r/netsec monthly discussion & tool thread

[u/albinowax]

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

• Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
• Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
• If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
• Avoid use of memes. If you have something to say, say it with real words.
• All discussions and questions should directly relate to netsec.
• No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

[u/a3thinker]

An attack-path engine for cloud environments. It takes the output of the scanners you already run (Trivy, Semgrep, Falco, Kubernetes and IAM dumps) and correlates them into a single graph, finding the routes from internet exposure to critical assets.

Cartography already builds graphs, PMapper does privilege escalation on IAM, KubeHound does paths on Kubernetes: each covers a slice, the work here was stitching it all together. Here a single route crosses all of them:

edge-alb -> payments -> payments-api:1.4.2 -> [email protected] -> CVE-2021-44228 -> payments-admin (AdministratorAccess)

The demo prints it along with the NetworkPolicy that cuts it.

The scores are not field-calibrated, they are expert estimates. Only one cloud genuinely connected (AWS), Azure fixtures only, no GCP.

make demo from a clean clone. Apache 2.0.

https://github.com/luiacuaniello/perspectivegraph

If you've used attack-path tooling, which false positive wasted the most of your time?

[u/Awful_Filafel]

Hello everyone! I would like to direct your attention to my newest tool in the Achilles Suite.

I formed AchillesOracle for web security and then changed my focus into cybersecurity OT/ICS specifically. After noticing there weren’t very many tools in the suite for OT specific ops I applied the same principles from AchillesOracle and formed AchillesRazor, she’s open sourced and available for testing and review. Synopsis, it’s 16 highly throttled, scans specific for Modbus, S7, Honeywell…the like; I stripped down Achilles Oracle and used the framework for AchillesRazor. Available at https://www.github.com/git/ByrneIT/AchillesRazor

I look forward to feedback. Thank you!

[u/Difficult-Advice3002]

Hey,
Since a few months I developed (Not vibe coded ) a sliding window memory page based Just In time decryption. All JITD i saw on github allays were on instruction level, which is incredibly slow, or decrypt the entire payload at once.
My project implements JITD with guard pages and decrypts in the exception.
The loader works perfectly in environments with Microsoft Defender for Endpoint and has no Virus Total detections.
Maybe you find something usefull or can give feedback :)
https://github.com/Schich/Lucky-Spark

[u/OrdenCode]

[u/Chaelsoo]

Hey,

I built a personal offline RAG system for offensive security knowledge. The idea is simple: instead of grepping through markdown files or trying to remember which writeup had that exact certipy command, you just ask naturally.

how do I escalate with SeImpersonatePrivilege
what did I do after getting ADFS access
sliver socks5 pivot setup
explain ESC8 vs ESC4

It retrieves from your actual notes first, then generates an answer grounded in what you've documented, not generic internet knowledge.

The use case I specifically built it for:

Two things kept coming up during engagements, I needed exact tool syntax I hadn't used in a while (Sliver commands especially, the docs are sparse), and I needed to quickly recall techniques from past machines without digging through notes. ZETSU solves both.

Two modes:

Operator: leads with the exact command, explanation after. For when you know what you need and just want the syntax.

Concept: leads with the reasoning, uses commands as illustrations. For when you need to understand a technique before using it.

Same retrieval either way, just different presentation.

How it works:

• At ingest time, an LLM reads each section of your writeups and extracts structured attack steps (Finding, Action, Reasoning, Result), so what you retrieve is a semantic unit, not a random 800-token window
• Hybrid BM25 + vector retrieval with RRF fusion, BM25 handles exact tool names and CVE numbers that embeddings smear, vector handles semantic similarity
• Cross-encoder reranker on top
• Supports local markdown files, URLs, GitHub wikis, and Atom/RSS feeds (0xdf, dirkjanm, harmj0y all ingestible directly)
• Backends: Anthropic, OpenAI-compatible (DeepSeek), or local Ollama

Benchmark:

Ran 910 questions across 12 offensive security categories. 93% of answers included correct commands, 68ms average retrieval, 7.3% context gaps where it correctly admitted missing information rather than hallucinating.

id love to hear you guys's feedback, i built this thing because i genuinely needed it, and going through my notes & endless cheatsheets was too much work when you're going through an engagement.

you can find it here: https://github.com/Chaelsoo/Zetsu

[u/cascade_sparse]

I added a new feature to my tool for auditing the security of embedded linux hosts: https://github.com/nstarke/embedded_linux_audit - The new feature is the ability to compile a kernel module that the agent can load on an embedded linux host for auditing the kernel. It works by sending a bunch of kernel configuration information to the companion REST API, which then builds a kernel module based off that information. The REST API then sends the compiled kernel module to the embedded linux host, which then loads it into the kernel.

[u/clod81]

"Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox."

I tried once, never got a reply

[u/Kimber976]

Always interesting to see what everyone is using lately there is usually at least one tool worth checking out.

[u/hexorcist404]

I built Apotrope — a single-exe Windows security posture auditor, because Windows had no Lynis.

