56c2b0233c
the hallway is four steps longer at night. i've confirmed this.
2026-06-18 17:40:31 -04:00
4bb95fdb97
feat(ja3-ja4-tls-fingerprinting): M11 forensic pcap report, criterion benches, TLS miss-rate counter
...
Add a --report flag to the pcap command that prints one forensic summary of
a whole capture (endpoint inventory, fingerprint distribution, intel verdicts,
detection alerts, and a coverage section with the TLS miss rate and throughput)
instead of the per-event stream, folding in intel and detection automatically
when a seeded database is present. Add a tls_handshakes_fingerprinted counter
and Counters::tls_miss_rate so truncated and multi-segment ClientHellos the
capture clipped are reported rather than mistaken for absence. Add criterion
benches over the vendored captures and the parse/hash hot path. Plus frontend
landing and asset polish.
2026-06-18 11:19:13 -04:00
b689b4ceb9
lol
2026-06-17 15:40:25 -04:00
c7e4f7572c
feat(hsm-emulator): materialize default key-usage attributes per object class
...
materializeDefaults now sets CKA_ENCRYPT/DECRYPT/SIGN/VERIFY/SIGN_RECOVER/VERIFY_RECOVER/WRAP/UNWRAP/DERIVE (plus ALWAYS_AUTHENTICATE for private keys) to CK_FALSE when absent, per CKO_PUBLIC_KEY/PRIVATE_KEY/SECRET_KEY; smoke sets the RSA wrap and recover usage flags.
2026-06-16 03:07:03 -04:00
1bb94b08eb
feat(ja3-ja4-tls-fingerprinting): M8 SQLite intel store + M9 detection engine
...
M8: tlsfp-intel crate with seeded fingerprint DB, JA4 fuzzy matcher, prevalence scoring.
M9: six detection rules (known_bad, ua_mismatch, os_mismatch, first_seen, fp_rotation, monoculture) over an observation/alert store (migration v2); --detect on pcap/live plus an intel alerts feed; user_agent plumbed through StreamEvent::HttpRequest.
M10 scaffolding: cybercore frontend, compose/infra/install groundwork (serve not yet wired).
Relicense MIT -> AGPL-3.0; ignore env/node_modules/dist; exclude seed CSVs from whitespace hooks.
2026-06-16 03:06:31 -04:00
7845d9a1d9
m1-7
2026-06-14 02:38:11 -04:00
e4207b343a
feat(ja3-ja4-tls-fingerprinting): JA3/JA4 TLS fingerprinting tool in Rust (M0-M5)
...
Passive TLS client and server fingerprinting from packet captures. Two-crate
workspace: tlsfp-core (parsing and fingerprint logic, no I/O, unsafe forbidden)
and tlsfp (clap CLI). Edition 2024, MSRV 1.85.
Core (M0-M4): a hand-rolled bounds-checked TLS parser for ClientHello,
ServerHello, and the TLS 1.2 Certificate chain, plus the full fingerprint
family computed byte-exact against published vectors: JA3/JA3S (MD5), JA4/JA4_r,
JA4S, JA4H, JA4X, and JA4T. GREASE is stripped, wire order and unknown cipher
and extension values are preserved.
Pipeline (M5): a pcap and pcapng file reader behind a PacketSource trait,
etherparse L2-L4 decode (Ethernet, raw IP, BSD loopback, Linux SLL and SLL2,
VLAN and QinQ), and a hand-rolled per-flow TCP reassembler with wrapping serial
arithmetic, out-of-order parking, first-write-wins overlap resolution, and
bounded memory. The tlsfp pcap subcommand fingerprints every handshake in a
capture, as readable lines or NDJSON.
Verified three ways: 94 tests including unit KATs, nine real-pcap full-pipeline
KATs against the FoxIO sample corpus, and property tests that reassemble
arbitrarily segmented and reordered streams. Builds clean on stable and MSRV
1.85; clippy -D warnings and rustfmt clean.
