cyber-port - Root index for the k1N Cyber Port cybersecurity po

项目说明

Cyber Port

A public cybersecurity portfolio by Hiago Kin Levi — a curated collection of 13 open-source repositories co defensi, cloud security, De, AI security, and more.

All repositories are free to use, adapt, and share under CC BY 4.0 with attribution.

---

Provide professionals, students, and security teams with production-quality, modular, and well-documented tools that cover the full spectrum of modern defensi — from honeypots to incident response, from WAF rules to AI guardrails.

E published here is strictly defensi, and ethical.

---

Portfolio Index

Threat Detection & Response

| Repository | Description | Maturity |
|------------|-------------|----------|
| honeypot-foundry | Defensi servers: SSH/HTTP/API/FTP/RDP obser, credential masking, spray/stuffing/burst detection, and live SIEM transport delivery for Splunk HEC, Elastic bulk, and CEF/syslog relays | Acti |
| dfir-attack-lab | DFIR triage: Linux/macOS/Windows collectors, auth.log + Windows Event Log parsers, installable k1n-dfir CLI, timeline builder with HTML/CSV/JSON/JSONL/TXT export, case packager | Acti |
| ir-playbooks-automation | IR playbooks, containment/eradication/recovery workflows, safe automations (EC2 isolation, forensic snapshots), SLA tracking | Acti |

Application & Web Security

| Repository | Description | Maturity |
|------------|-------------|----------|
| waf-defense-rulepacks | WAF rulesets for Cloudflare, AWS WAF, Azure WAF — SQLi/XSS/SSRF/LFI/command-injection/Log4Shell packs, OWASP co analyzer, per-IP/per-path rate-limiting rulepack, ModSecurity CRS compatibility layer, rule test harness | Acti |
| secure-pipeline-blueprints | Secure CI/CD blueprints for GitHub Actions, GitLab CI, Azure DevOps — SAST, SCA, secret scanning, IaC scanning, pipeline security auditor (PA001-PA008) | Acti |
| offensi | management lifecycle, pentest go, rules of engagement, e templates, remediation workflows, signed risk-acceptance go workflow | Acti |

Cloud & Infrastructure Security

| Repository | Description | Maturity |
|------------|-------------|----------|
| cloud-posture-watch | Cloud security posture for AWS, Azure, GCP — storage exposure, network exposure (SG/NSG analysis), logging gaps, drift detection | Acti |
| iam-audit-lab | IAM audit across AWS, Azure, GCP, Entra — excessi, MFA co, inacti, trust policy analyzer, posture score 0-100 | Acti |
| container-defense-stack | Docker hardening, secure K8s manifests, OPA/Gatekeeper admission policies, Helm chart scanner, RBAC baselines | Acti |

Identity, Secrets & Monitoring

| Repository | Description | Maturity |
|------------|-------------|----------|
| secret-leak-sentinel | Secret detection in code, CI logs, configs — regex + entropy detectors, CI artifact scanner, pre-commit + pre-push hooks | Acti |
| phishing-surface-monitor | Brand protection: typosquatting detection, CT log monitoring (crt.sh), MX/SPF/DMARC gap detection, takedown e packages, registrar/ICANN templates, and case tracking | Acti |

AI & Cryptography Security

| Repository | Description | Maturity |
|------------|-------------|----------|
| ai-security-guardrails | Security guardrails for LLM apps, agents, RAG — prompt injection detector (14 rules), RAG source , input/output filtering, policy engine | Acti |
| cryptologik | Crypto posture: TLS checker, anti-patterns detector (MD5/ECB/hardcoded keys), smart contract SWC top-10 checker (SWC-100/101/103/105/106/107/111/113/115/128), CVSS v3.1 risk scoring integration | Acti |

---

Maturity Model

Each repository follows a defined maturity progression:

| Stage | Description |
|-------|-------------|
| Planned | Scoped but not started |
| Bootstrap | Initial structure and core modules in place |
| Acti | Core complete, modules expanding |
| Operational | Production-ready, tested, documented |
| Mature | Stable, feature-complete, community-ready |

---

Go

13 permanent base repositories. No new repos will be created.

New content always goes *inside* one of the 13 existing repositories as a module, script, template, playbook, or training material. This keeps the portfolio coherent, na, and professionally maintained.

See CATEGORIES.md for the full taxonomy and STANDARDS.md for contribution and code standards.

Li completion tracking is published in PORTFOLIO_STATUS.md.
The execution policy for finishing the portfolio lives in COMPLETION_STRATEGY.md.

---

How to Contribute

1. Read CONTRIBUTING.md and CODE_OF_CONDUCT.md
2. Choose the repository that matches your contribution domain
3. Open an issue first for significant additions
4. Submit a PR with tests and documentation

All contributions must be in English, strictly defensive, and meet the professional standards defined in STANDARDS.md.

---

Ethical Disclaimer

All tools and content in this portfolio are designed exclusively for authorized, defensi work. Never use these tools against systems you do not own or ha written permission to test or monitor. Unauthorized access to computer systems is illegal. Always compliance with applicable laws and organizational policies before deployment.

