diff --git a/README.md b/README.md
index d1c058c..4606bcd 100644
--- a/README.md
+++ b/README.md
@@ -12,10 +12,33 @@ Please visit the framework at the link below and good hunting!
https://osintframework.com
### Legend
-(T) - Indicates a link to a tool that must be installed and run locally
-(D) - Google Dork, for more information: Google Hacking
-(R) - Requires registration
-(M) - Indicates a URL that contains the search term and the URL itself must be edited manually
+
+#### Name Markers
+(T) - Indicates a link to a tool that must be installed and run locally
+(D) - Google Dork, for more information: Google Hacking
+(R) - Requires registration
+(M) - Indicates a URL that contains the search term and the URL itself must be edited manually
+
+#### Tool Metadata Fields
+Each tool entry in `arf.json` can include structured metadata beyond the name and URL:
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `description` | string | What the tool does |
+| `status` | string | `live`, `degraded`, `down`, or `deprecated` |
+| `pricing` | string | `free`, `freemium`, or `paid` |
+| `bestFor` | string | Primary use case in one line |
+| `input` | string | What the tool takes as input |
+| `output` | string | What the tool returns |
+| `opsec` | string | `passive` or `active` |
+| `opsecNote` | string | Operational security considerations |
+| `localInstall` | boolean | Corresponds to `(T)` marker |
+| `googleDork` | boolean | Corresponds to `(D)` marker |
+| `registration` | boolean | Corresponds to `(R)` marker |
+| `editUrl` | boolean | Corresponds to `(M)` marker |
+| `api` | boolean | Whether the tool offers an API |
+| `invitationOnly` | boolean | Whether access requires an invitation |
+| `deprecated` | boolean | Whether the tool is deprecated |
### For Update Notifications
Follow me on Twitter: @jnordine - https://twitter.com/jnordine
@@ -26,23 +49,37 @@ Feedback or new tool suggestions are extremely welcome! Please feel free to sub
### Contribute with a GitHub Pull Request
For new resources, please ensure that the site is available for public and free use.
-
- - Update the arf.json file in the format shown below. If this isn't the first entry for a folder, add a comma to the last closing brace of the previous entry.
-
-```
+1. Update `arf.json` with your new tool entry in the appropriate category folder. Use the enriched format below:
+
+```json
{
- "name": "Example Name",
+ "name": "Example Name (T)",
"type": "url",
- "url": "http://example.com"
+ "url": "https://example.com",
+ "description": "Brief description of what the tool does and its key capabilities.",
+ "status": "live",
+ "pricing": "free",
+ "bestFor": "Primary use case in one sentence",
+ "input": "What the tool accepts (e.g., Username, Domain, IP address)",
+ "output": "What the tool returns (e.g., Profile matches, DNS records)",
+ "opsec": "passive",
+ "opsecNote": "Any operational security considerations for using this tool.",
+ "localInstall": true,
+ "googleDork": false,
+ "registration": false,
+ "editUrl": false,
+ "api": false,
+ "invitationOnly": false,
+ "deprecated": false
}
```
-
- - Submit pull request!
-
+At a minimum, include `name`, `type`, and `url`. The metadata fields are strongly encouraged as they help users understand each tool at a glance.
-Thank you!
+Append `(T)`, `(D)`, `(R)`, or `(M)` to the name when applicable, and set the corresponding boolean field to `true`.
+
+2. Submit your pull request!
## OSINT Framework Website
diff --git a/public/arf.json b/public/arf.json
index 54a6ba0..94c76ce 100644
--- a/public/arf.json
+++ b/public/arf.json
@@ -10898,7 +10898,7 @@
"deprecated": false
},
{
- "name": "GOVDATA - Das Datenportal für Deutschland (German)",
+ "name": "GOVDATA - Das Datenportal f\u00fcr Deutschland (German)",
"type": "url",
"url": "https://www.govdata.de/",
"description": "Official German government open data portal with 120K+ datasets. Centralized access to federal, state, and local administrative data.",
@@ -10918,7 +10918,7 @@
"deprecated": false
},
{
- "name": "Open-Data-Portal München (German)",
+ "name": "Open-Data-Portal M\u00fcnchen (German)",
"type": "url",
"url": "https://opendata.muenchen.de/",
"description": "City of Munich open data portal with 331+ datasets. Provides administrative data from Munich government at city level.",
@@ -11197,12 +11197,12 @@
"url": "https://www.brbpub.com/"
},
{
- "name": "GOVDATA - Das Datenportal für Deutschland (German)",
+ "name": "GOVDATA - Das Datenportal f\u00fcr Deutschland (German)",
"type": "url",
"url": "https://www.govdata.de/"
},
{
- "name": "Open-Data-Portal München (German)",
+ "name": "Open-Data-Portal M\u00fcnchen (German)",
"type": "url",
"url": "https://www.opengov-muenchen.de/"
},
@@ -20134,9 +20134,89 @@
]
},
{
- "name": "Exploits & Advisories",
- "type": "folder",
+ "name": "Cyber Threat Intelligence",
"children": [
+ {
+ "name": "Advisories",
+ "children": [
+ {
+ "name": "Vulert: Updated Open Source Vulnerability Database",
+ "type": "url",
+ "url": "https://vulert.com/vuln-db"
+ },
+ {
