{"id":51863663,"url":"https://github.com/abdulwahed-sweden/ferox","last_synced_at":"2026-07-24T12:30:42.902Z","repository":{"id":368874916,"uuid":"1092560055","full_name":"abdulwahed-sweden/ferox","owner":"abdulwahed-sweden","description":"ferox","archived":false,"fork":false,"pushed_at":"2026-07-02T14:55:27.000Z","size":3166,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-02T16:34:15.631Z","etag":null,"topics":["c2","cybersecurity","memory-forensics","mitre-attack","offensive-security","penetration-testing","pentesting","red-team","rust","security-tools"],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/abdulwahed-sweden.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-11-08T21:15:13.000Z","updated_at":"2026-07-02T14:57:48.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/abdulwahed-sweden/ferox","commit_stats":null,"previous_names":["abdulwahed-sweden/ferox"],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/abdulwahed-sweden/ferox","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/abdulwahed-sweden%2Fferox","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/abdulwahed-sweden%2Fferox/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/abdulwahed-sweden%2Fferox/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/abdulwahed-sweden%2Fferox/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/abdulwahed-sweden","download_url":"https://codeload.github.com/abdulwahed-sweden/ferox/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/abdulwahed-sweden%2Fferox/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35842301,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-24T02:00:07.870Z","response_time":62,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["c2","cybersecurity","memory-forensics","mitre-attack","offensive-security","penetration-testing","pentesting","red-team","rust","security-tools"],"created_at":"2026-07-24T12:30:42.092Z","updated_at":"2026-07-24T12:30:42.891Z","avatar_url":"https://github.com/abdulwahed-sweden.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# 🦊 Ferox Security Framework v4.1\n\n[![Rust](https://img.shields.io/badge/Rust-2021%20Edition-orange)]()\n[![License](https://img.shields.io/badge/License-MIT-blue)]()\n[![Status](https://img.shields.io/badge/Status-Production%20Ready-success)]()\n[![Version](https://img.shields.io/badge/Version-4.1.0-brightgreen)]()\n\n**Ferox** is a modern Rust-native offensive security framework designed for authorized penetration testing, security research, and red team operations. Built with performance, safety, and observability in mind.\n\n\u003e ## ⚠️ Authorized Use Only\n\u003e\n\u003e Ferox is an **offensive-security tool** (recon, exploitation, C2, post-exploitation). Use it **only** against systems you own or for which you hold **explicit, written authorization** — e.g. a signed pentest engagement, a bug-bounty program's scope, or a lab you control.\n\u003e\n\u003e Unauthorized access to computer systems is a **crime** in most jurisdictions (e.g. the U.S. CFAA, the UK Computer Misuse Act, and equivalent EU/Swedish law). You are solely responsible for operating within the law and your authorization. The software is provided \"AS IS\", without warranty; the author accepts **no liability** for misuse or resulting damage. See the [Security \u0026 Authorization](#-security--authorization) section and [LICENSE](./LICENSE).