---

E Log

Detailed cycle memory and the current rotation queue live in MEMORY.md.

| Cycle | Date | Changes |
|-------|------|---------|
| Cycle 1 | 2026-04-06 | Bootstrap: all 13 repos created with initial production scaffold, CC BY 4.0 license applied |
| Cycle 2 | 2026-04-06 | Depth: API decoy + SIEM adapters (honeypot), Windows parser + case packager (dfir), TLS checker + anti-patterns detector (cryptologik) |
| Cycle 3 | 2026-04-06 | Expand: CVSS v3.1 calculator (offensi), CT log monitor + MX/SPF/DMARC checker (phishing), OPA policies + Helm scanner (container), SLA tracker + forensic snapshot (ir-playbooks) |
| Cycle 4 | 2026-04-06 | Deepen: WAF co analyzer + SSRF/LFI/Log4Shell packs (waf), prompt injection detector + RAG security (ai-guardrails), network exposure analyzer + SG collector (cloud-posture), CI artifact scanner + pre-push hook (secret-sentinel) |
| Cycle 5 | 2026-04-06 | Mature: IAM trust policy analyzer + posture scorer 0-100 (iam-audit-lab), GitHub Actions security auditor PA001-PA008 + Azure DevOps blueprint (secure-pipeline), macOS triage collector + timeline reporter with HTML/JSONL/TXT export (dfir), SSH credential pattern analyzer — spray/stuffing/burst detection (honeypot) |
| Cycle 6 | 2026-04-06 | Deepen: Azure NSG exposure analyzer NET-AZ-001–005 + cross-cloud storage public-access checker STG-PUB-001–007 (cloud-posture), e bundle generator + SLA escalation report with 4 tiers ON_TRACK/WARNING/BREACHED/CRITICAL_BREACH (offensi), SWC top-10 smart contract checker SWC-103/106/111/113/128 + CVSS v3.1 risk scoring integration (cryptologik), per-IP/per-path rate-limiting rulepack for Cloudflare/AWS/Azure + ModSecurity CRS compatibility layer + WAF rule test harness (waf-defense-rulepacks) |
| Cycle 7 | 2026-04-06 | Expand: JSON/HTML posture-report CLI with --fail-on se gate (cloud-posture), lifecycle state machine with 14 allowed transitions + CLI (offensi), composable LLM output filtering pipeline — SecretLeakStage/PiiRedactionStage/SystemPromptLeakStage/InternalNetworkStage/Policy with BLOCK short-circuit and cumulative risk score (ai-guardrails), Azure automation with deny-all NSG + dry_run safety + restore_azure_vm() rollback + IR runbook cross-reference engine (ir-playbooks) |
| Cycle 8 | 2026-04-06 | Monitor & Enrich: Slack/PagerDuty webhook alerting + self-contained HTML report + UTF-8 CS (secret-sentinel), alert dedup engine with configurable window/max_group_size + suppression rules + IP geo-enrichment (MaxMind/stub) + dashboard JSON metrics with time-window filtering (honeypot), MITRE ATT&CK auto-mapper (35 action→technique entries + keyword fallback) + timeline diff engine with sub-second stability (dfir), IAM posture drift detection with 9 change types and signed risk_delta (iam-audit-lab) |
| Cycle 9 | 2026-04-06 | Integration & CLI: multi-cloud unified scan runner + k1n-posture scan command with --pro/--fail-on/--dry-run (cloud-posture), Nginx/ModSec rate-limit config stubs + waf-export CLI with 5- export (waf-defense-rulepacks), GitLab CI security auditor GL-001–GL-008 mirroring GitHub Actions PA001–PA009 (secure-pipeline-blueprints), takedown e ZIP package generator + Slack/generic domain alert webhooks (phishing-surface-monitor) |
| Cycle 10 | 2026-04-06 | Operational Hardening: Falco-style runtime threat detection (14 built-in rules: shell spawn/pri container/sensitive file/container escape/crypto mining/K8s API enumeration) + Kubernetes RBAC auditor RBAC-001–007 (container-defense-stack), GCP firewall tags + AWS Lambda quarantine =0 + MITRE ATT&CK auto-tagger (28 keyword patterns, 8 incident types, IoC hints) (ir-playbooks-automation), NVD API v2.0 C pipeline + correlate_c() mismatch detection + pentest ScopeDocument with exclusions/port restrictions/time window (offensi), key rotation advisor ROT-001–006 (7 key types, max-age table, warning window) + JWT security checker JWT-001–009 (alg=none/short HMAC/missing exp/nbf/iat/iss/aud/jti) with raw token decoder (cryptologik) |
| Cycle 11 | 2026-04-06 | Intelligence & Go: threat intel feed enricher (ThreatIntelEnricher with exact-IP O(1) + CIDR lookup, TTL expiry, 4 feed parsers: ip_list/cs/stix2_json) (honeypot-foundry), read-only Docker container forensics collector (inspect/processes/network/filesystem-diff/logs/mounts/security_context with env-, dry_run=True) (dfir-attack-lab), deny-by-default agent tool call policy enforcer (ToolPolicyEngine with per-session rate limiting, blocked/redact arg patterns, audit log) (ai-security-guardrails), secret suppression go (SuppressionRule with fnmatch glob + fingerprint matching + ISO expiry + SuppressionStore with JSON persistence + audit reporting) (secret-leak-sentinel) |
| Cycle 12 | 2026-04-06 | Pattern Detection & Analysis: attack session reconstructor (groups honeypot events by IP + idle timeout, classifies RECON/SPRAY/STUFFING/BRUTE_FORCE/EXPLOITATION, scores 0–100) (honeypot-foundry), cross-source log correlation engine (7 patterns: BRUTE_THEN_SUCCESS/SPRAY_THEN_PI/PERSISTENCE/RECON_THEN_EXPLOIT/ANOMALOUS_TIME across auth.log + EVTX + container logs with per-incident confidence 0–1) (dfir-attack-lab), multi-turn jailbreak detector (6 patterns: INSTRUCTION_DRIFT/PERSONA_REPLACEMENT/AUTHORITY_ESCALATION/ROLEPLAY_EXPLOITATION/REPETITION_PRESSURE/CONTEXT_INJECTION, risk score + CRITICAL/HIGH/MEDIUM levels) (ai-security-guardrails), secret scan baseline tracker (SHA-256 fingerprint persistence, diff engine new/resol, CI fail-on-new-secrets gate) (secret-leak-sentinel) |