+ "name": "SecurityFocus",
+ "type": "url",
+ "url": "https://www.securityfocus.com/bid"
+ },
+ {
+ "name": "NVD - NIST",
+ "type": "url",
+ "url": "https://nvd.nist.gov/"
+ },
+ {
+ "name": "OSV Vulnerability Library",
+ "type": "url",
+ "url": "https://osv.dev/list"
+ },
+ {
+ "name": "CVE Details",
+ "type": "url",
+ "url": "https://www.cvedetails.com/"
+ },
+ {
+ "name": "CVE - MITRE",
+ "type": "url",
+ "url": "https://www.cve.org/"
+ },
+ {
+ "name": "OWASP",
+ "type": "url",
+ "url": "https://www.owasp.org/index.php/Main_Page"
+ },
+ {
+ "name": "Secunia",
+ "type": "url",
+ "url": "https://secuniaresearch.flexerasoftware.com/community/research/"
+ },
+ {
+ "name": "Australian Cyber Security Centre",
+ "type": "url",
+ "url": "https://www.cyber.gov.au/"
+ },
+ {
+ "name": "Canadian Centre for Cyber Security",
+ "type": "url",
+ "url": "https://www.cyber.gc.ca/"
+ }
+ ]
+ },
+ {
+ "name": "Attack Surface / Security Testing",
+ "type": "folder",
+ "children": [
+ {
+ "name": "ImmuniWeb",
+ "type": "url",
+ "url": "https://www.immuniweb.com/",
+ "description": "AI-powered application security platform for web penetration testing and vulnerability scanning.",
+ "status": "live",
+ "pricing": "freemium",
+ "bestFor": "Web security testing and scanning",
+ "input": "Web application or target URL",
+ "output": "Vulnerability reports and risk assessment",
+ "opsec": "active",
+ "opsecNote": "Performs actual penetration testing and scanning - generates server logs",
+ "localInstall": false,
+ "googleDork": false,
+ "registration": true,
+ "editUrl": false,
+ "api": true,
+ "invitationOnly": false,
+ "deprecated": false
+ }
+ ]
+ },
{
"name": "Default Passwords",
"type": "folder",
@@ -20179,159 +20259,17 @@
]
},
{
- "name": "Vulert: Updated Open Source Vulnerability Database",
- "type": "url",
- "url": "https://vulert.com/vuln-db"
- },
- {
- "name": "MITRE ATT&CK",
- "type": "url",
- "url": "https://attack.mitre.org/"
- },
- {
- "name": "Exploit DB",
- "type": "url",
- "url": "https://www.exploit-db.com/"
- },
- {
- "name": "Packet Storm",
- "type": "url",
- "url": "https://packetstormsecurity.com/"
- },
- {
- "name": "SecurityFocus",
- "type": "url",
- "url": "https://www.securityfocus.com/bid"
- },
- {
- "name": "NVD - NIST",
- "type": "url",
- "url": "https://nvd.nist.gov/"
- },
- {
- "name": "OSV Vulnerability Library",
- "type": "url",
- "url": "https://osv.dev/list"
- },
- {
- "name": "CVE Details",
- "type": "url",
- "url": "https://www.cvedetails.com/"
- },
- {
- "name": "CVE - MITRE",
- "type": "url",
- "url": "https://www.cve.org/"
- },
- {
- "name": "OWASP",
- "type": "url",
- "url": "https://www.owasp.org/index.php/Main_Page"
- },
- {
- "name": "Secunia",
- "type": "url",
- "url": "https://secuniaresearch.flexerasoftware.com/community/research/"
- },
- {
- "name": "Australian Cyber Security Centre",
- "type": "url",
- "url": "https://www.cyber.gov.au/"
- },
- {
- "name": "Canadian Centre for Cyber Security",
- "type": "url",
- "url": "https://www.cyber.gc.ca/"
- }
- ]
- },
- {
- "name": "Threat Intelligence",
- "type": "folder",
- "children": [
- {
- "name": "Phishing",
- "type": "folder",
+ "name": "Exploits",
"children": [
{
- "name": "SecAI.ai",
+ "name": "Exploit DB",
"type": "url",
- "url": "https://secai.ai/research",
- "description": "Security research platform providing threat intelligence, vulnerability analysis, and cybersecurity insights with focus on emerging threats.",
- "status": "live",
- "pricing": "free",
- "bestFor": "Security research and threat intelligence",
- "input": "Threat indicator or research topic",
- "output": "Research articles and threat analysis",
- "opsec": "passive",
- "opsecNote": "Passive threat intelligence platform",
- "localInstall": false,
- "googleDork": false,
- "invitationOnly": false,
- "registration": false,
- "editUrl": false,
- "api": false,
- "deprecated": false
+ "url": "https://www.exploit-db.com/"
},
{
- "name": "https://openphish.com/feed.txt",
+ "name": "Packet Storm",
"type": "url",
- "url": "https://openphish.com/feed.txt",
- "description": "Real-time phishing URL feed providing confirmed malicious phishing sites updated continuously.",
- "status": "live",
- "pricing": "free",
- "bestFor": "Phishing URL detection",
- "input": "Feed subscription or URL lookup",
- "output": "Phishing URLs and malicious domains",
- "opsec": "passive",
- "opsecNote": "Passive feed consumption of public phishing data",
- "localInstall": false,
- "googleDork": false,
- "api": true,
- "invitationOnly": false,
- "registration": false,
- "editUrl": false,
- "deprecated": false
- },
- {
- "name": "PhishTank",
- "type": "url",
- "url": "https://www.phishtank.com/",
- "description": "Community-driven phishing URL database where users submit and verify suspected phishing sites.",
- "status": "live",
- "pricing": "free",
- "bestFor": "Phishing site verification",
- "input": "Phishing URL or suspected malicious site",
- "output": "Phishing status and community verification votes",
- "opsec": "passive",