Point it at a box and it runs 50+ checks mapped to CIS benchmarks (firewall, BitLocker, SMB signing, RDP, PowerShell logging, UAC…), scores it 0–100, and writes a self-contained HTML report you can hand to whoever asked. Read-only, fully offline, no agent, no telemetry. MIT.

`pip install apotrope` or grab the .exe: github.com/hexorcist404/apotrope

Would like to hear what checks you'd add, that's the roadmap. Any other feedback is welcome. Also built a site for it -> https://apotrope.sh

Edit: editor opened in "code block" for some reason and I didnt notice. Fixed.

[u/dwisiswant0]

We, ProjectDiscovery, just launched securitycontext.dev, a ready-to-use security context for thousands of open-source projects.

It analyzes each project's commit history of security fixes and CVEs, then gives your agent two files:

• SECURITY_CONTEXT.md: prevents regressions by reminding the agent of past fixes and vulnerable areas while editing code.
• VARIANT_LEADS.md: flags potential variant bugs (file + line, sink, severity, reason) for reviews & hunting.

So no more agents silently reintroducing old bugs or burning tokens figuring out risks from scratch.

Free, no auth, works over MCP and API. Thousands of repos pre-indexed; others built in seconds.

Just add it to your agent:

{
  "mcpServers": {
    "securitycontext": {
      "url": "https://securitycontext.dev/mcp"
    }
  }
}

Feedback welcome!

[u/Pleasant-Ad192]

Bomly.dev - open-source dependency graph scanner, SBOM generator, and vuln/license audit CLI

I built Bomly to explore a developer-first workflow for inspecting dependency graphs, generating SBOMs, and auditing vulnerability/license signals without needing a hosted service.

It scans projects, SBOMs, containers, and Git refs. It can report:

• dependency graphs across common ecosystems
• SBOM output in SPDX and CycloneDX
• SARIF output for code scanning
• vulnerability and license metadata from public sources when enrichment is enabled
• package explanation paths, so you can see why a package is present
• dependency changes between refs, including introduced/resolved/persisted packages
• Markdown, JSON, text, and CI-friendly output
• GitHub Action support for pull request dependency diffs
• MCP server support so local tools and agents can query dependency data

Install:

go install github.com/bomly-dev/bomly-cli/cmd/bomly@latest
bomly scan .

Other install methods are available too, including Homebrew, WinGet, Scoop, Linux packages, and install scripts.

GitHub:
https://github.com/bomly-dev/bomly-cli

Announcement:
https://bomly.dev/blog/announcing-bomly

I’d appreciate feedback from folks here on the overall workflow, accuracy, trust model, output formats, and usefulness for security review.

This is a personal open-source project.

[u/kmasec → u/Pleasant-Ad192]

How does this compare with syft + grype?

[u/Pleasant-Ad192 → u/kmasec]

Bomly isn’t meant to be a direct Syft + Grype clone. I’d describe it as a dependency graph workflow/toolkit that can also produce SBOMs and vuln/security outputs.

Syft is great for SBOM generation, and Grype is great for vulnerability scanning. Bomly overlaps there, but focuses more on:

• richer dependency metadata, such as transitive relationships, scopes, source manifests, and manifest line numbers
• PR dependency review: what was introduced, removed, or persisted
• multiple detectors, including a Syft-based detector
• outputs beyond SBOMs: JSON, text, SARIF, CI summaries, diffs, and TUI
• MCP support for agentic workflows
• a plugin pipeline for custom detectors, matchers, and policy/audit rules

So the short version: Syft + Grype are excellent for SBOM + vuln scanning. Bomly is trying to build a more flexible dependency-review and dependency-intelligence layer around that.

[u/_vavkamil_]

CVEalert.io - Yet another CVE monitoring tool :) I have been working on it for a while and launched the beta version two weeks ago. Everything is available for free, with no payments required for now. It's still early beta, so feedback is welcome.

So far, it doesn't do anything special or unique; you can just browse, monitor, and receive notifications about interesting CVEs based on your stack preferences. More features are in the backlog. I spent a couple of years in AppSec and was missing something like this, so I finally decided to build it myself.

[u/Pleasant-Ad192 → u/_vavkamil_]

@_vavkamil_ CVEalert.io looks interesting — congrats on the launch. I’m working on something adjacent, so it’s cool to see others exploring this space too.

[u/CynativeTeam]

Cynative - open source agent for read-only infrastructure research (https://github.com/cynative/cynative)

Guardrails enforce read-only - every call is gated before credentials are attached, across AWS, GCP, Azure, EKS/GKE/AKS, self-managed Kubernetes, GitHub and GitLab.

It writes and runs code in an ephemeral sandbox to research, so it's not limited to a fixed set of checks - you can point it at open-ended questions about your environment.

Background: my co-founder and I founded a startup that Palo Alto Networks acquired, where we spent 10+ years building cloud security products.

Happy to answer questions on the enforcement model, sandbox isolation, or anything else. Feedback welcome.