| Cycle 13 | 2026-04-06 | Beha Intelligence: beha scanner fingerprinting (SHODAN/MASSCAN/ZGRAB/METASPLOIT/CREDENTIAL_STUFFING_BOT/CUSTOM_SCRIPT/HUMAN classification via UA patterns + timing + credential pairs) (honeypot-foundry), lateral mo graph tracker (SEQUENTIAL_HOP/MULTI_HOP_CHAIN/FAN_OUT/CREDENTIAL_REUSE patterns, only successful auth events form graph edges) (dfir-attack-lab), token budget guard + context stuffing detector (per-turn/per-session hard limits + anomaly WARN at N× session a, stateless repeated-block/char-run/whitespace detection) (ai-security-guardrails), multi-detector finding deduplicator (union-find o grouping by fingerprint/rule_id/line-range, probability-union confidence, max se, longest e) (secret-leak-sentinel) |
| Cycle 14 | 2026-04-06 | Deep Co: AWS CloudTrail logging gap analyzer CT-001–CT-008 (trail disabled//single-region/global-events/MFA-delete/KMS/CloudWatch/management-events, risk score 0–100) (cloud-posture-watch), IAM permission boundary analyzer PB-001–PB-005 (missing boundary, wildcard sensiti, trust policy enforcement, deleted policy reference, overly permissive) (iam-audit-lab), API security rulepack API-AUTH/BOLA/INJECT/VERB/EXPOSE/RATE — 10 rules for auth bypass/IDOR/GraphQL/SSTI//burst (waf-defense-rulepacks), Dockerfile security auditor DF-001–DF-010 (root execution/unpinned images/secret vars/ADD-URL/un packages/curl-pipe-bash/HEALTHCHECK/cap-add/chown/digest) (secure-pipeline-blueprints) |
| Cycle 15 | 2026-04-06 | Intelligence & Detection: lookalike domain risk scorer with 8 signals (leet/homoglyph/keyboard-proximity/edit-distance/suspicious-TLD/brand-as-subdomain/embedded/punycode, score 0–100) (phishing-surface-monitor), Certificate Transparency abuse detector CT-ABU-001–007 (mass issuance/wildcard-TLD/SAN-count/brand-keyword//untrusted-issuer/new-domain) (cryptologik), Linux process memory artifact collector MA-001–007 (anonymous-exec-mapping/deleted-backing/world-writable/name-mismatch/suspicious-parent/deleted-exe/high-entropy, dry_run mode) (dfir-attack-lab), container image layer security scanner LAY-001–007 (secrets-in-history/cache-bloat/sensiti/SUID-SGID/layer-count/layer-size/fetch-no-checksum) (container-defense-stack) |
| Cycle 16 | 2026-04-06 | Protocol Decoys & Tooling: MySQL/Redis protocol decoy handlers (MySQLDecoy greeting+auth capture, RedisDecoy RESP+inline parser, password masked to SHA-256[:16], 68 tests) (honeypot-foundry), PCAP e capture trigger (PcapTrigger wrapping tcpdump/tshark, dry_run=True default, bounded by max_seconds/max_packets, CaptureResult pipeline, 43 tests) (ir-playbooks-automation), bot detection rulepack BOT-UA-001–004/BOT-CS-001/BOT-SC-001–002/BOT-ENV-001 (headless browser/scanner/missing-UA/long-UA/cred-stuffing/scraper/missing-fingerprint-headers, 65 tests) (waf-defense-rulepacks), STRIDE threat modeling module (11 component + 7 data-flow checks, all 6 STRIDE categories, ThreatFinding with risk_score, include_low_se filter, 60 tests) (offensi) |
| Cycle 17 | 2026-04-06 | Registry & Cloud Hardening: Windows registry persistence detector REG-P-001–007 (Run/RunOnce/RunServices/startup-folder/ser/IFEO-hijack/AppInit_DLLs/Winlogon-userinit-shell, RegistrySnapshot input model, 49 tests) (dfir-attack-lab), model exfiltration detector EXF-001–006 (training-data/system-prompt/membership-inference/weight-extraction/few-shot/credential, proximity regex, ExfiltrationResult, 51 tests) (ai-security-guardrails), S3 bucket policy analyzer S3-PUB-001–002/S3-XACCT-001/S3-ENC-001/S3-TLS-001/S3-LOG-001/S3- (public-principal/ACL/cross-account/encrypt-deny/TLS-deny/logging/, analyze_many(), 45 tests) (cloud-posture-watch), git history scanner (CommitSnapshot offline mode, 8 rules AWS/GitHub/Stripe/Slack/PEM/password, binary skip, fingerprint dedup, 44 tests) (secret-leak-sentinel) |
| Cycle 18 | 2026-04-06 | Domain & Protocol Intelligence: WHOIS domain age risk scorer with 6 signals (new-domain/no-reg-date/expiry-soon/pri/high-risk-country/short-registration-period, score 0–100, CRITICAL/HIGH/MEDIUM/LOW/INFO, 69 tests) (phishing-surface-monitor), Kubernetes NetworkPolicy analyzer NP-001–NP-007 (ingress/egress co gaps, allow-all selectors, overly broad namespaceSelector, no ports restriction, 49 tests) (container-defense-stack), AWS SCP analyzer SCP-001–SCP-007 (allow-star/missing root-deny/cloudtrail-deny/org-lea guardrails, wildcard resources, NotAction patterns, cross-policy guardrail checks, 56 tests) (iam-audit-lab), TLS certificate chain TLS-CV-001–TLS-CV-008 (weak sig algo/expired/expiry-warning/self-signed-non-root/incomplete-chain/CN-SAN-mismatch/broad-wildcard/short-key, 75 tests) (cryptologik) |