Test captures under testdata/pcap are vendored unmodified from the FoxIO ja4
repository with per-file SHA-256 provenance.
2026-06-10 08:01:24 -04:00
d03b9a37ad
fix(hsm-emulator): install.sh builds and validates the ReleaseSafe artifact
...
build_module printed (ReleaseSafe) but ran plain 'zig build', which is Debug here (preferred_optimize_mode only ships ReleaseSafe with --release). It left a 20M Debug .so labeled as the shipped build, and 'zig build smoke' would reinstall Debug over any ReleaseSafe artifact via its install-step dependency.
Run build + test + smoke with --release=safe so the script produces and validates the real 5.9M shipped artifact end to end. Kept check-only (no dependency auto-install): missing deps still hard-fail/warn with the exact apt command.
Verified: ./install.sh exits 0 on a clean tree, final zig-out/lib/libhsm.so is 5.9M ReleaseSafe, tests + smoke pass, pkcs11-tool loads it.
2026-06-02 08:01:48 -04:00
53fd886ed8
docs(hsm-emulator): M12 learn track + README flip
...
learn/: add 00-OVERVIEW, 01-CONCEPTS, 02-ARCHITECTURE, 03-IMPLEMENTATION, 04-CHALLENGES, and MECHANICS (the byte-by-byte crypto deep-dive). CONFORMANCE shipped in M11. Real-breach grounding, function/file code refs (no line numbers), no AI voice.
Project README: flip M0-stale to real M0-M11 (21 mechanisms, std.Io.randomSecure, roadmap done through M12, learn/ link table).
Root README: graduate HSM to a completed project (Full Source Code 32->33, C badge -> Zig, title + footer now link to source and learn/).
Verified docs-only: zig build test and zig build smoke both exit 0, smoke mechanisms=21, objdump -T shows only C_GetFunctionList. No source changed.
2026-06-02 07:28:08 -04:00
f70ca3f32c
feat(hsm-emulator): M10 crypto-surface, M11 conformance, deep-audit hardening
...
M10 (crypto-surface): RUP-safe buffered AES-GCM streaming (16 MiB cap),
DigestEncrypt/SignEncrypt/DecryptDigest/DecryptVerify dual functions
(decrypt-side CBC-only), RSA C_SignRecover/C_VerifyRecover (CKM_RSA_PKCS),
digest-only Get/SetOperationState.
M11 (conformance): spec-correct C_WaitForSlotEvent (DONT_BLOCK->CKR_NO_EVENT,
blocking->FUNCTION_NOT_SUPPORTED, pReserved->ARGUMENTS_BAD) + CKF_DONT_BLOCK;
public learn/CONFORMANCE.md documenting every deliberate N/A with its OASIS
v2.40 section and exact return code.
Deep project audit (5 read-only dimension agents, 0 Critical/High):
- fix: C_Finalize-vs-fast-path use-after-free race -- replace lockless
state.current() with state.acquire() (lock + verify-live atomically)
across all ~57 entry points
- fix: enforce CKR_PIN_LEN_RANGE on the new PIN in InitToken/InitPIN/SetPIN
- fix: clear a stale sealed flag on Object.set replace (login-unseal wedge)
- harden: zeroize CBC plaintext stack temporaries; Debug leak-assert at
C_Finalize turns smoke into an API-layer leak gate
- test: ABI layout-check PSS/OAEP param structs; +sealed-flag regression
Proven: 76/76 unit (Debug + ReleaseSafe), in-process smoke (with PIN-length
asserts), cross-process pkcs11-tool (init/pin/RSA keygen+sign/wrong-pin).
.so exports only C_GetFunctionList.
2026-06-02 06:48:25 -04:00
0b8f8df8a3
feat(hsm-emulator): M9 key management — wrap/unwrap, derive, digest-key
...
