Open Source C++ Cybersecurity Tools

justniffer is a TCP sniffer. It reassembles and reorders packets and displays the tcp flow in a customizable way. It can log network traffic in web server log format. It can also log network services performances (e.g. web server response times) and extract http content (images, html, scripts, etc)

USBShield stands out as a free and open-source option for users seeking security against unauthorized USB access. Unlike many competing paid solutions, it offers extensive usability through its portable format and easy rule syntax, along with essential functionalities like automatic device disabling and thorough event logging. If you're looking for a straightforward yet effective means to safeguard your Windows system from unauthorized USB use, USBShield is a reliable choice.

A version of Midbar data vault adapted for the ESP32 CYD and WebFlash. It keeps the cryptographic keys in the ESP32 RAM and stores the ciphertexts (encrypted data) in the Google Firebase. The tutorial is available at: https://www.instructables.com/How-to-Turn-ESP32-CYD-Into-a-Secure-IoT-Data-Vault/ WebFlash for ESP32-CYD: https://northstrix.github.io/Midbar-ESP32-CYD-Firebase-Edition/flash WebFlash for ESP32-CYD2USB: https://northstrix.github.io/Midbar-ESP32-CYD2USB-Firebase-Edition/flash

Midbar Firebase Edition - is the edition of Midbar that stores the encrypted data in the cloud while keeping the cryptographic keys on the device! It comes with the firmware for the hardware IoT data vault and the desktop app that's synced with the vault via the Google Firebase. A vault and an app can be used without one another. The GitHub repository is available at github.com/Northstrix/Midbar-Firebase-Edition Tutorial for V1 https://www.instructables.com/DIY-IoT-Data-Vault-With-Google-Firebase/ Tutorial for V2 https://medium.com/@Northstrix/syncing-mcu-password-vault-with-desktop-app-using-google-firebase-28963e060444 Tutorial for V3 https://www.instructables.com/DIY-Advanced-IoT-Password-Vault-Synced-With-Deskto/ GitHub Repository: https://github.com/Northstrix/Midbar-Firebase-Edition

Passive-Network-Scan-L2/3 is a lightweight, passive network discovery tool that listens on a network interface in promiscuous mode and collects Layer 2 and Layer 3 signalling (ARP, STP, DHCP, mDNS, SSDP). It aggregates discovered hosts by MAC address, attempts to measure passive RTTs for request/response protocols, maintains per-protocol RTT histories and simple service hints, and can emit structured events and a final table in JSON or CSV formats.

The EaseFilter Process Filter Driver SDK is a kernel-mode development kit designed to help developers monitor and control Windows process and thread activities. By intercepting process and thread operations at the kernel level, it enables the development of robust security applications that can prevent unauthorized or malicious processes from executing. With the Process Filter Driver, it allows you to prevent the untrusted executable binaries (malwares) from being launched, protect your data being damaged by the untrusted processes. It also enables your application to get the callback notification for the process/thread creation or termination, from the new process information you can get the parent process Id and thread Id of the new created process, you also can get the exact file name that is used to open the executable file and the command line that is used to execute the process if it is available.

The EaseFilter Registry Filter Driver SDK is a powerful, kernel-mode development toolkit designed to help developers monitor, control, and protect Windows registry operations in real time. It enables the development of robust security, compliance, and system integrity solutions by intercepting and managing registry access before it reaches the Windows registry subsystem. The SDK allows your application to receive notifications before any registry operation is processed by the Windows Configuration Manager. By registering a RegistryCallback routine, your application can detect: Registry key creation, deletion, renaming Registry value changes Query operations

Remme Protocol is a blockchain-based protocol focused on digital key and identity lifecycle management to resolve issues related to cybersecurity, IoT connectivity, data integrity, digital copyright protection, transparency etc. Some of the groundbreaking features include: - Free Rate Limited Transactions - Low Latency Block confirmation (0.5 seconds) - Attribute-based identity and access control - Designed for Sparse Header Light Client Validation - Time Delay Security - Hierarchical Role Based Permissions - Support for Biometric Hardware Secured Keys (e.g. Apple Secure Enclave) - Designed for Parallel Execution of Context Free Validation Logic - Designed for Inter Blockchain Communication Read the Tech paper here: https://github.com/Remmeauth/Documentation/blob/master/RemmeProtocolTechPaper.md

EaseFilter Secure Sandbox was developed by a set of file system filter driver software development kit which includes file access control filter driver, transparent file encryption filter driver and process filter driver. The EaseFilter Secure Sandbox encompasses file security, file encryption, file monitoring, data loss prevention and process monitoring and protection. EaseFilter file system filter driver is a kernel-mode component that runs as part of the Windows executive above the file system. The EaseFilter file system filter driver can intercept requests targeted at a file system or another file system filter driver. By intercepting the request before it reaches its intended target, the filter driver can extend or replace functionality provided by the original target of the request. The EaseFilter file system filter driver can log, observe, modify, or even prevent the I/O operations for one or more file systems or file system volumes.