| Cycle 19 | 2026-04-06 | Host & Protocol Defense: Network connection anomaly analyzer NC-001–NC-007 (suspicious ports/excessi/DGA entropy/crypto-mining pools/Tor/listening count/lateral mo SMB-WinRM-RDP, RFC1918 helper, 98 tests) (dfir-attack-lab), Kubernetes Pod Security Standards analyzer PSS-001–PSS-008 (root/pri/privesc/host-namespaces/dangerous-caps/hostPath/readonly-root/latest-tag, Pod+Deployment+StatefulSet+DaemonSet+Job+CronJob, 93 tests) (container-defense-stack), IR timeline builder (chronological sort, gap detection, auto-phase split, e/by_source/by_type, accumulation API, 86 tests) (ir-playbooks-automation), HTTP security header analyzer HDR-001–HDR-010 (HSTS/max-age/CSP/X-Frame-Options/nosniff/Referrer-Policy/Ser/X-Powered-By/Permissions-Policy/unsafe-inline, e(), 102 tests) (waf-defense-rulepacks) |
| Cycle 20 | 2026-04-06 | Deception & Supply Chain: Canary token generator (HTTP_URL/API_KEY/CRED_PAIR/ENV_ types, CanaryRegistry with create/trigger/export/stats, SHA-256 fingerprinting, 72 tests) (honeypot-foundry), Dependency confusion attack detector DC-001–DC-006 (internal-keyword naming/suspicious /registry URLs/company patterns/unpinned /short names, parse_requirements_txt(), 106 tests) (secure-pipeline-blueprints), Entropy-based secret scanner ENT-001–ENT-004 (high-entropy hex/base64/alphanumeric/keyword-adjacent, Shannon entropy, candidate extraction, dedup, scan_texts() batch, 95 tests) (secret-leak-sentinel), triage scorer (C/exploitability/exposure/age/patch composite 0–100, P1–P5 priority tiers, score_many/top_n/by_tier, 82 tests) (offensi) |
| Cycle 21 | 2026-04-06 | Cloud, AI & Phishing Intelligence: GCP IAM analyzer GCP-IAM-001–007 (primiti/allUsers/SA-owner/external-member/default-SA/key-age/broad-admin-roles, from_dict(), 88 tests) (cloud-posture-watch), RAG document poisoning detector RAG-P-001–007 (instruction-o/persona-injection/system-prompt-extraction/authority-spoofing/hidden-text/base64-payload/delimiter-injection, 98 tests) (ai-security-guardrails), IP geolocation risk alerter GEO-001–005 (high-risk-country/hosting-ASN/anonymizer-ASN/Tor-exit/ASN-burst, e() with state, 92 tests) (honeypot-foundry), Email header phishing analyzer EH-001–008 (SPF/DKIM/DMARC/Reply-To-mismatch/brand-impersonation/suspicious-mailer/hop-count/disposable-TLD, 84 tests) (phishing-surface-monitor) |
| Cycle 22 | 2026-04-06 | Beha & Protocol Depth: Process tree analyzer PT-001–PT-007 (suspicious parent-child/process-masquerade/LOLBins/unusual-shell/empty-cmdline/process-bomb/attacker-tools, 104 tests) (dfir-attack-lab), IR SLA tracker ON_TRACK/WARNING/BREACHED/CRITICAL_BREACH P1-P5 tiers with detect/respond/resol, sla_score 0-100, escalation messages, e(), 77 tests (ir-playbooks-automation), Rate limit policy generator Cloudflare/AWS-WAF/Nginx export IP/header/cookie/query match keys block/challenge/log actions () from_dict_list(), 100 tests (waf-defense-rulepacks), JWT attack detector JWT-ATK-001–007 (alg-confusion/none-alg/embedded-JWK/KID-injection/long-token/timing-anomaly/suspicious-iss) filter_attacks(), 80 tests (cryptologik) |
| Cycle 23 | 2026-04-06 | Credential Protection & Cloud Identity: Pre-commit secret scanning hook SC-001–SC-006 (AWS-key/GitHub-token/pri/password-assignment/API-key/Stripe-li ordering, skip_paths/extensions, allow_list, fail_on_se threshold, 97 tests) (secret-leak-sentinel), Con memory inspector MEM-001–006 (PII/credential accumulation/instruction-persistence/cross-session/memory-size/repeated-tool-calls/base64-scratchpad, 90 tests) (ai-security-guardrails), SSH credential classifier DEFAULT_CREDENTIAL/DICTIONARY_WORD/TARGETED_USER/SER/CREDENTIAL_STUFFING/RANDOM_JUNK (priority chain, 23 default pairs, confidence scoring, 84 tests) (honeypot-foundry), Azure AD security analyzer AAD-001–007 (MFA-pri/legacy-auth/guest-pri/non-PIM/no-CA-MFA/SP-secret-age/guest-ratio, 91 tests) (cloud-posture-watch) |
| Cycle 24 | 2026-04-06 | Multi-Cloud Infrastructure Hardening: IaC security scanner IAC-001–007 (public-storage/open-SG/unencrypted/hardcoded-creds/admin-without-MFA/permissi/missing-tags, AWS+Azure+GCP, scan_many(), 129 tests) (secure-pipeline-blueprints), K8s RBAC gap analyzer RBAC-GAP-001–007 (cluster-admin-binding/wildcard-verbs/wildcard-resources/secrets-read/default-SA/escalation-verbs/system:masters, pri detection, 104 tests) (container-defense-stack), Azure RBAC analyzer AZ-RBAC-001–007 (Owner/Contributor-at-subscription/classic-admin/SP-owner/guest-pri/non-PIM-direct/wildcard-custom-role/management-group-scope, PIM-aware, 110 tests) (iam-audit-lab), DNS change monitor DNS-MON-001–007 (MX/NS-change/A-record-drift/new-CNAME/DNSSEC-remo/suspicious-subdomain, DGA entropy, compare_many(), 133 tests) (phishing-surface-monitor) |
| Cycle 25 | 2026-04-06 | Supply Chain, API & IR Enrichment: SBOM security analyzer SBOM-001–007 (critical-C/copyleft-license/outdated/untrusted-registry/duplicate-/transiti, multi-ecosystem, 123 tests) (secure-pipeline-blueprints), K8s admission webhook analyzer ADMS-001–007 (fails-open/no-NS-selector/mutating-no-timeout/TLS-insecure/no-pod-co/missing-CA/side-effects, global-co, 114 tests) (container-defense-stack), GraphQL WAF rulepack GQL-001–007 (depth-limit/batch-abuse/introspection/field-duplication/alias-abuse/directi/, block_on_se, 135 tests) (waf-defense-rulepacks), IOC enrichment/correlation engine 7 types (IP/domain/hash/URL/email/registry/process, domain-suffix matching, recursi flattening, co metrics, 116 tests) (ir-playbooks-automation) |
