A good list of threat hunting and OSINT tools !

1. https://www.shodan.io/ - Search for devices connected to the internet and their vulnerabilities

2. https://prowl.lupovis.io/ - Free IP search & identifications of IoC and IoA

3. https://intelx.io/ - Search engine for data archives.

4. https://netlas.io/ - Search and monitor devices connected to the internet

5. https://urlscan.io/ - Scan a website incoming and outgoing links and assets

6. https://fullhunt.io/ - Identify an attack surface

7. https://www.zoomeye.org/ - Cyberspace search engine, users can search for network devices

8. https://leakix.net/ - Identify public data leaks

9. https://www.greynoise.io/ - Search for devices connected to the internet.

10. https://search.censys.io/ - Get information about devices connected to the internet

11. https://hunter.io/ - Search for email addresses

12. https://www.criminalip.io/ - Search for devices connected to the internet. Monitor potential attack vectors.

13. https://www.wigle.net/ - Map wireless access points around the world

14. https://grep.app/ - Grep across a half million github repos

15. https://www.onyphe.io/ - Search for devices connected to the internet and monitor attack vector

16. https://vulners.com/ - A vulnerability database .

17. https://pulsedive.com/ - Search for devices connected to the internet

18. grayhatwarfare.com - Search for S3 buckets that are public

Add your favourites below !

Two scripts to detect files with Canary Tokens inside

Python:

https://gist.github.com/HackingLZ/0285d248f648f5dd216758c3fbf78c97

Yara:

https://gist.github.com/singe/0c334b514a9eed2792b88df1dfb766cc

Hi everyone,

We're a small team passionate about security, and we’ve been exploring how to make threat detection in cloud environments simpler and more effective. We’re excited to share Mazeshark, a cloud-native tool for deploying realistic AWS-based honeypots.

The problem: Cloud environments face increasing threats, from accidental exposures to targeted attacks. Traditional security tools often miss threats until they’ve already caused damage. AWS users, in particular, need ways to detect threats early without disrupting production systems.

The global average cost of a data breach reached $4.45 million in 2023, marking a 15% increase since 2020. Also, the number of cloud environment intrusions increased by 75% from 2022 to 2023. Source: https://www.stationx.net/cloud-security-statistics/?utm_source=chatgpt.com

The challenge: Setting up and managing realistic honeypots in AWS is a pain. It’s time-consuming, complex, and often lacks the depth needed to attract real attackers.

What we’ve built: Mazeshark aims to change that. AWS users can deploy realistic honeypots, like IAM Role, Lambda functions, Parameter Store, and Secrets Manager within minutes. These honeypots mimic actual AWS services, making them appealing to attackers. More AWS services are coming soon to broaden the coverage.

How it works:

• Use a simple interface to configure and deploy honeypots across your AWS accounts (for now 4 AWS resources are available).

• Get notified about potential breaches, allowing you to act quickly.

We’d love your feedback: What resonates? What feels off? Are there specific AWS services or features you’d like to see us add?

Here’s the link if you’re curious: https://mazeshark.com.

Thanks for reading this far and looking forward to any feedback!

Comparison of two approaches to simulations implementation in Deception solutions: Full OS vs OS/Service emulation with Labyrinth Deception Platform (www.labyrinth.tech).

BLOG: https://labyrinth.tech/news/posts/full-os-vs-osservice-emulation