted session data to be downloaded and consumed directly. Moloch stores and exports all packets in standard PCAP format, allowing you to also use your favorite PCAP ingesting tools, such as wireshark, during your analysis workflow. Moloch is built to be deployed across many systems and can scale to handle tens of gigabits/sec of traffic. PCAP retention is based on available sensor disk space. Metadata retention is based on the Elasticsearch cluster scale. Both can be increased at anytime and are under your complete control.
DOI: 10.23721/100/1504405
title: Nmap

description: Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and official binary packages are available for Linux, Windows, and Mac OS X. In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced GUI and results viewer (Zenmap), a flexible data transfer, redirection, and debugging tool (Ncat), a utility for comparing scan results (Ndiff), and a packet generation and response analysis tool (Nping).
DOI: 10.23721/100/1504406
title: openssl

description: The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, fully featured, and Open Source toolkit implementing the Transport Layer Security (TLS) protocols (including SSLv3) as well as a full-strength general purpose cryptographic library. The OpenSSL toolkit includes: libssl (with platform specific naming): Provides the client and server-side implementations for SSLv3 and TLS. libcrypto (with platform specific naming): Provides general cryptographic and X.509 support needed by SSL/TLS but not logically part of it. openssl: A command line tool that can be used for: Creation of key parameters Creation of X.509 certificates, CSRs and CRLs Calculation of message digests Encryption and decryption SSL/TLS client and server tests Handling of S/MIME signed or encrypted mail And more...
DOI: 10.23721/100/1504407
title: Infection Monkey

description: The Infection Monkey is an attack simulation tool designed to test networks against attackers. A self-propagating testing tool, it identifies and visualizes attack paths in your network and provides actionable steps to mitigate and stop attacks.The Infection Monkey is an open source security tool that tests a data center's resiliency to perimeter breaches and internal server infection. The Monkey uses various methods to self propagate across a data center and reports success to a centralized Monkey Island server.
DOI: 10.23721/100/1504408
title: PhishTank

description: PhishTank is a collaborative clearing house for data and information about phishing on the Internet. Also, PhishTank provides an open API for developers and researchers to integrate anti-phishing data into their applications at no charge.
DOI: 10.23721/100/1504409
title: Wireshark

description: Wireshark lets you see what’s happening on your network at a microscopic level and is the standard across many commercial and non-profit enterprises, government agencies, and educational institutions. Wireshark has a rich feature set which includes the following: - Deep inspection of hundreds of protocols, with more being added all the time - Live capture and offline analysis - Standard three-pane packet browser - Multi-platform: Runs on Windows, Linux, macOS, Solaris, FreeBSD, NetBSD, and many others - Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility - The most powerful display filters in the industry - Rich VoIP analysis - Read/write many different capture file formats: tcpdump (libpcap), Pcap NG, Catapult DCT2000, Cisco Secure IDS iplog, Microsoft Network Monitor, Network General Sniffer® (compressed and uncompressed), Sniffer® Pro, and NetXray®, Network Instruments Observer, NetScreen snoop, Novell LANalyzer, RADCOM WAN/LAN Analyzer, Shomiti/Finisar Surveyor, Tektronix K12xx, Visual Networks Visual UpTime, WildPackets EtherPeek/TokenPeek/AiroPeek, and many others - Capture files compressed with gzip can be decompressed on the fly - Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platform) - Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2 - Coloring rules can be applied to the packet list for quick, intuitive analysis - Output can be exported to XML, PostScript®, CSV, or plain text