A simple application that extracts your IoCs from garbage input and checks their reputation using multiple services.
Inspired by Cybergordon and IntelOwl.
This project aims to provide a simple and efficient way to check the reputation of your observables using multiple services, without having to deploy a complex solution.
Features
- Effortless Input Handling: Paste raw logs, IoCs, or fanged IoCs, and let our regex parser do the rest.
- Multi-Service Reputation Checks: Verify observables (IP, hash, domain, URL) across multiple services like VirusTotal, AbuseIPDB, IPInfo, Spur.us, MDE, Google Safe Browsing, Shodan, Abusix, Phishtank, ThreatFox, URLscan, Github, Google…
- Detailed Reports: Generate comprehensive reports with advanced search and filter options.
- High Performance: Leverage multithreading for faster processing.
- Automated Observable Pivoting: Automatically pivot on domains, URL and IP addresses using reverse DNS and RDAP.
- Accurate Domain Info: Retrieve precise domain information from ICANN RDAP (next generation whois).
- Abuse Contact Lookup: Accurately find abuse contacts for IPs, URLs, and domains.
- Export Options: Export results to CSV and autofiltered well formatted Excel files.
- MDE Integration: Check if observables are flagged on your Microsoft Defender for Endpoint (MDE) tenant.
- Proxy Support: Use a proxy if required.
- Data Storage: Store results in a SQLite database.
- Analysis History: Maintain a history of analyses with easy retrieval and search functionality.
What Cyberbro Does That Others Don’t
- Accessible to everyone from beginners to experts. No gatekeeping here.
- Lightweight & Easy Deployment: Simple to set up and use.
- Advanced TLD Verification: Uses
tldextract to accurately extract root domains, helping RDAP lookups. - Pragmatic Information Gathering: Utilizes GitHub and Google indexed results to catch what other engines might miss.
- CTI Report Integration: Leverages IoC.One for IoC-related CTI reports in HTML or PDF.
- EDR Integration: Integrates with solutions like Microsoft Defender for Endpoint to check if observables were seen in YOUR environment.
Getting Started
- To get started, clone the repository
git clone https://github.com/stanfrbd/cyberbro
cd cyberbro
For more information click here.