- C_WrapKey/C_UnwrapKey: CKM_AES_KEY_WRAP (RFC 3394) + CKM_RSA_PKCS_OAEP, secret keys only
- new AES-KEY-WRAP primitive in cipher.zig (RFC 3394 KAT-verified, fail-closed, zeroized temps)
- C_DeriveKey: factor shared secret-key-object builder; accept raw SEC1 or DER peer point
- C_DigestKey: secret-key class + sealed-guard (CKR_KEY_INDIGESTIBLE / CKR_USER_NOT_LOGGED_IN)
- advertise CKM_ECDH1_DERIVE + CKM_AES_KEY_WRAP; add WRAP/UNWRAP to RSA-PKCS-OAEP
- 9 OASIS-exact CKR_* wrap/unwrap/digest error codes
- 70/70 tests; proven via in-process smoke + cross-process pkcs11-tool (OpenSSL + RFC 3394 oracles)
2026-06-01 23:03:53 -04:00
ccb1b40a15
feat(hsm-emulator): PKCS#11 HSM emulator in Zig (M0–M7)
...
Software HSM that compiles to a real Cryptoki (PKCS#11) v2.40 shared
object, loadable by pkcs11-tool / OpenSSL like a smartcard. SoftHSM2-style
three-layer split: C-ABI facade -> typed core state -> crypto + persistence.
- M0 hand-written v2.40 ABI + build-time OASIS cross-check; exports only C_GetFunctionList
- M1 sessions, login, Argon2id PIN, lockout
- M2 objects + find, CKA_PRIVATE gating, persisted token store
- M3 RNG, SHA-2 digest, HMAC, AES-CBC/CBC-PAD/GCM
- M4 ECDSA P-256/P-384 keygen + sign/verify (std.crypto)
- M5 RSA 2048-4096 via libcrypto: PKCS#1 v1.5 / PSS sign-verify, PKCS#1 / OAEP enc-dec
- M6 encrypted-at-rest store: selective AES-256-GCM envelope, master key wrapped under Argon2id(User-PIN)
- M7 hardening (session-secret zeroization, fail-closed relock, heap-leak scrub, ubsan-free ABI) + Docker
Verified three ways: 65/65 unit tests, in-process dlopen smoke, and
cross-process OpenSC pkcs11-tool (token keys survive process restart).
Also excludes vendor/pkcs11 from the trailing-whitespace / end-of-file
pre-commit hooks so the vendored OASIS headers keep their documented
SHA-256 provenance.
2026-06-01 20:35:48 -04:00
9e7246e417
Update README.md
2026-05-24 18:09:32 -04:00
8665b3f93a
cracked
2026-05-23 06:59:28 -04:00
163d126655
Merge pull request #256 from CarterPerez-dev/chore/add-linting-to-yml-and-pre-commit
...
Chore/add linting to yml and pre commit
2026-05-23 06:43:38 -04:00
540a1dfcd7
Merge pull request #246 from CarterPerez-dev/dependabot/go_modules/PROJECTS/intermediate/secrets-scanner/github.com/go-git/go-git/v5-5.19.1
...
chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 in /PROJECTS/intermediate/secrets-scanner
2026-05-23 06:43:21 -04:00
ec1eb3cc2d
ci(lint): mkdir bin before building ameba
2026-05-23 06:34:52 -04:00
e78b17aa8c
ci(lint): fix Crystal ameba bin + relax V fmt to advisory
...
- Crystal: shards install doesn't build dev-dep binaries. Build ameba
explicitly via crystal build lib/ameba/bin/ameba.cr -o bin/ameba so
the lint step finds it.
- V: vlang/setup-v installs a V build whose fmt rules drift from local
V 0.5.1 (same version string, different formatter behavior). Make
v fmt advisory and gate the job on v vet only.