- "opsecNote": "Passive lookup of community-reported database",
- "localInstall": false,
- "googleDork": false,
- "editUrl": true,
- "api": true,
- "invitationOnly": false,
- "registration": false,
- "deprecated": false
- },
- {
- "name": "PhishStats",
- "type": "url",
- "url": "https://phishstats.info/",
- "description": "Phishing detection and analysis platform providing statistics on campaigns and domain intelligence.",
- "status": "live",
- "pricing": "free",
- "bestFor": "Phishing campaign analysis",
- "input": "Domain, IP, or keyword",
- "output": "Campaign tracking and threat profiles",
- "opsec": "passive",
- "opsecNote": "Passive querying of phishing statistics database",
- "localInstall": false,
- "googleDork": false,
- "api": true,
- "invitationOnly": false,
- "registration": false,
- "editUrl": false,
- "deprecated": false
+ "url": "https://packetstormsecurity.com/"
}
]
},
@@ -20482,47 +20420,87 @@
]
},
{
- "name": "TTPs",
+ "name": "Phishing",
"type": "folder",
"children": [
{
- "name": "Malware Exploit TTP Database",
+ "name": "SecAI.ai",
"type": "url",
- "url": "https://www.pwnmalw.re/",
- "description": "Malware exploit database documenting security vulnerabilities in malware families (offline).",
- "status": "down",
+ "url": "https://secai.ai/research",
+ "description": "Security research platform providing threat intelligence, vulnerability analysis, and cybersecurity insights with focus on emerging threats.",
+ "status": "live",
"pricing": "free",
- "bestFor": "Malware exploit research",
- "input": "Malware name or exploit query",
- "output": "Exploit documentation and vulnerability details",
+ "bestFor": "Security research and threat intelligence",
+ "input": "Threat indicator or research topic",
+ "output": "Research articles and threat analysis",
"opsec": "passive",
- "opsecNote": "Passive lookup when functional",
+ "opsecNote": "Passive threat intelligence platform",
"localInstall": false,
"googleDork": false,
+ "invitationOnly": false,
"registration": false,
"editUrl": false,
"api": false,
- "invitationOnly": false,
- "deprecated": true
+ "deprecated": false
},
{
- "name": "Mitre TTPs",
+ "name": "https://openphish.com/feed.txt",
"type": "url",
- "url": "https://attack.mitre.org/",
- "description": "MITRE ATT&CK framework: globally-accessible knowledge base of adversary tactics and techniques.",
+ "url": "https://openphish.com/feed.txt",
+ "description": "Real-time phishing URL feed providing confirmed malicious phishing sites updated continuously.",
"status": "live",
"pricing": "free",
- "bestFor": "Threat modeling and TTP analysis",
- "input": "Search for tactics, techniques, or threat groups",
- "output": "Technique descriptions and mitigation strategies",
+ "bestFor": "Phishing URL detection",
+ "input": "Feed subscription or URL lookup",
+ "output": "Phishing URLs and malicious domains",
"opsec": "passive",
- "opsecNote": "Passive research of public threat intelligence",
+ "opsecNote": "Passive feed consumption of public phishing data",
"localInstall": false,
"googleDork": false,
- "registration": false,
- "editUrl": false,
"api": true,
"invitationOnly": false,
+ "registration": false,
+ "editUrl": false,
+ "deprecated": false
+ },
+ {
+ "name": "PhishTank",
+ "type": "url",
+ "url": "https://www.phishtank.com/",
+ "description": "Community-driven phishing URL database where users submit and verify suspected phishing sites.",
+ "status": "live",
+ "pricing": "free",
+ "bestFor": "Phishing site verification",
+ "input": "Phishing URL or suspected malicious site",
+ "output": "Phishing status and community verification votes",
+ "opsec": "passive",
+ "opsecNote": "Passive lookup of community-reported database",
+ "localInstall": false,
+ "googleDork": false,
+ "editUrl": true,
+ "api": true,
+ "invitationOnly": false,
+ "registration": false,
+ "deprecated": false
+ },
+ {
+ "name": "PhishStats",
+ "type": "url",
+ "url": "https://phishstats.info/",
+ "description": "Phishing detection and analysis platform providing statistics on campaigns and domain intelligence.",
+ "status": "live",
+ "pricing": "free",
+ "bestFor": "Phishing campaign analysis",
+ "input": "Domain, IP, or keyword",
+ "output": "Campaign tracking and threat profiles",
+ "opsec": "passive",
+ "opsecNote": "Passive querying of phishing statistics database",
+ "localInstall": false,
+ "googleDork": false,
+ "api": true,
+ "invitationOnly": false,
+ "registration": false,
+ "editUrl": false,
"deprecated": false
}
]
@@ -20738,401 +20716,20 @@
]
},
{
- "name": "IBM X-Force Exchange",
- "type": "url",
- "url": "https://exchange.xforce.ibmcloud.com/",
- "description": "Collaborative threat intelligence platform with malware, vulnerability, and campaign data.",
- "status": "live",
- "pricing": "freemium",
- "bestFor": "Malware and threat intelligence",
- "input": "IOC, domain, or malware sample",
- "output": "Threat analysis and intelligence reports",
- "opsec": "passive",
- "opsecNote": "Passive querying of threat database",
- "localInstall": false,
- "googleDork": false,
- "registration": true,
