Blueteam Python Packages

maigret

🕵️‍♂️ Collect a dossier on a person by username from 3000+ sites

theharvester

E-mails, subdomains and names Harvester - OSINT

pyloobins

Living Off the Orchard: macOS Binaries (LOOBins) is designed to provide detailed information on various built-in "living off the land" macOS binaries and how they can be used by threat actors for malicious purposes.

yaralyzer

Visually inspect and force decode YARA and regex matches found in both binary and text data with colors. Lots of colors.

vulnparse-pin

A Vulnerability Intelligence and Decision Support Engine — Making Vulnerability Triage Faster and Remediation Decisions Explainable

slack-watchman

Slack enumeration and exposed secrets detection tool

defaultcreds-cheat-sheet

One place for all the default credentials to assist the Blue/Red teamers identifying devices with default password 🛡️

ransomwatch

ransomwatch is a Python based tool designed for ransomware threat intelligence and security research.

goodhound

Attackers think in graphs, defenders think in actions, management think in charts. GoodHound operationalises Bloodhound by determining the busiest paths to high value targets and creating actionable output to prioritise remediation of attack paths.

gitlab-watchman

Finding exposed secrets and personal data in GitLab

plumhound

BloodHoundAD reporting engine for Blue and Purple Teams

skipper-cli

python SOC Automation & Recon Toolkit - Port scanner, threat intel, log analyser

certpatrol-orchestrator

Process orchestration platform for managing multiple CertPatrol instances with a modern web interface.

crack-o-matic

Find and notify users in your Active Directory with weak passwords

fibratus

Adversary tradecraft detection, protection, and hunting

gtfobins-cli

Command-line tool for GTFOBins - Unix binaries exploitation helper

slack-watchman-eg

Monitoring your Slack Enterprise Grid for sensitive information

github-watchman

Monitoring GitHub for sensitive data shared publicly

certpatrol

A fast, lightweight Certificate Transparency (CT) log tailer for your terminal. Filter domains with regex, run locally for privacy, and monitor in real time — no third-party servers, no tracking. A modern, local, privacy-friendly CertStream alternative.

stack-overflow-watchman

Detecting exposed secrets in Stack Overflow Enterprise for Teams

urlbreakdown

splits a URL into individual components, unescapes arguments, and performs light calculations for manual or automated analysis

honeycheck

Honeycheck detects rogue dhcp servers and provides a modular and fully configurable action environment in case they are found

trello-watchman

Monitoring your Trello boards for sensitive information