2026-05-23 06:32:22 -04:00
2c5a80e80e
cracked
2026-05-23 05:16:34 -04:00
43a6899042
cracked
2026-05-23 05:05:36 -04:00
0006ddad3d
cracked
2026-05-23 05:01:01 -04:00
481e07bddd
fix api sec scanner
2026-05-22 15:13:18 -04:00
6c2c40119f
Merge pull request #249 from CarterPerez-dev/dependabot/uv/PROJECTS/beginner/keylogger/idna-3.15
...
chore(deps): bump idna from 3.11 to 3.15 in /PROJECTS/beginner/keylogger
2026-05-22 14:19:22 -04:00
871f18d9fe
Merge pull request #245 from CarterPerez-dev/dependabot/go_modules/PROJECTS/beginner/canary-token-generator/backend/github.com/redis/go-redis/v9-9.7.3
...
chore(deps): bump github.com/redis/go-redis/v9 from 9.7.0 to 9.7.3 in /PROJECTS/beginner/canary-token-generator/backend
2026-05-22 14:19:03 -04:00
ac9ed2c0d4
Merge pull request #247 from CarterPerez-dev/dependabot/uv/PROJECTS/advanced/ai-threat-detection/backend/idna-3.15
...
chore(deps): bump idna from 3.11 to 3.15 in /PROJECTS/advanced/ai-threat-detection/backend
2026-05-22 14:18:49 -04:00
2aa8efeb85
Merge pull request #248 from CarterPerez-dev/dependabot/uv/PROJECTS/advanced/api-rate-limiter/idna-3.15
...
chore(deps): bump idna from 3.11 to 3.15 in /PROJECTS/advanced/api-rate-limiter
2026-05-22 14:18:36 -04:00
bab3440788
Merge pull request #250 from CarterPerez-dev/dependabot/uv/PROJECTS/advanced/bug-bounty-platform/backend/idna-3.15
...
chore(deps): bump idna from 3.11 to 3.15 in /PROJECTS/advanced/bug-bounty-platform/backend
2026-05-22 14:18:22 -04:00
b5f3f726f4
Merge pull request #251 from CarterPerez-dev/dependabot/uv/PROJECTS/foundations/http-headers-scanner/idna-3.15
...
chore(deps): bump idna from 3.13 to 3.15 in /PROJECTS/foundations/http-headers-scanner
2026-05-22 14:18:08 -04:00
46231c15ed
Merge pull request #252 from CarterPerez-dev/dependabot/uv/PROJECTS/advanced/encrypted-p2p-chat/backend/idna-3.15
...
chore(deps): bump idna from 3.11 to 3.15 in /PROJECTS/advanced/encrypted-p2p-chat/backend
2026-05-22 10:13:38 -04:00
c1c4241638
Merge pull request #254 from CarterPerez-dev/dependabot/uv/PROJECTS/beginner/c2-beacon/backend/idna-3.15
...
chore(deps): bump idna from 3.11 to 3.15 in /PROJECTS/beginner/c2-beacon/backend
2026-05-22 10:13:20 -04:00
688df30682
Merge pull request #255 from CarterPerez-dev/dependabot/uv/PROJECTS/advanced/ai-threat-detection/backend/mlflow-3.11.1
...
chore(deps): bump mlflow from 3.9.0 to 3.11.1 in /PROJECTS/advanced/ai-threat-detection/backend
2026-05-21 21:06:20 -04:00
3474d7711b
chore(deps): bump mlflow
...
Bumps [mlflow](https://github.com/mlflow/mlflow ) from 3.9.0 to 3.11.1.
- [Release notes](https://github.com/mlflow/mlflow/releases )
- [Changelog](https://github.com/mlflow/mlflow/blob/master/CHANGELOG.md )
- [Commits](https://github.com/mlflow/mlflow/compare/v3.9.0...v3.11.1 )
---
updated-dependencies:
- dependency-name: mlflow
dependency-version: 3.11.1
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-05-21 20:33:21 +00:00
15a9429d0f
chore(deps): bump idna in /PROJECTS/beginner/c2-beacon/backend
...