- "editUrl": false,
- "api": true,
- "invitationOnly": false,
- "deprecated": false
- },
- {
- "name": "Malware Information Sharing Platform",
- "type": "url",
- "url": "https://www.misp-project.org/",
- "description": "Open-source platform for collecting, storing, and sharing cyber threat indicators and malware data.",
- "status": "live",
- "pricing": "free",
- "bestFor": "Threat intelligence sharing",
- "input": "Threat indicators and malware samples",
- "output": "Structured threat intelligence and correlations",
- "opsec": "passive",
- "opsecNote": "Local platform for passive sharing",
- "localInstall": true,
- "googleDork": false,
- "registration": false,
- "editUrl": false,
- "api": true,
- "invitationOnly": false,
- "deprecated": false
- },
- {
- "name": "Malware Patrol",
- "type": "url",
- "url": "https://www.malwarepatrol.net/",
- "description": "Threat intelligence feed service providing malware samples, URLs, domains, and IOC data.",
- "status": "live",
- "pricing": "freemium",
- "bestFor": "Malware IOC and feed intelligence",
- "input": "IOC queries or feed subscriptions",
- "output": "Malware hashes, URLs, and threat intel",
- "opsec": "passive",
- "opsecNote": "Passive consumption of threat feeds",
- "localInstall": false,
- "googleDork": false,
- "registration": true,
- "editUrl": false,
- "api": true,
- "invitationOnly": false,
- "deprecated": false
- },
- {
- "name": "AlienVault OTX",
- "type": "url",
- "url": "https://otx.alienvault.com/",
- "description": "Crowd-sourced threat intelligence platform with 180K+ participants sharing 19M+ daily threats.",
- "status": "live",
- "pricing": "free",
- "bestFor": "Community threat intelligence",
- "input": "IOC, domain, IP, or search query",
- "output": "Community threat pulses and analysis",
- "opsec": "passive",
- "opsecNote": "Passive community threat data sharing",
- "localInstall": false,
- "googleDork": false,
- "registration": true,
- "editUrl": false,
- "api": true,
- "invitationOnly": false,
- "deprecated": false
- },
- {
- "name": "FireHOL IP Lists ",
- "type": "url",
- "url": "https://iplists.firehol.org/",
- "description": "Collection of firewall-friendly IP blacklists for blocking malicious and spam sources.",
- "status": "live",
- "pricing": "free",
- "bestFor": "IP reputation and blocking",
- "input": "IP address or list subscription",
- "output": "Blacklist membership status",
- "opsec": "passive",
- "opsecNote": "Passive lookup of public reputation lists",
- "localInstall": false,
- "googleDork": false,
- "registration": false,
- "editUrl": false,
- "api": true,
- "invitationOnly": false,
- "deprecated": false
- },
- {
- "name": "Maltiverse",
- "type": "url",
- "url": "https://maltiverse.com/",
- "description": "Threat intelligence platform aggregating 100+ sources with real-time IOC scoring.",
- "status": "live",
- "pricing": "freemium",
- "bestFor": "IOC aggregation and scoring",
- "input": "IOC or threat indicator",
- "output": "Threat scores and context",
- "opsec": "passive",
- "opsecNote": "Passive aggregation of threat data",
- "localInstall": false,
- "googleDork": false,
- "registration": true,
- "editUrl": false,
- "api": true,
- "invitationOnly": false,
- "deprecated": false
- },
- {
- "name": "Malpedia",
- "type": "url",
- "url": "https://malpedia.caad.fkie.fraunhofer.de/",
- "description": "Free collaborative malware database from Fraunhofer FKIE with 600+ malware families.",
- "status": "live",
- "pricing": "freemium",
- "bestFor": "Malware family identification",
- "input": "Malware sample or family name",
- "output": "Malware family analysis and YARA rules",
- "opsec": "passive",
- "opsecNote": "Passive malware research database",
- "localInstall": false,
- "googleDork": false,
- "registration": true,
- "editUrl": false,
- "api": true,
- "invitationOnly": true,
- "deprecated": false
- },
- {
- "name": "Project Honey Pot",
- "type": "url",
- "url": "https://www.projecthoneypot.org/",
- "description": "Distributed honeypot project tracking email harvesters, spam servers, and malicious IPs.",
- "status": "live",
- "pricing": "free",
- "bestFor": "Spam and harvester tracking",
- "input": "IP address or email domain",
- "output": "Harvester and spam activity records",
- "opsec": "passive",
- "opsecNote": "Passive honeypot intelligence",
- "localInstall": false,
- "googleDork": false,
- "registration": true,
- "editUrl": false,
- "api": true,
- "invitationOnly": false,
- "deprecated": false
- },
- {
- "name": "Cymon Open Threat Intelligence",
- "type": "url",
- "url": "https://cymon.io/",
- "description": "Largest open tracker of malware, phishing, botnets containing 6M+ malicious IPs.",
- "status": "live",
- "pricing": "freemium",
- "bestFor": "IP threat tracking",
- "input": "IP address or threat indicator",
- "output": "Malware and threat reports",
- "opsec": "passive",
- "opsecNote": "Passive threat database queries",
- "localInstall": false,
- "googleDork": false,
- "registration": true,
- "editUrl": false,
- "api": true,
- "invitationOnly": false,
- "deprecated": false
