Scripts

A Session Hijacking Prevention Script helps protect web applications by detecting and blocking unauthorized access to user sessions. It monitors session integrity, validates user IP addresses and user-agents, and regenerates session IDs periodically to minimize the risk of session theft. By enforcing secure cookies, HTTPS, and inactivity timeouts, it ensures that attackers cannot impersonate legitimate […]

A Ransomware Behavior Tracker monitors system activity to detect suspicious patterns typical of ransomware attacks, such as rapid file encryption, mass renaming, or unusual process behavior.It alerts security teams in real-time to prevent data loss and supports automated containment actions to stop the spread.Ideal for endpoint protection, it helps organizations quickly identify and respond to […]

A DNS Spoofing Detector checks DNS responses from multiple trusted resolvers and flags inconsistencies that may indicate cache poisoning or man-in-the-middle manipulation.It compares A-record answers across resolvers (e.g., Google, Cloudflare, Quad9) and highlights unexpected or differing IPs for the same hostname.Use it as an early-warning tool—investigate mismatches, verify authoritative nameservers, and avoid trusting a single […]

A File Integrity Monitoring Tool continuously monitors critical system files and directories to detect unauthorized changes, additions, or deletions that could indicate malicious activity. It logs all modifications, generates alerts for suspicious changes, and helps maintain compliance with security policies. By providing real-time monitoring and tamper-evident audit trails, it allows organizations to quickly identify potential […]

A tool that automatically probes web applications and database inputs with crafted payloads to detect SQL injection weaknesses by analyzing responses and behavior.It helps developers and security teams locate exploitable input fields, unsafe query constructions, and error-based information leaks so vulnerabilities can be fixed early.Delivers clear findings with risk levels and remediation advice — and […]

Scans email bodies for suspicious keywords and risky URLs. Flags likely phishing attempts for triage (not a final verdict). Good for demoing gateway-level filtering or analyst triage steps. Can be extended with domain checks, ML models, or quarantine actions.

Recursively scans files for known malicious code patterns and moves hits to quarantine. Fast way to triage web shells or injected scripts on a web host. Outputs findings and can preserve quarantined samples for analysis. Best used with backups and combined with YARA or AV for higher fidelity.

Parses logs to find IPs with repeated failed authentication attempts. Alerts on thresholds within a time window to spot brute-force activity. Ideal for SIEM ingestion, automated alerts, or temporary blocking rules. Careful with NATed IPs — tune thresholds to avoid false positives.