Commits

Branch selector

main

User selector

All users

Datepicker

All time

Commit history

Commits on Aug 10, 2026

• Read a captured binary by its strings, not 16,384 lines of hex

  Show description for 3d12558
  

  AfterPacket

  and

  claude

  committed
  3d12558View commit details

  Copy full SHA for 3d12558

  Browse repository at this point

• Set the exec bit on the remaining deploy shell scripts

  Show description for cb803cd
  AfterPacket

  committed
  cb803cdView commit details

  Copy full SHA for cb803cd

  Browse repository at this point

• Same-subnet RETURN only: the cross product opened honeypot to Kibana

  Show description for acc0f7b
  AfterPacket

  committed
  acc0f7bView commit details

  Copy full SHA for acc0f7b

  Browse repository at this point

• Do not let a missing viewer element disable the whole loot page

  Show description for 99702b1
  AfterPacket

  committed
  99702b1View commit details

  Copy full SHA for 99702b1

  Browse repository at this point

• Close the Kibana egress hole and audit the tunnel that replaces it

  Show description for ec509eb
  AfterPacket

  committed
  ec509ebView commit details

  Copy full SHA for ec509eb

  Browse repository at this point

• Read a captured sample without anything having parsed it

  Show description for b6b1407
  AfterPacket

  committed
  b6b1407View commit details

  Copy full SHA for b6b1407

  Browse repository at this point

• Set the exec bit on the deploy/ python tools

  Show description for 2ad4a58
  AfterPacket

  committed
  2ad4a58View commit details

  Copy full SHA for 2ad4a58

  Browse repository at this point

• Make verify-loot-provenance.py executable

  Show description for 74ab2ae
  AfterPacket

  committed
  74ab2aeView commit details

  Copy full SHA for 74ab2ae

  Browse repository at this point

• Say which captured samples have quotable hashes

  Show description for c006f85
  AfterPacket

  committed
  c006f85View commit details

  Copy full SHA for c006f85

  Browse repository at this point

Commits on Aug 7, 2026

• Follow the retrieval chain to the payload, not just to the script

  Show description for 61baf7e
  AfterPacket

  committed
  61baf7eView commit details

  Copy full SHA for 61baf7e

  Browse repository at this point

Commits on Aug 5, 2026

• Add a pruner for the partial samples the capture bug left behind

  Show description for 7b024b0
  AfterPacket

  committed
  7b024b0View commit details

  Copy full SHA for 7b024b0

  Browse repository at this point

• Capture the dropper, not eleven prefixes of it

  Show description for 54e158c
  AfterPacket

  committed
  54e158cView commit details

  Copy full SHA for 54e158c

  Browse repository at this point

• Add SISTER_DASHBOARD_URL/NAME to admin-dashboard environment

  Show description for de4e9f2
  

  AfterPacket

  and

  claude

  committed
  de4e9f2View commit details

  Copy full SHA for de4e9f2

  Browse repository at this point

• Link Drosera and Utricularia in footer for operators running both

  Show description for 8d3fc39
  

  AfterPacket

  and

  claude

  committed
  8d3fc39View commit details

  Copy full SHA for 8d3fc39

  Browse repository at this point

Commits on Aug 3, 2026

• Pace VirusTotal inside the free tier the comment claimed to respect

  Show description for f0ed0ce
  

  AfterPacket

  and

  claude

  committed
  f0ed0ceView commit details

  Copy full SHA for f0ed0ce

  Browse repository at this point

• Stop hammering VirusTotal after it has already said no

  Show description for 5ec569f
  

  AfterPacket

  and

  claude

  committed
  5ec569fView commit details

  Copy full SHA for 5ec569f

  Browse repository at this point

• Stop two opposite loot verdicts sharing the word "unknown"