- },
- {
- "name": "mlsecproject / combine",
- "type": "url",
- "url": "https://github.com/mlsecproject/combine",
- "description": "Tool for gathering and normalizing threat intelligence feeds from public sources.",
- "status": "live",
- "pricing": "free",
- "bestFor": "Threat feed aggregation",
- "input": "Multiple threat intelligence feeds",
- "output": "Normalized IOC data in CSV or CRITs format",
- "opsec": "passive",
- "opsecNote": "Local processing of public feeds",
- "localInstall": true,
- "googleDork": false,
- "registration": false,
- "editUrl": false,
- "api": false,
- "invitationOnly": false,
- "deprecated": false
- },
- {
- "name": "hostintel - keithjjones Github",
- "type": "url",
- "url": "https://github.com/keithjjones/hostintel",
- "description": "Modular Python application to collect host and malicious IP intelligence.",
- "status": "live",
- "pricing": "free",
- "bestFor": "Host intelligence gathering",
- "input": "IP, FQDN, or domain name",
- "output": "Intelligence data in CSV format",
- "opsec": "passive",
- "opsecNote": "Local tool for passive host analysis",
- "localInstall": true,
- "googleDork": false,
- "registration": false,
- "editUrl": false,
- "api": false,
- "invitationOnly": false,
- "deprecated": false
- },
- {
- "name": "massive-octo-spice - csirtgadgets Github",
- "type": "url",
- "url": "https://github.com/csirtgadgets/massive-octo-spice",
- "description": "CSIRT threat intelligence platform (deprecated - use bearded-avenger v3 instead).",
- "status": "degraded",
- "pricing": "free",
- "bestFor": "Legacy CSIRT intelligence platform",
- "input": "Threat intelligence feeds",
- "output": "Aggregated threat data",
- "opsec": "passive",
- "opsecNote": "Local platform for threat aggregation",
- "localInstall": true,
- "googleDork": false,
- "registration": false,
- "editUrl": false,
- "api": false,
- "invitationOnly": false,
- "deprecated": true
- },
- {
- "name": "Scam Database",
- "type": "url",
- "url": "https://www.scamdb.net/",
- "description": "User-contributed database of scam reports searchable by phone, email, and website.",
- "status": "live",
- "pricing": "free",
- "bestFor": "Scam and fraud reporting",
- "input": "Phone, email, or website",
- "output": "Unverified scam reports and details",
- "opsec": "passive",
- "opsecNote": "Passive lookup of community reports",
- "localInstall": false,
- "googleDork": false,
- "registration": true,
- "editUrl": false,
- "api": false,
- "invitationOnly": false,
- "deprecated": false
- },
- {
- "name": "Bot Scout",
- "type": "url",
- "url": "https://botscout.com/",
- "description": "Service tracking bot signatures (names, IPs, emails) to prevent automated spam and abuse.",
- "status": "live",
- "pricing": "freemium",
- "bestFor": "Bot and spam detection",
- "input": "IP, email, or username",
- "output": "Bot activity and spam records",
- "opsec": "passive",
- "opsecNote": "Passive honeypot-based detection",
- "localInstall": false,
- "googleDork": false,
- "registration": true,
- "editUrl": false,
- "api": true,
- "invitationOnly": false,
- "deprecated": false
- },
- {
- "name": "APTnotes",
- "type": "url",
- "url": "https://github.com/aptnotes/data",
- "description": "Repository of public documents, whitepapers, and articles about APT campaigns.",
- "status": "live",
- "pricing": "free",
- "bestFor": "APT research and threat analysis",
- "input": "Search APT campaign documents",
- "output": "Threat reports and analysis",
- "opsec": "passive",
- "opsecNote": "Passive access to public threat research",
- "localInstall": false,
- "googleDork": false,
- "registration": false,
- "editUrl": false,
- "api": false,
- "invitationOnly": false,
- "deprecated": false
- },
- {
- "name": "HoneyDB",
- "type": "url",
- "url": "https://honeydb.io/",
- "description": "Honeypot network providing real-time IoT and server threat intelligence via REST API.",
- "status": "live",
- "pricing": "freemium",
- "bestFor": "IoT honeypot intelligence",
- "input": "IP address or attack queries",
- "output": "Honeypot interaction logs and threat data",
- "opsec": "passive",
- "opsecNote": "Passive honeypot-based intelligence",
- "localInstall": false,
- "googleDork": false,
- "registration": true,
- "editUrl": false,
- "api": true,
- "invitationOnly": false,
- "deprecated": false
- },
- {
- "name": "Pulsedive",
- "type": "url",
- "url": "https://pulsedive.com/",
- "description": "Free threat intelligence platform for enriching IPs, URLs, domains, and IOCs from OSINT feeds.",
- "status": "live",
- "pricing": "freemium",
- "bestFor": "IOC enrichment and risk scoring",
- "input": "IP, URL, domain, or IOC",
- "output": "Enriched threat intelligence and risk factors",
- "opsec": "passive",
- "opsecNote": "Passive querying of enrichment database",
- "localInstall": false,
- "googleDork": false,
- "registration": true,
- "editUrl": false,
- "api": true,
- "invitationOnly": false,
- "deprecated": false
- },
- {
- "name": "Mr.Looquer IOC Feed - 1st Dual Stack Threat Feed",
- "type": "url",