| Cycle 26 | 2026-04-06 | Pipeline & Container Secret Hardening: CI/CD pipeline secret scanner PIPE-001–007 (AWS-key/GitHub-GitLab-token/base64-binary/curl-secrets/unmasked-en/SSH-key, scan_pipeline() API, 115 tests) (secure-pipeline-blueprints), K8s secret analyzer SV-001–007 (en/sensiti/secret-in-command/SA-automount/multi-container-shared/default-SA/root-home-mount, 108 tests) (container-defense-stack), XML WAF rulepack XML-001–007 (XXE/XML-bomb/DTD-external/CDATA-script/o/XSLT/namespace-poisoning, regex-only, 115 tests) (waf-defense-rulepacks), Subdomain takeo STKO-001–007 (dangling-CNAME/li/dangling-NS/dangling-A/CNAME-chain/cloud-IP/de, 25 services, 140 tests) (phishing-surface-monitor) |
| Cycle 27 | 2026-04-06 | Integrity, Quotas & Impersonation: Artifact integrity checker ART-001–007 (missing-checksum/weak-hash/un/SLSA-le/age/checksum-mismatch, 121 tests) (secure-pipeline-blueprints), K8s resource quota analyzer RQ-001–007 (no-requests/no-limits/excessi/excessi/no-NS-quota/critical-NS/init-container, memory+cpu parsers, 132 tests) (container-defense-stack), SSRF protection rulepack SSRF-001–007 (RFC1918/loopback/cloud-metadata/DNS-rebinding/dangerous-scheme/URL-shortener/internal-hostname, 143 tests) (waf-defense-rulepacks), Brand impersonation detector BRD-001–007 (homoglyph/brand-embedded/suspicious-TLD/punycode/keyboard-proximity/action-word/numeric-substitution, Unicode NFKC, 140 tests) (phishing-surface-monitor) |
| Cycle 28 | 2026-04-06 | Signing, Ingress & Crypto Policies: Container image signing SIGN-001–007 (no-signatures/untrusted-signer/un/missing-SBOM/missing-/expired/mutable-tag, OCI attestations, 95 tests) (secure-pipeline-blueprints), K8s Ingress security analyzer ING-001–007 (no-TLS/no-redirect/wildcard-host/pri/no-auth/CORS-wildcard/default-NS, multi-controller, 121 tests) (container-defense-stack), LFI/RFI rulepack LFI-001–007 (path-tra/null-byte/PHP-wrappers/RFI/URL-encoded/double-encoded/OS-file-targets, stdlib-only, 135 tests) (waf-defense-rulepacks), Password policy analyzer PWD-001–007 (min-length/complexity/expiry/lockout/history/insecure-hash/no-MFA, work-factor checks, 135 tests) (cryptologik) |
| Cycle 29 | 2026-04-06 | Supply Chain, CIS Compliance & IAM Escalation: Supply chain risk scorer SCR-001–007 (new-package/few-maintainers/low-stars/typosquatting/no-source-repo/unpinned/suspicious-scope, 113 tests) (secure-pipeline-blueprints), CIS K8s Benchmark scanner CIS-K8S-001–007 (anonymous-auth/etcd-encryption/kubelet-readonly/audit-logging/TLS/pod-security/kube-system-SA, compliance_score, 114 tests) (container-defense-stack), AWS IAM pri escalation detector PRI–007 (CreatePolicy/AttachRolePolicy+AssumeRole/PassRole-wildcard/LoginProfile/lambda+PassRole/AddUserToGroup, wildcard matching, 140 tests) (iam-audit-lab), Forensic hash FHV-001–007 (weak-hash/mismatch/late-collection/no-custody/missing-baseline/missing-metadata/custody-inconsistency, integrity_score, 98 tests) (ir-playbooks-automation) |
| Cycle 30 | 2026-04-06 | Code Review & Injection Defense: Code review policy checker CRP-001–007 (no-required-re/self-appro/stale-dismissal/no-status-checks/insufficient-re/unprotected-branch, 109 tests) (secure-pipeline-blueprints), Command injection WAF pack CMD-001–007 (shell-metacharacters/command-substitution/newline-injection/redirection/OS-commands/URL-encoded/null-byte, anti-double-count, 119 tests) (waf-defense-rulepacks), Certificate abuse monitor CERT-ABU-001–007 (suspicious-domain/wildcard/untrusted-CA/expired/excessi/self-signed/too-long, CA suppression for self-signed, 112 tests) (phishing-surface-monitor), RNG security analyzer RNG-001–007 (insecure-PRNG/hardcoded-seed/weak-seed/small-output/insecure-general/sequential-sample/frequency-imbalance, analyze_usage()+analyze_sample() split, 133 tests) (cryptologik) |
| Cycle 31 | 2026-04-06 | Pipeline Permissions, K8s SA & IAM Keys: GitHub Actions permissions auditor GHP-001–007 (write-all/no-permissions/contents-write-on-PR/id-token/secrets-inherit/pull-requests/packages, 121 tests) (secure-pipeline-blueprints), K8s service account auditor SA-001–007 (cluster-admin-binding/automount/wildcard-verbs/secrets-access/default-SA/imagePullSecrets/kube-system, binding+role resolution, 104 tests) (container-defense-stack), AWS access key analyzer AK-001–007 (root-key/key-age/ne/stale/multiple-acti/inacti, per-key findings weight dedup, 110 tests) (iam-audit-lab), URL deobfuscator URLO-001–007 (percent-encoded-hostname/unicode-homoglyph/nonstandard-IP/data-URI/redirect-chain/double-encoded/embedded-credentials, nonstandard IP parser, 126 tests) (phishing-surface-monitor) |
