Tool search 164,478 tools · 10,067 live servers

Return individual raw honeypot events with all fields. Use when the user wants to see actual records: 'show me events from this IP', 'what hit port 443 last week', 'events from Russia yesterday'. Filters: source_ip, country (2-letter code), asn (e.g. 'AS12345'), dest_port, protocol ('tls' or '' = the coarse TLS/raw-TCP signal), app_protocol (nDPI L7 protocol label: 'bittorrent', 'ssh', 'rdp', 'mssql-tds', 'mining', 'rtsp', 'smbv1', ... — find everything speaking a protocol regardless of port), http_method, request_header (substring of the masked HTTP request headers), ja4/ja3 (exact TLS client fingerprint), has_client_cert (true = only events where the client presented an mTLS cert), ip_version (4 or 6 = only IPv4 or IPv6 sources). since/until are ISO-8601 UTC strings. Each record includes: source_ip, country, asn, dest_port, user_agent, url_path, http_request_headers, tls_client_ja4, tls_client_ja3, http_request_ja4h, ssh_client_hassh, tls_client_cert_subject/issuer, event_sequence, event_duration, source_bytes/dest_bytes/network_bytes, network_protocol, application_protocol, timestamp.

Literal substring search over captured request text: URL path, request body, request headers and event summary. Use for: 'find attacks targeting /wp-admin', 'find requests with this user agent string', 'what payloads hit port 80 last week'. It matches text that literally appeared in the request, and nothing else. These do NOT work and will return an empty list: - a CVE id ('CVE-2024-4577'), which is our tag for a pattern, never payload text. Use cve_lookup instead. This tool rejects them rather than answering emptily. - a product or vendor name ('Cisco FMC', '7-Zip'), which appears in an advisory, not in the request. Search the endpoint it exposes instead, e.g. '/ccmadmin' or the vulnerable path. - a description of behaviour ('SQL injection attempts'). Search a marker that occurs in the traffic, e.g. 'UNION SELECT' or '../'. An empty list is a real answer: it means no captured request in that window contained the string. Widen since/until before concluding the activity does not exist. Free to call; volume is metered like every other tool. since/until are ISO-8601 UTC strings.

Check whether components of a software stack are end-of-life, past active support, or affected by CVEs on CISA's Known Exploited Vulnerabilities catalog (1,600+ entries of vulnerabilities confirmed exploited in the wild). Pass a comma-separated stack like 'node@16,python@3.8,postgresql@17'. Returns severity counts: critical (past EOL — no security patches), warning (past active support), and ok. Use before recommending or upgrading a runtime, or to audit a Dockerfile or CI config. Operated by an autonomous AI agent (Krab Bot); the free tier is used here.

Return a list of hands-on SecDim Play secure coding challenges (labs) related to a detected or suspected vulnerability. SecDim Play challenges are scored, hands-on labs: find and fix a real vulnerability in running code to earn points and badges. Use this tool to: - Find hands-on SecDim Play labs for specific vulnerabilities like XSS, SQL Injection, etc. - Explore OWASP Top 10 vulnerabilities and related labs - Provide additional resources and guides to help developers improve their secure coding skills For structured tutorial content (text, video, and lab-based courses) on the same vulnerability, use search_learn_courses (SecDim Learn) instead or in addition. Args: search: Search term for the vulnerability (e.g., 'xss', 'sql-injection', 'injection') cwe: Common Weakness Enumeration (CWE) ID to filter by owasp: OWASP category to filter by (e.g., 'a03:2021') technology: Technology or framework to filter by (e.g., 'react', 'django') language: Programming language to filter by (e.g., 'javascript', 'python') difficulty: Difficulty level to filter by (e.g., 'trivial', 'easy', 'medium', 'hard') type: Challenge format to filter by (e.g., 'battle', 'exploitation', 'incident-response') mitre: MITRE ATT&CK ID to filter by (e.g., 'T1102.003') SecDim Play challenges (labs) each simulate a real vulnerability. They are scored according to the following difficulty levels: - Trivial: Easy to find and path vulnerabilities. It can be completed in 5-10 minutes. 1-15 points. - Easy: Known vulnerabilities. It can be completed in 10-30 minutes. 16-35 points. - Medium: Known vulnerabilities but require defence-in-depth patch. It can be completed in 20-30 minutes. 36-70 points. - Hard: Hard to find or patch vulnerabilities. It can be completed in 30-60 minutes. 71-100 points. - Battle: SecDim Flagship attack and defence challenge that require both vulnerability exploitation and mitigation skills. Points are accumulated. Returns: Dictionary containing SecDim Play labs results or error If there are no results, user can perform a manual search on the SecDim Play frontend (SECDIM_PLAY_FRONTEND_BASE_URL)

Search for SecDim Play secure coding labs (hands-on, scored challenges). This tool searches across SecDim Play's hands-on secure coding labs based on the search query. The backend API handles parsing of vulnerability names, CWE IDs, and OWASP IDs. Language can be specified using the format "lang:javascript". Args: query: Search query that may include: - Vulnerability names (e.g., "XSS", "SQL injection") - CWE IDs (e.g., "79") - OWASP IDs (e.g., "A03:2021") Examples: - "XSS lang:javascript" - searches for XSS labs in JavaScript - "SQL injection lang:Python" - searches for SQL injection labs in Python - "79" - searches for labs related to CWE-79 Returns: Dictionary with search results containing: - results: List of matching SecDim Play labs with id, title, snippet, and metadata