- "url": "https://iocfeed.mrlooquer.com/",
- "description": "Threat intelligence feed providing IOC data with IPv4/IPv6 dual stack support.",
- "status": "live",
- "pricing": "free",
- "bestFor": "IOC threat feed access",
- "input": "Feed subscription",
- "output": "IOC threat intelligence feed",
- "opsec": "passive",
- "opsecNote": "Passive threat feed consumption",
- "localInstall": false,
- "googleDork": false,
- "registration": false,
- "editUrl": false,
- "api": false,
- "invitationOnly": false,
- "deprecated": false
- },
- {
- "name": "REScure Cyber Threat Intelligence Project",
- "type": "url",
- "url": "https://rescure.me/",
- "description": "Community-driven cyber threat intelligence project providing IOC feeds and research.",
- "status": "live",
- "pricing": "free",
- "bestFor": "Threat intelligence feeds",
- "input": "IOC feed subscription",
- "output": "IOC threat intelligence",
- "opsec": "passive",
- "opsecNote": "Passive threat feed access",
- "localInstall": false,
- "googleDork": false,
- "registration": false,
- "editUrl": false,
- "api": false,
- "invitationOnly": false,
- "deprecated": false
- },
- {
- "name": "Attack Surface / Security Testing",
- "type": "folder",
+ "name": "Threat Feeds & Platforms",
"children": [
{
- "name": "ImmuniWeb",
+ "name": "IBM X-Force Exchange",
"type": "url",
- "url": "https://www.immuniweb.com/",
- "description": "AI-powered application security platform for web penetration testing and vulnerability scanning.",
+ "url": "https://exchange.xforce.ibmcloud.com/",
+ "description": "Collaborative threat intelligence platform with malware, vulnerability, and campaign data.",
"status": "live",
"pricing": "freemium",
- "bestFor": "Web security testing and scanning",
- "input": "Web application or target URL",
- "output": "Vulnerability reports and risk assessment",
- "opsec": "active",
- "opsecNote": "Performs actual penetration testing and scanning - generates server logs",
+ "bestFor": "Malware and threat intelligence",
+ "input": "IOC, domain, or malware sample",
+ "output": "Threat analysis and intelligence reports",
+ "opsec": "passive",
+ "opsecNote": "Passive querying of threat database",
"localInstall": false,
"googleDork": false,
"registration": true,
@@ -21140,6 +20737,416 @@
"api": true,
"invitationOnly": false,
"deprecated": false
+ },
+ {
+ "name": "Malware Information Sharing Platform",
+ "type": "url",
+ "url": "https://www.misp-project.org/",
+ "description": "Open-source platform for collecting, storing, and sharing cyber threat indicators and malware data.",
+ "status": "live",
+ "pricing": "free",
+ "bestFor": "Threat intelligence sharing",
+ "input": "Threat indicators and malware samples",
+ "output": "Structured threat intelligence and correlations",
+ "opsec": "passive",
+ "opsecNote": "Local platform for passive sharing",
+ "localInstall": true,
+ "googleDork": false,
+ "registration": false,
+ "editUrl": false,
+ "api": true,
+ "invitationOnly": false,
+ "deprecated": false
+ },
+ {
+ "name": "Malware Patrol",
+ "type": "url",
+ "url": "https://www.malwarepatrol.net/",
+ "description": "Threat intelligence feed service providing malware samples, URLs, domains, and IOC data.",
+ "status": "live",
+ "pricing": "freemium",
+ "bestFor": "Malware IOC and feed intelligence",
+ "input": "IOC queries or feed subscriptions",
+ "output": "Malware hashes, URLs, and threat intel",
+ "opsec": "passive",
+ "opsecNote": "Passive consumption of threat feeds",
+ "localInstall": false,
+ "googleDork": false,
+ "registration": true,
+ "editUrl": false,
+ "api": true,
+ "invitationOnly": false,
+ "deprecated": false
+ },
+ {
+ "name": "AlienVault OTX",
+ "type": "url",
+ "url": "https://otx.alienvault.com/",
+ "description": "Crowd-sourced threat intelligence platform with 180K+ participants sharing 19M+ daily threats.",
+ "status": "live",
+ "pricing": "free",
+ "bestFor": "Community threat intelligence",
+ "input": "IOC, domain, IP, or search query",
+ "output": "Community threat pulses and analysis",
+ "opsec": "passive",
+ "opsecNote": "Passive community threat data sharing",
+ "localInstall": false,
+ "googleDork": false,
+ "registration": true,
+ "editUrl": false,
+ "api": true,
+ "invitationOnly": false,
+ "deprecated": false
+ },
+ {
+ "name": "FireHOL IP Lists ",
+ "type": "url",
+ "url": "https://iplists.firehol.org/",
+ "description": "Collection of firewall-friendly IP blacklists for blocking malicious and spam sources.",
+ "status": "live",
+ "pricing": "free",
+ "bestFor": "IP reputation and blocking",
+ "input": "IP address or list subscription",
+ "output": "Blacklist membership status",
+ "opsec": "passive",
+ "opsecNote": "Passive lookup of public reputation lists",
+ "localInstall": false,
+ "googleDork": false,
+ "registration": false,
+ "editUrl": false,
+ "api": true,
+ "invitationOnly": false,
+ "deprecated": false
+ },
+ {
+ "name": "Maltiverse",
+ "type": "url",
+ "url": "https://maltiverse.com/",
+ "description": "Threat intelligence platform aggregating 100+ sources with real-time IOC scoring.",