\n\n## What's New in 4.1\n\n- **Code Modernization** - Updated to Rust 2021 edition, all dependencies current\n- **Mobile App Analysis** - APK and IPA security assessment modules\n- **Security Assessment Wizard** - Guided workflow for comprehensive assessments\n- **Enhanced Progress Tracking** - Real-time progress with discoveries\n- **Desktop Application** - Modern React-based Tauri interface\n\n---\n\n## 🚀 Quick Start\n\n### Installation\n\n```bash\ngit clone https://github.com/abdulwahed-sweden/ferox\ncd ferox\ncargo build --release --features memory-forensics\n```\n\n### First Run\n\n```bash\n# System diagnostics\n./target/release/ferox doctor check\n\n# Launch console\n./target/release/ferox console\n\n# Memory forensics\n./target/release/ferox memory analyze dump.raw --output report.json\n```\n\n## 🎯 Core Features\n\n### 🔍 Memory Forensics\n\n- Volatility3 integration\n- YARA scanning\n- MITRE ATT\u0026CK mapping\n- Export formats: JSON, Markdown, tables\n\n### 🛰️ Command \u0026 Control\n\n- Teams Tunnel C2\n- HTTP beacon\n- DNS C2\n- Relay manager\n\n### 🎯 Smart Payload System (Phase 4)\n\n- **Fileless Reverse TCP** with AES-256-GCM encryption\n- **Multi-stage payloads** (Stage-1 stager + Stage-2 payload)\n- **Cross-platform support**: Windows, Linux, macOS, Universal\n- **Execution Command Generators**: Ready-to-paste commands per OS\n- **Listener Command Helpers**: Netcat, Socat, Metasploit, Python\n- **C2 Integration**: Teams, GitHub Gist, DNS-over-HTTPS, HTTP Beacon\n\n### 📱 Mobile App Analysis (New in 4.0)\n\n- **APK Analyzer** - Android app security analysis\n  - Manifest parsing \u0026 permission analysis\n  - Code decompilation \u0026 secrets detection\n  - Network security config analysis\n  - Certificate validation checks\n- **IPA Analyzer** - iOS app security analysis\n  - Info.plist analysis \u0026 entitlements extraction\n  - Binary protections check (PIE, ARC, stack canaries)\n  - URL scheme \u0026 deep link analysis\n  - Third-party SDK detection\n- **App Reconnaissance** - App store intelligence gathering\n\n### 🔧 Security Operations\n\n- Reconnaissance (ASN, DNS, WHOIS, Subdomains)\n- High-speed scanning\n- Exploitation (authorized)\n- Post-exploitation: credentials, persistence, lateral movement\n\n### 🔒 Post-Exploitation Engines (Phase 5)\n\n- **Persistence Engine**: Multi-platform persistence with 14 methods\n  - Windows: Registry Run, Scheduled Tasks, WMI Events, Services, Startup Folder\n  - Linux: Cron, Systemd, Shell RC, XDG Autostart\n  - macOS: Launch Agents/Daemons, Login Items\n  - Auto-select based on privileges and stealth requirements\n  - Built-in redundancy support\n- **Privilege Escalation Engine**: Comprehensive privesc enumeration\n  - Windows: UAC Bypass (fodhelper, eventvwr, sdclt), Token Impersonation, Service Exploits\n  - Linux: Sudo abuse, SUID/SGID binaries, Kernel exploits, Capabilities\n  - MITRE ATT\u0026CK mapping for all techniques\n  - GTFOBins integration references\n- **Credential Harvesting Engine**: Multi-source credential extraction\n  - Windows: LSASS, SAM, Credential Manager, Browser passwords\n  - Linux: /etc/shadow, SSH keys, GNOME Keyring, Browser credentials\n  - macOS: Keychain, Browser passwords\n  - Cross-platform: Cloud credentials (AWS/Azure/GCP), Git tokens\n  - Sensitivity classification and redaction support\n\n### 🗂 System Management\n\n- SQLite session tracking\n- Tamper-proof audit logs\n- Safe mode for dangerous modules\n- Policy-based authorization\n\n## 🛠️ Usage Examples\n\n### Interactive Console\n\n```bash\nferox\u003e use scanner/port\nferox (scanner/port)\u003e set RHOSTS 10.0.0.0/24\nferox (scanner/port)\u003e set PORTS 1-1000\nferox (scanner/port)\u003e run --json \u003e scan_results.json\n```\n\n### Memory Analysis\n\n```bash\nferox memory analyze memory.dmp --database analysis.db\nferox memory malfind memory.dmp --min-score 0.6 --mitre\nferox memory pslist memory.dmp --format table\n```\n\n### System Diagnostics\n\n```bash\nferox doctor check --critical\nferox doctor check --format json\nferox doctor dependency python\nferox doctor dependency volatility\n```\n\n### C2 Operations\n\n```bash\nferox c2 list --status active\nferox c2 setup teams_tunnel --team-id \"security-team\"\nferox c2 test http_beacon --target http://target.com\n```\n\n### Smart