  Show description for 95f3528
  

  AfterPacket

  and

  claude

  committed
  95f3528View commit details

  Copy full SHA for 95f3528

  Browse repository at this point

Commits on Aug 2, 2026

• Make loot verdicts groupable, and stop hiding the clean ones

  Show description for 7491f55
  

  AfterPacket

  and

  claude

  committed
  7491f55View commit details

  Copy full SHA for 7491f55

  Browse repository at this point

• Give the web tarpit a hold_kind too, or the chart shows the wrong 40%

  Show description for c426ede
  

  AfterPacket

  and

  claude

  committed
  c426edeView commit details

  Copy full SHA for c426ede

  Browse repository at this point

• One home for held_seconds, and a keyword to compare the mechanisms by

  Show description for dfaa473
  

  AfterPacket

  and

  claude

  committed
  dfaa473View commit details

  Copy full SHA for dfaa473

  Browse repository at this point

• Measure the bang's hold instead of assuming it

  Show description for 0896282
  

  AfterPacket

  and

  claude

  committed
  0896282View commit details

  Copy full SHA for 0896282

  Browse repository at this point

• Point the pyflakes hint at apt, not pip

  Show description for 010d00b
  

  AfterPacket

  and

  claude

  committed
  010d00bView commit details

  Copy full SHA for 010d00b

  Browse repository at this point

• Move the bang to the exit: nothing that lands leaves cleanly

  Show description for b93dd76
  

  AfterPacket

  and

  claude

  committed
  b93dd76View commit details

  Copy full SHA for b93dd76

  Browse repository at this point

• Add a loot page: search by hash, re-scan, encrypted download

  Show description for ac2a6e4
  

  AfterPacket

  and

  claude

  committed
  ac2a6e4View commit details

  Copy full SHA for ac2a6e4

  Browse repository at this point

• Stop ssh_crash sending a version string, which undid the hold and leaked

  Show description for 4eca6ba
  

  AfterPacket

  and

  claude

  committed
  4eca6baView commit details

  Copy full SHA for 4eca6ba

  Browse repository at this point

• Crash mode never ran on SSH; make it run, and hold instead of hanging up

  Show description for 45facdb
  

  AfterPacket

  and

  claude

  committed
  45facdbView commit details

  Copy full SHA for 45facdb

  Browse repository at this point

• Make crash mode visible, and add the CSRF check it shipped without

  Show description for 146cf60
  

  AfterPacket

  and

  claude

  committed
  146cf60View commit details

  Copy full SHA for 146cf60

  Browse repository at this point

• Drop the reverse nmap scan; give crash mode an off switch and a way out

  Show description for d9119c2
  

  AfterPacket

  and

  claude

  committed
  d9119c2View commit details

  Copy full SHA for d9119c2

  Browse repository at this point

• Add crash mode and reverse nmap scanning for attacker profiling

  Show description for 4cbd4c1
  

  AfterPacket

  and

  claude

  committed
  4cbd4c1View commit details

  Copy full SHA for 4cbd4c1

  Browse repository at this point

Commits on Aug 1, 2026

• Added Support for LLM

  AfterPacket

  committed
  0cafb55View commit details

  Copy full SHA for 0cafb55

  Browse repository at this point

• Ignore the local working notes and the demo deployment

  AfterPacket

  committed
  92d638cView commit details

  Copy full SHA for 92d638c

  Browse repository at this point

• Enrich events with the source ASN

  AfterPacket

  committed
  1a76993View commit details

  Copy full SHA for 1a76993

  Browse repository at this point

• Narrow the stall range and stop halving dropper chains

  AfterPacket

  committed
  ebbc994View commit details

  Copy full SHA for ebbc994

  Browse repository at this point

• Tag events with their MITRE ATT&CK technique

  AfterPacket

  committed
  c25d347View commit details

  Copy full SHA for c25d347

  Browse repository at this point

• Ship rotated log siblings the glob was silently skipping

  AfterPacket

  committed
  240a2c6View commit details

  Copy full SHA for 240a2c6

  Browse repository at this point