| Cycle 32 | 2026-04-06 | SAST, Container Escape, SQLi & AI Leakage: SAST findings aggregator SAST-001–007 (no-CWE/stale-critical/se/suppressed-no-expiry/count-threshold/sensiti/duplicate, pipeline_fail gate, 104 tests) (secure-pipeline-blueprints), Container escape detector CEX-001–007 (pri/hostPID/hostNetwork/runtime-socket/dangerous-caps/host-path/missing-securityContext, escape_risk tier, 118 tests) (container-defense-stack), SQL injection detection pack SQLI-001–007 (classic-UNION/time-based-blind/boolean-blind/error-based/stacked-queries/URL-encoded-bypass/comment-obfuscation, 143 tests) (waf-defense-rulepacks), LLM data leakage detector DLK-001–007 (PII/API-key/system-prompt/internal-infra/SQL-DDL/file-path/memorized-data, redacted_response, 157 tests) (ai-security-guardrails) |
| Cycle 33 | 2026-04-06 | License, Image & Crypto Key Analysis: License compliance checker LIC-001–007 (strong-copyleft/weak-copyleft/non-commercial/missing/deprecated/network-copyleft-saas/unknown-SPDX, project_type+deployment_context, 127 tests) (secure-pipeline-blueprints), Container image security scanner IMG-001–007 (root-user/unpinned-tag/sensiti/en/age/no-healthcheck/o, 130 tests) (container-defense-stack), Asymmetric key security analyzer ASY-001–007 (RSA-small/RSA-adequate/DSA-deprecated/weak-EC-cur/RSA-e3/no-expiry, Ed25519/Ed448 exemption, 135 tests) (cryptologik), GCP service account analyzer GCP-SA-001–007 (owner-editor-role/old-key/default-compute-SA/impersonation/ne/multiple-keys/org-folder-scope, disabled-SA short-circuit, 115 tests) (iam-audit-lab) |
| Cycle 34 | 2026-04-06 | Supply Chain, Malware, Phishing & XSS: Third-party action auditor TPA-001–007 (mutable-branch/floating-tag/untrusted-org/docker-no-digest/continue-on-error//action-count, 133 tests) (secure-pipeline-blueprints), Malware triage scorer MAL-001–007 (known-hash/extension-mismatch/embedded-PE/exec-strings/high-entropy/network-indicators/code-injection-APIs, P1–P5 priority, 136 tests) (ir-playbooks-automation), Social engineering detector SENG-001–007 (urgency/authority-impersonation/credential-har/fear-threat/reward-prize/decepti/excessi, 139 tests) (phishing-surface-monitor), XSS detection pack XSS-001–007 (reflected/DOM-sinks/CSS-based/e/S/URL-encoded/entity-encoded, 161 tests) (waf-defense-rulepacks) |
| Cycle 35 | 2026-04-06 | Env Vars, Agent Security, Container Drift & Cipher Suites: Env ENV-001–007 (hardcoded-secret/credential-URL/user-input-in-secret/github-token/workflow-scope//pri, extract_en(), 110 tests) (secure-pipeline-blueprints), AI agent action auditor AGT-001–007 (filesystem-OOB/burst-rate/stuck-loop/unauthorized-domain/code-exec/PII-in-args/chain-depth, ALLOW/WARN/BLOCK, 118 tests) (ai-security-guardrails), Container drift detector DRIFT-001–007 (new-process/read-only-write/unexpected-network/root-uid/new-executable/en/resource-abuse, drift_level tier, 122 tests) (container-defense-stack), TLS cipher suite analyzer CS-001–007 (NULL-ANON/RC4/DES-3DES/EXPORT/no-AEAD/TLS1.0-1.1/no-forward-secrecy, TLS1.3 exemption, grade A–F, 124 tests) (cryptologik) |
| Cycle 36 | 2026-04-06 | Registry, Honeypot, OAuth & IR Correlation: Container registry scanner CREG-001–007 (public-/no-/no-tag-immutability/no-signing/no-lifecycle/no-encryption/external-access, 133 tests) (secure-pipeline-blueprints), Lateral mo detector LATM-001–007 (credential-reuse/multi-host/username-enum/internal-IP/post-auth-pi/burst, sliding-window, 131 tests) (honeypot-foundry), OAuth app analyzer OAUTH-001–007 (write-scopes/stale/pri/scope-accumulation/no-expiry/un/blast-radius, 115 tests) (iam-audit-lab), Incident correlation engine ICOR-001–007 (repeated-attacker/shared-C/known-bad-IOC/o/no-containment/widespread, correlate_incremental(), 128 tests) (ir-playbooks-automation) |
| Cycle 37 | 2026-04-06 | Finding Quality, Phishing Kits, Cloud Creds & Pro: Pentest finding quality checker FINDQ-001–007 (no-C/no-remediation/generic-title/no-asset/no-CWE/no-effort, PASS/WARN/FAIL, 123 tests) (offensi), Phishing kit detector PKIT-001–007 (cloned-login/cloaking/exfil-POST/legit-redirect/obfuscated-JS/anti-indexing/fa, kit_detected, 121 tests) (phishing-surface-monitor), Cloud credential detector CCD-001–007 (AWS-key/AWS-secret/Azure-storage/GCP-SA-JSON/cloud-token/cloud-DB-URL/sensiti, push-safe patterns, 127 tests) (secret-leak-sentinel), Build pro checker PROV-001–007 (no-SLSA/insufficient-SLSA/unpinned-source/non-hermetic/unsigned/no-timestamp/unpinned-materials, slsa_compliant, 115 tests) (secure-pipeline-blueprints) |
| Cycle 38 | 2026-04-06 | Open Redirect, Ad AI, Workload Identity & Hashing: Open redirect rulepack ORED-001–007 (external-domain/URL-encoded/double-slash/backslash/ja/data-URI/suspicious-TLD, allowed_domains suppression, 132 tests) (waf-defense-rulepacks), Ad input detector ADV-001–007 (model-extraction-probe/membership-inference/backdoor-trigger/leetspeak-homoglyph/encoded-payload/context-flood/model-in, ALLOW/REVIEW/BLOCK, 116 tests) (ai-security-guardrails), Workload identity checker WID-001–007 (no-WI-annotation/o/GCP-owner-editor/default-SA-cloud-vars/no-audience/shared-identity/no-token-expiry, cross-workload WID-006, 104 tests) (container-defense-stack), Hashing policy analyzer HASH-001–007 (MD5/SHA-1/truncated/unsalted-password/short-salt/fast-hash-KDF/algorithm-reuse, bcrypt exemption, 124 tests) (cryptologik) |
