AiSOC delivers an open-source AI Security Operations Center that unifies event ingestion, graph correlation, autonomous triage, and purple-team adversary emulation into a single self-hosted console. Security analysts triage alerts across an interactive Investigation Rail that visualizes six-event attack timelines, pivot-path entity graphs, and recommended containment steps. The underlying LangGraph agentic engine reasons over ingested telemetry, querying MITRE ATT&CK frameworks, CISA Known Exploited Vulnerabilities catalogs, and Shodan intelligence while recording every prompt, tool execution, and evidentiary citation in an immutable Investigation Ledger. Incident responders execute automated containment playbooks, including host network isolation, credential revocation in identity providers, and firewall blocklist updates with human-in-the-loop sign-offs. Threat hunters input plain-English hypotheses into the natural-language hunt workbench to generate and execute ES|QL, SPL, and KQL queries against historical telemetry stores. Platform operators connect over seventy vendor connectors spanning CrowdStrike, SentinelOne, Microsoft Defender, AWS Security Hub, Okta, and Cloudflare to normalize streaming events into Open Cybersecurity Schema Framework standards. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Leave a fake door unlocked and see who walks through: Krawl is a self-hosted honeypot that poses as a sloppy web server and records everything scanners and scrapers try. Fake WordPress, phpMyAdmin, and admin logins. Every attempt logged, every credential captured. A .env file leaking fake database strings, AWS keys, and Stripe secrets. SQL injection, XSS, path traversal, XXE, and command injection traps that answer with believable fake output. SQLMap gets a different database error on every request. Malicious crawlers wander an endless maze of random links. An optional tarpit adds delay and word salad that cost scrapers time, storage, and tokens. Optional AI-generated pages write a plausible decoy for any path an attacker requests. A hidden dashboard shows an attacker map, top IPs, captured credentials, and per-IP forensics. TLSH fuzzy hashing groups webshell variants into campaigns. A behavior score labels each IP attacker, bad crawler, good crawler, or regular user. Export bans as raw lists, iptables, or nftables rules, with guides for Fail2Ban, OPNsense, and RouterOS. A canary-token link in decoy pages emails you the IP and user agent of anyone who follows it. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

When cybersecurity instructors and competition organizers host Capture The Flag tournaments, GZCTF orchestrates isolated per-team challenge containers, dynamic anti-cheat flags, and live exponential scoreboards from a single web platform. Event administrators can configure four distinct challenge modes covering static attachments, team-specific dynamic attachments, shared static containers, and isolated dynamic containers where unique flags are injected into each team's environment at launch. A customizable exponential scoring engine adjusts point values automatically as more teams solve a problem while awarding first, second, and third blood bonuses to top contenders. Built-in flag-sharing detection monitors every submission in real time, flagging suspicious cross-team flag reuse alongside live event streams and container logs. Participants can group into divisions, track their ranking trajectory on interactive score timelines, and upload post-game writeups directly into the portal for organizer review and batch archiving. Built-in network proxying forwards challenge traffic over WebSocket tunnels with optional packet capture so referees can audit exploit payloads during active matches. Multi-language localization, customizable branding, invitation gates, and email domain restrictions adapt the portal to university courses, corporate security drills, or international tournaments. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.