+ "status": "live",
+ "pricing": "freemium",
+ "bestFor": "IOC aggregation and scoring",
+ "input": "IOC or threat indicator",
+ "output": "Threat scores and context",
+ "opsec": "passive",
+ "opsecNote": "Passive aggregation of threat data",
+ "localInstall": false,
+ "googleDork": false,
+ "registration": true,
+ "editUrl": false,
+ "api": true,
+ "invitationOnly": false,
+ "deprecated": false
+ },
+ {
+ "name": "Malpedia",
+ "type": "url",
+ "url": "https://malpedia.caad.fkie.fraunhofer.de/",
+ "description": "Free collaborative malware database from Fraunhofer FKIE with 600+ malware families.",
+ "status": "live",
+ "pricing": "freemium",
+ "bestFor": "Malware family identification",
+ "input": "Malware sample or family name",
+ "output": "Malware family analysis and YARA rules",
+ "opsec": "passive",
+ "opsecNote": "Passive malware research database",
+ "localInstall": false,
+ "googleDork": false,
+ "registration": true,
+ "editUrl": false,
+ "api": true,
+ "invitationOnly": true,
+ "deprecated": false
+ },
+ {
+ "name": "Project Honey Pot",
+ "type": "url",
+ "url": "https://www.projecthoneypot.org/",
+ "description": "Distributed honeypot project tracking email harvesters, spam servers, and malicious IPs.",
+ "status": "live",
+ "pricing": "free",
+ "bestFor": "Spam and harvester tracking",
+ "input": "IP address or email domain",
+ "output": "Harvester and spam activity records",
+ "opsec": "passive",
+ "opsecNote": "Passive honeypot intelligence",
+ "localInstall": false,
+ "googleDork": false,
+ "registration": true,
+ "editUrl": false,
+ "api": true,
+ "invitationOnly": false,
+ "deprecated": false
+ },
+ {
+ "name": "Cymon Open Threat Intelligence",
+ "type": "url",
+ "url": "https://cymon.io/",
+ "description": "Largest open tracker of malware, phishing, botnets containing 6M+ malicious IPs.",
+ "status": "live",
+ "pricing": "freemium",
+ "bestFor": "IP threat tracking",
+ "input": "IP address or threat indicator",
+ "output": "Malware and threat reports",
+ "opsec": "passive",
+ "opsecNote": "Passive threat database queries",
+ "localInstall": false,
+ "googleDork": false,
+ "registration": true,
+ "editUrl": false,
+ "api": true,
+ "invitationOnly": false,
+ "deprecated": false
+ },
+ {
+ "name": "mlsecproject / combine",
+ "type": "url",
+ "url": "https://github.com/mlsecproject/combine",
+ "description": "Tool for gathering and normalizing threat intelligence feeds from public sources.",
+ "status": "live",
+ "pricing": "free",
+ "bestFor": "Threat feed aggregation",
+ "input": "Multiple threat intelligence feeds",
+ "output": "Normalized IOC data in CSV or CRITs format",
+ "opsec": "passive",
+ "opsecNote": "Local processing of public feeds",
+ "localInstall": true,
+ "googleDork": false,
+ "registration": false,
+ "editUrl": false,
+ "api": false,
+ "invitationOnly": false,
+ "deprecated": false
+ },
+ {
+ "name": "hostintel - keithjjones Github",
+ "type": "url",
+ "url": "https://github.com/keithjjones/hostintel",
+ "description": "Modular Python application to collect host and malicious IP intelligence.",
+ "status": "live",
+ "pricing": "free",
+ "bestFor": "Host intelligence gathering",
+ "input": "IP, FQDN, or domain name",
+ "output": "Intelligence data in CSV format",
+ "opsec": "passive",
+ "opsecNote": "Local tool for passive host analysis",
+ "localInstall": true,
+ "googleDork": false,
+ "registration": false,
+ "editUrl": false,
+ "api": false,
+ "invitationOnly": false,
+ "deprecated": false
+ },
+ {
+ "name": "massive-octo-spice - csirtgadgets Github",
+ "type": "url",
+ "url": "https://github.com/csirtgadgets/massive-octo-spice",
+ "description": "CSIRT threat intelligence platform (deprecated - use bearded-avenger v3 instead).",
+ "status": "degraded",
+ "pricing": "free",
+ "bestFor": "Legacy CSIRT intelligence platform",
+ "input": "Threat intelligence feeds",
+ "output": "Aggregated threat data",
+ "opsec": "passive",
+ "opsecNote": "Local platform for threat aggregation",
+ "localInstall": true,
+ "googleDork": false,
+ "registration": false,
+ "editUrl": false,
+ "api": false,
+ "invitationOnly": false,
+ "deprecated": true
+ },
+ {
+ "name": "Scam Database",
+ "type": "url",
+ "url": "https://www.scamdb.net/",
+ "description": "User-contributed database of scam reports searchable by phone, email, and website.",
+ "status": "live",
+ "pricing": "free",
+ "bestFor": "Scam and fraud reporting",
+ "input": "Phone, email, or website",
+ "output": "Unverified scam reports and details",
+ "opsec": "passive",
+ "opsecNote": "Passive lookup of community reports",
+ "localInstall": false,
+ "googleDork": false,
+ "registration": true,
+ "editUrl": false,
+ "api": false,
+ "invitationOnly": false,
+ "deprecated": false
+ },
+ {
+ "name": "Bot Scout",
+ "type": "url",
+ "url": "https://botscout.com/",
+ "description": "Service tracking bot signatures (names, IPs, emails) to prevent automated spam and abuse.",
+ "status": "live",
+ "pricing": "freemium",
+ "bestFor": "Bot and spam detection",
+ "input": "IP, email, or username",