| Cycle 39 | 2026-04-06 | PowerShell Forensics, Campaign Profiling, IAM Policy & After-Action Reports: PowerShell artifact analyzer PSA-001–007 (encoded-command/AMSI-bypass/download-cradle/execution-policy-bypass/LOLBins/obfuscation/attack-framework, 142 tests) (dfir-attack-lab), Attack campaign profiler CAMP-001–007 (multi-source-credential-reuse/distributed-scanning/subnet-sweep/tool-fingerprint/temporal-burst/credential-progression/return-attacker, 116 tests) (honeypot-foundry), IAM policy analyzer IAMP-001–007 (wildcard-sensiti/s3-exfil/sts-wildcard/deny-none/NotAction/NotResource/sensiti, 132 tests) (iam-audit-lab), After-action report generator AAR-001–007 (missing-root-cause/no-detection-timeline/SLA-breach/no-remediation/recurrence/no-lessons/e, EXCELLENT/GOOD/ADEQUATE/POOR, 119 tests) (ir-playbooks-automation) |
| Cycle 40 | 2026-04-06 | Remediation Plans, Page Clone Detection, Env File Scanning & Dependency Vulns: Remediation plan generator RPLAN-001–007 (missing-desc/no-owner/no-due-date/critical-no-compensating/duplicate-text/no-/effort-mismatch, EXCELLENT/GOOD/ADEQUATE/POOR, 112 tests) (offensi), Page clone detector PCLN-001–007 (login-form/brand-in-title/social-link-farming/obfuscated-JS/anti-indexing/external-form-exfil/fa, HIGH/MEDIUM/LOW/MINIMAL, 130 tests) (phishing-surface-monitor), Env file scanner ENV-001–007 (AWS-key/generic-API-key/password/PEM/DB-connection-string/token/high-entropy-secret, placeholder suppression, 165 tests) (secret-leak-sentinel), Dependency reporter D–007 (unpatched-critical/unpatched-high/direct-no-fix//missing-C/multi-C, 129 tests) (secure-pipeline-blueprints) |
| Cycle 41 | 2026-04-09 | Honeypot platform continuity: low-interaction FTP obser server with USER/PASS capture and safe reconnaissance replies, new run-api + run-ftp CLI commands, editable Hatch packaging fix + published k1n-honeypot console script, and synced schema/README/architecture/roadmap updates (honeypot-foundry) |
| Cycle 42 | 2026-04-09 | Portfolio wording cleanup: remo Claude references from GitHub-facing prompt docs while preserving the documents themselves, and re-scanned all 13 repositories to confirm zero remaining matches (waf-defense-rulepacks, cloud-posture-watch, secret-leak-sentinel) |
| Cycle 43 | 2026-04-09 | Portfolio completion engine: added a cross-repository status generator with Markdown/JSON output, unit tests, and an hourly GitHub Actions refresh workflow to track all 13 repositories by latest cycle, open roadmap count, core files, test , and completion band (cyber-port) |
| Cycle 44 | 2026-04-09 | Completion-first execution model: added a formal completion strategy, upgraded the portfolio status engine to rank repositories by completion priority, regenerated the portfolio status artifacts, and reordered the memory queue so roadmap closure is prioritized before new expansion work (cyber-port) |
| Cycle 45 | 2026-04-09 | DFIR completion pass: added the installable k1n-dfir console script, cross-platform collection commands for Linux/Windows/macOS, filtered report generation with HTML/CSV/JSON/JSONL/TXT export, packaging fixes for editable installs, new CLI/reporter tests, and README/roadmap sync (dfir-attack-lab) |
| Cycle 46 | 2026-04-09 | Honeypot completion pass: added a low-interaction RDP banner observer, exposed run-rdp in the CLI, added rdp to the event schema/model, switched the published CLI entrypoint to honeypot, updated architecture/learning docs, and closed the v0.2 roadmap gap with new unit/integration tests (honeypot-foundry) |
| Cycle 47 | 2026-04-09 | WAF completion pass: added a re Cloudflare command injection pack, repaired the repo-wide .py --all baseline so AWS/Azure templates no longer fail , synced the roadmap to close the LFI/SSRF/command-injection checklist drift, and regenerated the portfolio priority order with waf-defense-rulepacks reduced to 20 open roadmap items (waf-defense-rulepacks) |
| Cycle 48 | 2026-04-09 | go completion pass: added signed risk-acceptance records with appro, expiry checks, CLI workflows (create//expiring/apply), regression tests, and CVSS v3.1 weight corrections while closing the roadmap gap in offensi (offensi) |
| Cycle 49 | 2026-04-09 | Phishing monitoring completion pass: added a stateful Certificate Transparency alert workflow (analyzers/ct_alerts.py), new ct-monitor CLI command with JSON export and fail-on-alerts mode, regression co for state and alerting logic, and closed all v0.2 CT roadmap items in phishing-surface-monitor (phishing-surface-monitor) |
| Cycle 50 | 2026-04-09 | Honeypot deployment hardening pass: finished the carry-over Helm chart in honeypot-foundry, added default-deny egress NetworkPolicy isolation plus HPA/PDB-ready deployment manifests, added Helm/CLI regression tests, synced README/architecture/roadmap docs, and regenerated the portfolio completion status with honeypot-foundry reduced to 3 open roadmap items (honeypot-foundry, cyber-port) |
