Blueteam Python Packages

maigret

🕵️‍♂️ Collect a dossier on a person by username from 3000+ sites

theharvester

E-mails, subdomains and names Harvester - OSINT

pyloobins

Living Off the Orchard: macOS Binaries (LOOBins) is designed to provide detailed information on various built-in "living off the land" macOS binaries and how they can be used by threat actors for malicious purposes.

vulnparse-pin

Vulnerability Intelligence and Decision Support Engine - Parse, enrich, prioritize, and report on security scan results.

yaralyzer

Visually inspect and force decode YARA and regex matches found in both binary and text data with colors. Lots of colors.

slack-watchman

Slack enumeration and exposed secrets detection tool

defaultcreds-cheat-sheet

One place for all the default credentials to assist the Blue/Red teamers identifying devices with default password 🛡️

favicorn-osint

All-sources tool to search websites by favicons

ransomwatch

Ransomware Intelligence Tool - Designed for threat intelligence, security research, and situational awareness

certpatrol-orchestrator

Process orchestration platform for managing multiple CertPatrol instances

crack-o-matic

Find and notify users in your Active Directory with weak passwords

fibratus

Adversary tradecraft detection, protection, and hunting

plumhound

Bloodhound Reporting for Blue and Purple Teams

goodhound

Uses Sharphound, Bloodhound and Neo4j to produce an actionable list of attack paths for targeted remediation.

gitlab-watchman

Finding exposed secrets and personal data in GitLab

gtfobins-cli

Command-line tool for GTFOBins - Unix binaries exploitation helper

skipper-cli

python SOC Automation & Recon Toolkit - Port scanner, threat intel, log analyser

slack-watchman-eg

Monitoring your Slack Enterprise Grid for sensitive information

github-watchman

Monitoring GitHub for sensitive data shared publicly

certpatrol

A fast, lightweight Certificate Transparency (CT) log tailer for your terminal. Filter domains with regex, run locally for privacy, and monitor in real time — no third-party servers, no tracking. A modern, local, privacy-friendly CertStream alternative.

stack-overflow-watchman

Detecting exposed secrets in Stack Overflow Enterprise for Teams

urlbreakdown

splits a URL into individual components, unescapes arguments, and performs light calculations for manual or automated analysis

honeycheck

Honeycheck detects rogue dhcp servers and provides a modular and fully configurable action environment in case they are found

trello-watchman

Monitoring your Trello boards for sensitive information