Bumps [idna](https://github.com/kjd/idna ) from 3.11 to 3.15.
- [Release notes](https://github.com/kjd/idna/releases )
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md )
- [Commits](https://github.com/kjd/idna/compare/v3.11...v3.15 )
---
updated-dependencies:
- dependency-name: idna
dependency-version: '3.15'
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-05-21 20:32:07 +00:00
1e44bf6384
chore(deps): bump idna in /PROJECTS/advanced/encrypted-p2p-chat/backend
...
Bumps [idna](https://github.com/kjd/idna ) from 3.11 to 3.15.
- [Release notes](https://github.com/kjd/idna/releases )
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md )
- [Commits](https://github.com/kjd/idna/compare/v3.11...v3.15 )
---
updated-dependencies:
- dependency-name: idna
dependency-version: '3.15'
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-05-19 16:30:52 +00:00
d43054c523
chore(deps): bump idna in /PROJECTS/foundations/http-headers-scanner
...
Bumps [idna](https://github.com/kjd/idna ) from 3.13 to 3.15.
- [Release notes](https://github.com/kjd/idna/releases )
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md )
- [Commits](https://github.com/kjd/idna/compare/v3.13...v3.15 )
---
updated-dependencies:
- dependency-name: idna
dependency-version: '3.15'
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-05-19 16:23:33 +00:00
3897a542e6
chore(deps): bump idna in /PROJECTS/advanced/bug-bounty-platform/backend
...
Bumps [idna](https://github.com/kjd/idna ) from 3.11 to 3.15.
- [Release notes](https://github.com/kjd/idna/releases )
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md )
- [Commits](https://github.com/kjd/idna/compare/v3.11...v3.15 )
---
updated-dependencies:
- dependency-name: idna
dependency-version: '3.15'
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-05-19 16:19:13 +00:00
341d04a160
chore(deps): bump idna from 3.11 to 3.15 in /PROJECTS/beginner/keylogger
...
Bumps [idna](https://github.com/kjd/idna ) from 3.11 to 3.15.
- [Release notes](https://github.com/kjd/idna/releases )
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md )
- [Commits](https://github.com/kjd/idna/compare/v3.11...v3.15 )
---
updated-dependencies:
- dependency-name: idna
dependency-version: '3.15'
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-05-19 16:08:43 +00:00
360df54954
chore(deps): bump idna in /PROJECTS/advanced/api-rate-limiter
...
Bumps [idna](https://github.com/kjd/idna ) from 3.11 to 3.15.
- [Release notes](https://github.com/kjd/idna/releases )
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md )
- [Commits](https://github.com/kjd/idna/compare/v3.11...v3.15 )
---
updated-dependencies:
- dependency-name: idna
dependency-version: '3.15'
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-05-19 15:59:27 +00:00
9b4b6f7772
chore(deps): bump idna in /PROJECTS/advanced/ai-threat-detection/backend
...
Bumps [idna](https://github.com/kjd/idna ) from 3.11 to 3.15.
- [Release notes](https://github.com/kjd/idna/releases )
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md )
- [Commits](https://github.com/kjd/idna/compare/v3.11...v3.15 )
---
updated-dependencies:
- dependency-name: idna
dependency-version: '3.15'
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-05-19 15:56:13 +00:00
c9fda34256
chore(deps): bump github.com/go-git/go-git/v5
...
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git ) from 5.19.0 to 5.19.1.
- [Release notes](https://github.com/go-git/go-git/releases )
- [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md )
- [Commits](https://github.com/go-git/go-git/compare/v5.19.0...v5.19.1 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
dependency-version: 5.19.1
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-05-19 15:38:06 +00:00
3250ddbbe3
chore(deps): bump github.com/redis/go-redis/v9
...
Bumps [github.com/redis/go-redis/v9](https://github.com/redis/go-redis ) from 9.7.0 to 9.7.3.