| Cycle 51 | 2026-04-09 | Secure pipeline completion pass: added a reusable GitHub dependency review workflow, repaired offline YAML/ compatibility plus editable install metadata, and fixed the central portfolio status generator to ignore .venv* directories when counting Python modules (secure-pipeline-blueprints, cyber-port) |
| Cycle 52 | 2026-04-09 | Container runtime hardening pass: added Dockerfile rule DF006 to recommend distroless/minimal final runtime bases, repaired the offline editable-install baseline with a stable k1n-container-guard entrypoint, synced docs/roadmap guidance, and regenerated the portfolio completion status with container-defense-stack reduced to 8 open roadmap items (container-defense-stack, cyber-port) |
| Cycle 53 | 2026-04-09 | Container admission completion pass: added a tested Gatekeeper policy library with deployable ConstraintTemplate and Constraint manifests, refreshed admission-policy docs, and regenerated the portfolio completion status with container-defense-stack reduced to 7 open roadmap items and the portfolio backlog reduced to 182 (container-defense-stack, cyber-port) |
| Cycle 54 | 2026-04-09 | Cloud posture telemetry hardening pass: added AWS VPC Flow Logs collection and analysis, repaired the typed network exposure analyzer, restored the offline editable install with a unique k1n-posture entrypoint, and regenerated the portfolio completion status with the backlog reduced to 180 (cloud-posture-watch, cyber-port) |
| Cycle 55 | 2026-04-09 | Honeypot SIEM completion pass: added li HEC, Elastic bulk, and CEF/syslog delivery, repaired the offline editable-install baseline by switching to setuptools and a repository-unique honeypot wrapper, closed the remaining honeypot roadmap items, and regenerated the portfolio completion status with the backlog reduced to 177 and phishing-surface-monitor promoted as the next target (honeypot-foundry, cyber-port) |
| Cycle 56 | 2026-04-09 | Phishing takedown completion pass: repaired the offline CLI baseline to work without rich, added a file-backed takedown case workflow with e bundles, registrar/ICANN templates, and status tracking, closed the remaining phishing-surface-monitor roadmap items, and regenerated the portfolio completion status with the backlog reduced to 174 and container-defense-stack promoted as the next target (phishing-surface-monitor, cyber-port) |
| Cycle 57 | 2026-04-09 | Container scanner completion pass: exposed the existing Helm /chart and OCI layer scanners through the installable k1n-container-guard CLI, added CLI regression co, closed the remaining v0.2 roadmap items in container-defense-stack, and regenerated the portfolio completion status with the backlog reduced to 166 and offensi promoted as the next target (container-defense-stack, cyber-port) |
| Cycle 58 | 2026-04-09 | API completion pass: added an optional FastAPI findings CRUD service with a deterministic JSON-backed store, api dependency extra, offline unit co, docs and roadmap sync, and regenerated the portfolio completion status with the backlog reduced to 152 and container-defense-stack promoted as the next target (offensi, cyber-port) |
| Cycle 59 | 2026-04-10 | Completion-state reconciliation: continued the in-progress local publish cycle, all ahead-of-origin repository test baselines with repository-appropriate interpreters, regenerated portfolio status with container-defense-stack and offensi now beyond-ready, reduced the backlog to 144 open roadmap items, and promoted cloud-posture-watch as the next actionable completion target (cyber-port) |
| Cycle 60 | 2026-04-11 | Central index tra hardening: updated the portfolio status generator to reject repository-root symlink escapes outside the allowed clone/cache roots, ignore symlinked Python files during source counts, and added regression co so the central index cannot be skewed by out-of-tree content (cyber-port) |
| Cycle 61 | 2026-04-11 | Crypto CT burst hardening: published a cryptologik fix so CT-ABU-001 catches threshold-sized issuance bursts inside larger multi-day windows, refreshed the central portfolio status artifacts, and synced the central history to the published SHA (cryptologik, cyber-port) |
| Cycle 62 | 2026-04-12 | AI regex-rule schema hardening: published an ai-security-guardrails fix that rejects malformed YAML regex rule definitions, refreshed the central portfolio status artifacts to the published SHA, and promoted cryptologik as the next AI/Crypto lane target (ai-security-guardrails, cyber-port) |
| Cycle 69 | 2026-04-12 | AI regex score hardening: published an ai-security-guardrails fix so non-finite YAML regex rule scores fail closed, refreshed the central portfolio status artifacts to the published cycle-69 SHA, and reduced the backlog to 112 open roadmap items (ai-security-guardrails, cyber-port) |

---

Roadmap

See ROADMAP.md for the portfolio-le and e plan.

---

License

CC BY 4.0 — see LICENSE.
Free to use, share, and adapt with attribution to Hiago Kin Levi.

项目信息

开发语言：Python

Star 数：4

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Root index for the k1N Cyber Port cybersecurity portfolio — 13 defensive security repositories展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。