Folders and files
| Name | Name | Last commit date | ||
|---|---|---|---|---|
A historical security-learning script collection for defensive review and explicitly authorized work in an isolated lab.
Tracked files include experiments related to credential capture, traffic manipulation, scanning, command channels, persistence, and host modification. Such behavior can damage systems, expose personal data, or violate law and policy.
Use the repository only for static defensive study or on systems and networks you own or have explicit written permission to test. Do not run it on a daily workstation, production environment, third-party service, or network carrying real credentials. The archive is not a supported penetration-testing toolkit and provides no assurance of safety, stealth, reliability, or current effectiveness.
The refreshed default-branch tree contains 52 files in 7 directories:
| Format | Count | Role |
|---|---|---|
| .py | 37 | Historical Python experiments and utilities |
| .md | 6 | Root multilingual documentation and two nested historical notes |
| .sh | 4 | Shell experiments |
| .c | 2 | C source, including host-level experiments |
| .cpp | 1 | C++ source |
| .ps1 | 1 | PowerShell credential-related example |
| .def | 1 | Definition data associated with archived source |
Filenames and counts describe repository content; they are not instructions or evidence that a script works.
| Area | Defensive review focus |
|---|---|
| Network experiments | sockets, packet handling, listeners, proxies, target assumptions, and cleanup |
| Command channels | process creation, input/output transport, authentication absence, and host impact |
| Keyboard capture | privacy exposure, platform hooks, local storage, and detection opportunities |
| PowerShell material | credential access, privilege context, command logging, and endpoint controls |
| Bash modification | source changes, persistence implications, build provenance, and system integrity |
| Miscellaneous utilities | file transfer, forwarding, screenshots, proxying, and web-shell-related behavior |
The table frames static defensive analysis. It does not authorize deployment or expand operational capability.
| Path | Archived material and boundary |
|---|---|
| net_attacking/ | Network inspection, spoofing, scanning, packet, proxy, and traffic experiments |
| reverse_shell/ | TCP, UDP, C, Python, and shell command-channel experiments |
| keylogger/ | Keyboard-capture experiments for multiple platforms |
| powershell/ | One PowerShell credential-recovery example |
| bash_backdoor/ | A Bash source-modification experiment and its original notes |
| util_tools/ | FTP, proxy, screenshot, forwarding, and web-shell-related utilities |
These folders have different prerequisites and effects. They must not be joined by a common installer, launcher, or dependency bundle.
No dependency manifest, supported Python version, virtual environment, installation procedure, common run command, or test suite was found. The mixed Python, C, C++, PowerShell, shell, and Bash-source material cannot be assigned one runtime.
Individual files may require obsolete libraries, elevated privileges, raw sockets, display access, listeners, compiler toolchains, or a specific operating system. Nested historical notes are provenance evidence, not current build or deployment guidance.
- Define the authorized asset, behavior, time window, data set, and stop condition in writing.
- Prefer static review: inspect imports, endpoints, subprocesses, privilege changes, persistence, file writes, captured data, and cleanup.
- Derive findings or detection ideas in separate defensive documentation without modifying archived payload behavior.
- If dynamic analysis is genuinely required, use synthetic data and a disposable, disconnected lab with a tested reset path.
- Record observed input, state changes, output, network activity, and cleanup; stop if behavior exceeds the authorization scope.
No execution commands are provided because safe invocation depends on source review, written authorization, containment, and the selected file.
- Python syntax and imports may target obsolete versions or unavailable packages.
- Raw sockets, network listeners, keyboard hooks, and host-source changes can require high privileges and can destabilize a lab.
- Hard-coded addresses, ports, filenames, or credentials may redirect traffic or overwrite data if not identified first.
- Credential and screen-capture examples can collect personal data even during accidental execution.
- Historical files may contain harmful behavior not apparent from their names; static review is mandatory before any authorized analysis.
No repository-wide run, test, build, lint, or format command was found. No file was executed, dependency-resolved, compiled, or dynamically analyzed during the documentation audit.
A defensive code change requires synthetic regression evidence and proof that it does not add evasion, persistence, credential theft, exploitation, target discovery, destructive behavior, or deployment automation. A result for one file does not validate another folder.
Suitable contributions improve risk labeling, provenance, static analysis notes, or isolated defensive tests. Keep archived behavior stable, avoid formatting that obscures security-relevant diffs, and never commit real targets, credentials, captures, or personal data.
Keep English, Simplified Chinese, and Japanese READMEs aligned in section order, counts, paths, links, authorization limits, and safety statements.
See LICENSE. It is a rights and provenance notice, not an open-source license: it grants no permission to use, copy, modify, deploy, or redistribute original project material. Third-party material remains subject to its own rights and terms.
Some filenames and notes indicate relationships to external tools or techniques, but their origin and reuse terms were not independently verified. Do not assume permission to copy, modify, redistribute, or deploy any material.
- HaoXiang Huang
- Rays688888@Gmail.com
- Project homepage