- [Release notes](https://github.com/redis/go-redis/releases )
- [Changelog](https://github.com/redis/go-redis/blob/master/RELEASE-NOTES.md )
- [Commits](https://github.com/redis/go-redis/compare/v9.7.0...v9.7.3 )
---
updated-dependencies:
- dependency-name: github.com/redis/go-redis/v9
dependency-version: 9.7.3
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-05-19 14:18:33 +00:00
b514050fac
Merge pull request #244 from CarterPerez-dev/dependabot/npm_and_yarn/PROJECTS/intermediate/api-security-scanner/frontend/ws-8.20.1
...
chore(deps): bump ws from 8.18.3 to 8.20.1 (via audit fix) in /PROJECTS/intermediate/api-security-scanner/frontend
2026-05-19 10:15:49 -04:00
05ef94cc93
chore(deps): bump ws (via audit fix)
...
Bumps [ws](https://github.com/websockets/ws ) from 8.18.3 to 8.20.1.
- [Release notes](https://github.com/websockets/ws/releases )
- [Commits](https://github.com/websockets/ws/compare/8.18.3...8.20.1 )
---
updated-dependencies:
- dependency-name: ws
dependency-version: 8.20.1
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-05-18 21:10:02 +00:00
03491c9b73
Merge pull request #239 from CarterPerez-dev/dependabot/npm_and_yarn/PROJECTS/beginner/canary-token-generator/frontend/picomatch-4.0.4
...
chore(deps): bump picomatch from 2.3.1 to 4.0.4 in /PROJECTS/beginner/canary-token-generator/frontend
2026-05-18 15:34:23 -04:00
069a3eb4a7
Merge pull request #243 from CarterPerez-dev/dependabot/npm_and_yarn/PROJECTS/beginner/canary-token-generator/frontend/postcss-8.5.14
...
chore(deps): bump postcss from 8.5.6 to 8.5.14 in /PROJECTS/beginner/canary-token-generator/frontend
2026-05-18 15:34:11 -04:00
cad4abf19a
Merge pull request #241 from CarterPerez-dev/dependabot/go_modules/PROJECTS/beginner/canary-token-generator/backend/github.com/go-viper/mapstructure/v2-2.4.0
...
chore(deps): bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.4.0 in /PROJECTS/beginner/canary-token-generator/backend
2026-05-18 15:34:04 -04:00
f76faab1d9
Merge pull request #240 from CarterPerez-dev/dependabot/npm_and_yarn/PROJECTS/beginner/canary-token-generator/frontend/immutable-5.1.5
...
chore(deps): bump immutable from 5.1.4 to 5.1.5 in /PROJECTS/beginner/canary-token-generator/frontend
2026-05-18 15:33:29 -04:00
905ec1bc27
Merge pull request #242 from CarterPerez-dev/dependabot/npm_and_yarn/PROJECTS/beginner/canary-token-generator/frontend/react-router-7.15.1
...
chore(deps): bump react-router from 7.10.1 to 7.15.1 in /PROJECTS/beginner/canary-token-generator/frontend
2026-05-18 15:33:14 -04:00
b25e61b070
Merge pull request #238 from CarterPerez-dev/dependabot/npm_and_yarn/PROJECTS/beginner/canary-token-generator/frontend/flatted-3.4.2
...
chore(deps): bump flatted from 3.3.3 to 3.4.2 in /PROJECTS/beginner/canary-token-generator/frontend
2026-05-18 15:33:01 -04:00
d8a6266acf
chore(deps): bump postcss
...
Bumps [postcss](https://github.com/postcss/postcss ) from 8.5.6 to 8.5.14.
- [Release notes](https://github.com/postcss/postcss/releases )
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md )
- [Commits](https://github.com/postcss/postcss/compare/8.5.6...8.5.14 )
---
updated-dependencies:
- dependency-name: postcss
dependency-version: 8.5.14
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-05-18 14:03:49 +00:00
CarterPerez-dev
dependabot[bot]