+ "output": "Bot activity and spam records",
+ "opsec": "passive",
+ "opsecNote": "Passive honeypot-based detection",
+ "localInstall": false,
+ "googleDork": false,
+ "registration": true,
+ "editUrl": false,
+ "api": true,
+ "invitationOnly": false,
+ "deprecated": false
+ },
+ {
+ "name": "APTnotes",
+ "type": "url",
+ "url": "https://github.com/aptnotes/data",
+ "description": "Repository of public documents, whitepapers, and articles about APT campaigns.",
+ "status": "live",
+ "pricing": "free",
+ "bestFor": "APT research and threat analysis",
+ "input": "Search APT campaign documents",
+ "output": "Threat reports and analysis",
+ "opsec": "passive",
+ "opsecNote": "Passive access to public threat research",
+ "localInstall": false,
+ "googleDork": false,
+ "registration": false,
+ "editUrl": false,
+ "api": false,
+ "invitationOnly": false,
+ "deprecated": false
+ },
+ {
+ "name": "HoneyDB",
+ "type": "url",
+ "url": "https://honeydb.io/",
+ "description": "Honeypot network providing real-time IoT and server threat intelligence via REST API.",
+ "status": "live",
+ "pricing": "freemium",
+ "bestFor": "IoT honeypot intelligence",
+ "input": "IP address or attack queries",
+ "output": "Honeypot interaction logs and threat data",
+ "opsec": "passive",
+ "opsecNote": "Passive honeypot-based intelligence",
+ "localInstall": false,
+ "googleDork": false,
+ "registration": true,
+ "editUrl": false,
+ "api": true,
+ "invitationOnly": false,
+ "deprecated": false
+ },
+ {
+ "name": "Pulsedive",
+ "type": "url",
+ "url": "https://pulsedive.com/",
+ "description": "Free threat intelligence platform for enriching IPs, URLs, domains, and IOCs from OSINT feeds.",
+ "status": "live",
+ "pricing": "freemium",
+ "bestFor": "IOC enrichment and risk scoring",
+ "input": "IP, URL, domain, or IOC",
+ "output": "Enriched threat intelligence and risk factors",
+ "opsec": "passive",
+ "opsecNote": "Passive querying of enrichment database",
+ "localInstall": false,
+ "googleDork": false,
+ "registration": true,
+ "editUrl": false,
+ "api": true,
+ "invitationOnly": false,
+ "deprecated": false
+ },
+ {
+ "name": "Mr.Looquer IOC Feed - 1st Dual Stack Threat Feed",
+ "type": "url",
+ "url": "https://iocfeed.mrlooquer.com/",
+ "description": "Threat intelligence feed providing IOC data with IPv4/IPv6 dual stack support.",
+ "status": "live",
+ "pricing": "free",
+ "bestFor": "IOC threat feed access",
+ "input": "Feed subscription",
+ "output": "IOC threat intelligence feed",
+ "opsec": "passive",
+ "opsecNote": "Passive threat feed consumption",
+ "localInstall": false,
+ "googleDork": false,
+ "registration": false,
+ "editUrl": false,
+ "api": false,
+ "invitationOnly": false,
+ "deprecated": false
+ },
+ {
+ "name": "REScure Cyber Threat Intelligence Project",
+ "type": "url",
+ "url": "https://rescure.me/",
+ "description": "Community-driven cyber threat intelligence project providing IOC feeds and research.",
+ "status": "live",
+ "pricing": "free",
+ "bestFor": "Threat intelligence feeds",
+ "input": "IOC feed subscription",
+ "output": "IOC threat intelligence",
+ "opsec": "passive",
+ "opsecNote": "Passive threat feed access",
+ "localInstall": false,
+ "googleDork": false,
+ "registration": false,
+ "editUrl": false,
+ "api": false,
+ "invitationOnly": false,
+ "deprecated": false
+ }
+ ]
+ },
+ {
+ "name": "TTPs",
+ "children": [
+ {
+ "name": "Malware Exploit TTP Database",
+ "type": "url",
+ "url": "https://www.pwnmalw.re/",
+ "description": "Malware exploit database documenting security vulnerabilities in malware families (offline).",
+ "status": "down",
+ "pricing": "free",
+ "bestFor": "Malware exploit research",
+ "input": "Malware name or exploit query",
+ "output": "Exploit documentation and vulnerability details",
+ "opsec": "passive",
+ "opsecNote": "Passive lookup when functional",
+ "localInstall": false,
+ "googleDork": false,
+ "registration": false,
+ "editUrl": false,
+ "api": false,
+ "invitationOnly": false,
+ "deprecated": true
+ },
+ {
+ "name": "Mitre TTPs",
+ "type": "url",
+ "url": "https://attack.mitre.org/",
+ "description": "MITRE ATT&CK framework: globally-accessible knowledge base of adversary tactics and techniques.",
+ "status": "live",
+ "pricing": "free",
+ "bestFor": "Threat modeling and TTP analysis",
+ "input": "Search for tactics, techniques, or threat groups",
+ "output": "Technique descriptions and mitigation strategies",
+ "opsec": "passive",
+ "opsecNote": "Passive research of public threat intelligence",
+ "localInstall": false,
+ "googleDork": false,
+ "registration": false,
+ "editUrl": false,
+ "api": true,
+ "invitationOnly": false,
+ "deprecated": false
+ },
+ {
+ "name": "MITRE ATT&CK",
+ "type": "url",
+ "url": "https://attack.mitre.org/"
}
]
}
@@ -21417,7 +21424,7 @@
"url": "https://themanyhats.club/centralised-place-for-privacy-resources/"
},
{
- "name": "The Hitchhiker’s Guide to Online Anonymity",
+ "name": "The Hitchhiker\u2019s Guide to Online Anonymity",
"type": "url",
"url": "https://anonymousplanet.org/guide/"
},