Payload Generation\n\n```bash\n# Interactive payload generation\nferox\u003e use payloads/rev_tcp_fileless\nferox (payloads/rev_tcp_fileless)\u003e set LHOST 192.168.1.100\nferox (payloads/rev_tcp_fileless)\u003e set LPORT 4444\nferox (payloads/rev_tcp_fileless)\u003e set TARGET_OS windows\nferox (payloads/rev_tcp_fileless)\u003e run\n\n# Output includes:\n# - Encrypted payload (Base64/Hex)\n# - Ready-to-paste execution commands:\n#   - PowerShell Base64 Decode \u0026 Execute\n#   - PowerShell Encoded Command\n#   - CMD via PowerShell\n# - Listener commands:\n#   - nc -lvnp 4444\n#   - msfconsole multi/handler\n\n# Staged payload with C2\nferox (payloads/rev_tcp_fileless)\u003e set STAGED true\nferox (payloads/rev_tcp_fileless)\u003e set C2_URL https://c2.example.com/stage2\nferox (payloads/rev_tcp_fileless)\u003e run\n```\n\n### Persistence Engine\n\n```bash\n# List all persistence methods\nferox persist list\n\n# Auto-install persistence (safe mode)\nferox persist auto --platform windows --payload /path/to/agent --redundancy 2\n\n# Show method details\nferox persist describe registry_run_hkcu\n\n# Verify/remove persistence\nferox persist verify\nferox persist remove\n```\n\n### Privilege Escalation Engine\n\n```bash\n# List available enumerators\nferox privesc list\n\n# Auto-enumerate and exploit (safe mode)\nferox privesc auto --platform windows --command cmd.exe\n\n# Enumerate specific platform\nferox privesc enumerate --platform linux --category sudo\n\n# Show technique details\nferox privesc describe uac_bypass\n```\n\n### Credential Harvesting Engine\n\n```bash\n# List available harvesters\nferox creds list --platform windows\n\n# Harvest credentials (safe mode)\nferox creds harvest --platform linux --category all\n\n# Filter by category\nferox creds harvest --platform windows --category browser\n\n# Show harvester details\nferox creds describe lsass_memory\n\n# Show harvested credentials\nferox creds show\n```\n\n### Mobile App Analysis\n\n```bash\n# Android APK Analysis\nferox\u003e use mobile/apk_analyzer\nferox (mobile/apk_analyzer)\u003e set APK_PATH /path/to/app.apk\nferox (mobile/apk_analyzer)\u003e run\n\n# iOS IPA Analysis\nferox\u003e use mobile/ipa_analyzer\nferox (mobile/ipa_analyzer)\u003e set IPA_PATH /path/to/app.ipa\nferox (mobile/ipa_analyzer)\u003e run\n\n# App Store Reconnaissance\nferox\u003e use mobile/app_recon\nferox (mobile/app_recon)\u003e set BUNDLE_ID com.example.app\nferox (mobile/app_recon)\u003e run\n```\n\n### Security Assessment Wizard\n\n```bash\n# Launch interactive wizard\nferox\u003e wizard\n\n# Select assessment template:\n# 1. Full Penetration Test\n# 2. Web Application Assessment\n# 3. Network Security Audit\n# 4. Mobile App Assessment\n# 5. Cloud Security Review\n```\n\n## 🎨 Interface — Mixed Predator Theme\n\n- Dark, high-contrast security palette\n- Minimal animations (calm UI)\n- Terminal-optimized typography\n- Clean status symbols (✅ ❌ ⚠️ ℹ️)\n\n## 🛡️ Safe Mode Example\n\n```bash\nSAFE_MODE=1 ferox --mock run c2/teams_tunnel\nSAFE_MODE=1 ferox console\n```\n\n## 🔧 Architecture\n\n```text\nFerox CLI Integration Layer\n       ↓\n[doctor, memory, c2, sessions, persist, privesc, creds, console]\n       ↓\nModule Registry \u0026 Session Manager\n       ↓\nSecurity Engine (Async Rust)\n       ↓\n[Scanner, Recon, Exploit, Payloads, Memory, C2, Post, Auxiliary]\n       ↓\n┌─────────────────────────────────────────────────────────────┐\n│  Smart Payload Engine (AES-256-GCM, HKDF, Multi-Stage)      │\n│  Persistence Engine (14 methods, 3 platforms)               │\n│  Privilege Escalation Engine (7 enumerators, 2+ exploits)   │\n│  Credential Harvesting Engine (12 harvesters, 3 platforms)  │\n└─────────────────────────────────────────────────────────────┘\n```\n\n## 📦 Module Categories\n\n| Category              | #   | Description                                     |\n| --------------------- | --- | ----------------------------------------------- |\n| Scanner               | 8   | Port \u0026 service detection                        |\n| Recon                 | 6   | Information gathering                           |\n| **Mobile**            | 3   | APK/IPA analysis, app reconnaissance            |\n| Exploit               | 4   | Authorized exploitation                         |\n| **Payloads**          | 3   | Smart payload generation with encryption        |\n| Memory Forensics      | 8   | Volatility3 workflows                           |\n| **Post-Exploitation** | 33+ | Persistence (14), PrivEsc (7), Credentials (12) |\n| C2 \u0026 Evasion          | 12  | Communication \u0026 stealth                         |\n| Auxiliary             | 5   | Utility modules                                 |\n\n## 🩺 Ferox Doctor — Diagnostics Engine\n\n```bash\n# Full check\nferox doctor check\n\n# Dependency inspection\nferox doctor dependency python\nferox doctor dependency volatility\n\n# Auto-fix (when supported)\nferox doctor check --fix\n\n# Formats\nferox doctor check --format json\nferox doctor check --format markdown\n```\n\n## 🔒 Security \u0026 Authorization\n\n**Ferox is designed exclusively for authorized security work.**\n\n### Permitted\n\n- Authorized penetration testing\n- Red team assessments\n- Security research\n- CTFs\n- Defensive training\n\n### Prohibited\n\n- Unauthorized access\n- Criminal activity\n- Malicious operations\n- Violating laws/regulations\n\n### Built-in Safeguards\n\n- Authorization context\n- Immutable audit logs\n- Safe mode for high-risk modules\n- Policy-based access control\n\n## 🖥️ Ferox Desktop\n\nA professional C2 operations console built with Tauri and React:\n\n```bash\ncd ferox-desktop\nnpm install\ncargo tauri dev     # Development\ncargo tauri build   # Production build\n```\n\n**Features:**\n\n- Real-time session management with live updates\n- Integrated terminal with command history\n- Post-exploitation module dashboard\n- Session tree visualization\n- Dark theme optimized for operations.\n\nSee [Desktop Documentation](docs/developer/architecture.md) for details.\n\n## 📚 Documentation\n\n- [docs/README.md](docs/README.md) — Documentation index\n- [docs/INSTALLATION.md](docs/INSTALLATION.md) — Installation guide\n- [docs/user-guide/](docs/user-guide/) — End-user documentation\n- [docs/developer/](docs/developer/) — Developer documentation\n- [docs/api/](docs/api/) — API reference\n\n## 🛣️ Roadmap\n\n- [x] v2.0.0 – Memory forensics engine\n- [x] **Phase 4** – Smart Payload System with execution command generators\n- [x] **Phase 5** – Post-Exploitation Engines (Persistence, PrivEsc, Credentials)\n- [x] **Phase 6** – Ferox Desktop (Tauri + React operations console)\n- [x] **v4.0.0** – Mobile App Analysis (APK/IPA) \u0026 Security Assessment Wizard\n- [ ] Signed plugin marketplace\n- [ ] Hardware-backed credential vault\n- [ ] Extended evasion techniques\n\n## 🤝 Contributing\n\n1. Fork and branch:\n   ```bash\n   git checkout -b feat/description\n   ```\n2. Run full tests:\n   ```bash\n   cargo test --features memory-forensics --tests\n   ```\n3. Document all new modules.\n4. Include authorization/audit notes in PR.\n\n## 📄 License\n\nReleased under the MIT License. Usage limited to ethical and authorized scenarios.\n\n## 📬 Support\n\n- Maintainer: Abdulwahed Mansour\n- Email: abdulwahed.mansour@gmail.com\n- Security Contact: security@ferox.local\n- GitHub: @abdulwahed-sweden\n\nFast. Fierce. Fearless. Authorized. 🦊\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fabdulwahed-sweden%2Fferox","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fabdulwahed-sweden%2Fferox","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fabdulwahed-sweden%2Fferox/lists"}