Authorized use onlyfrom $499support & customisation
Rustsploit
Modular exploitation framework in Rust. Started as a routersploit rewrite and grew well past it — the backbone of our custom tooling work.
- Rust
- Modular
- ★58 stars
// store
The Arsenal.
The source is public — read it before you commit to anything. What you pay for is the engineer who wrote it: support, improvements, and customisation for your environment, plus the engagements the tooling was built for. Everything here is for authorized security testing and education.
⚠ Authorized use only — liability notice
Everything on this page is published for lawful, authorized security testing, research, and education. You are solely responsible for how you use it. Cyber Sec accepts no liability for any misuse, damage, data loss, service disruption, or legal consequence arising from your use of these tools. By downloading or commissioning work, you confirm you have explicit written authorization to test any system you target and that you will comply with all applicable laws. All tooling is provided as-is, without warranty.
// category 01 · tooling
Offensive Tooling
Dual-use tooling for authorized red-team and research engagements, written mostly in Rust. Most of it is public — read the source before you commit. Support, improvements and custom modules are priced per tool.
AI · authorized usefrom $499support & customisation
OpenHack
An AI-powered security-assessment agent for authorized pentesting. Multi-agent recon, exploitation and reporting — every action gated by a hash-signed rules-of-engagement harness.
- AI agent
- Multi-agent
- Signed ROE
Researchfrom $299support & customisation
Arcticfox C3
Async networking and codec framework in Rust — synchronises control content over public code-hosting and paste services. Built to study covert channels that need no dedicated C2 host, and to validate whether your detection sees them.
- Rust
- Covert channels
- Detection validation
Authorized use onlyfrom $299support & customisation
Rustforce
Fast, modular credential-testing toolkit in Rust covering FTP, SSH and Telnet, bundled with IP-generation and proxy download/test utilities.
- Rust
- FTP · SSH · Telnet
- Proxy-aware
// category 02 · tooling
Detection & Response
Blue-team tooling you deploy, tune, and own — no managed subscription required. The same building blocks we use on detection engineering builds, with paid support and tuning when you want it done properly.
Deploy & ownfrom $299support & customisation
Wazuh Installer
Scripted stand-up of a Wazuh deployment — the boring part of a SIEM rollout, automated so you can get to tuning.
- Wazuh
- Docker
- Scripted
AI · EDRComing soonin development
cau
CAU EDR — “Certs Are Useless”. A transparent open-source malware-detection engine in Go: six detectors read every file once, every finding is explained with a labelled class and an ATT&CK technique, and every report is machine-readable with CI exit codes.
- Go · MIT
- YARA · heuristics
- ATT&CK · SARIF/OCSF
Deploy & ownfrom $299support & customisation
p2soc — SOC Video Wall
Turns a Raspberry Pi 5 into a SOC video wall: a draggable 2×2 kiosk of auto-logging-in Wazuh, Zabbix and Grafana panels, secrets in Vaultwarden, autossh jump tunnel.
- Raspberry Pi 5
- Wazuh · Zabbix · Grafana
- GPLv3
// category 03 · tooling
Recon & Reference
Scanning tools and field references — the published methodology we actually work from, not a repackaged PDF. Paid tiers cover walkthroughs, extensions, and adapting them to your estate.
Investigationfrom $299support & customisation
openredact
An open-source investigation toolkit: recover defective redactions without regenerating content, route evidence by magic bytes, extract and correlate entities, and run scope-gated recon for authorized engagements.
- Forensics
- Python · MIT
- Authorized use
Reconfrom $299support & customisation
Recon Toolkit
Quicmap for QUIC/HTTP-3 port scanning and service fingerprinting, Stalkroute for deep path tracing, worldroute for bulk host recon, smfp for SMTP/FTP sweeps.
- QUIC / HTTP-3
- Bulk recon
- Rust · Python
Referencefrom $149support & customisation
Advanced Shodan Queries
A curated collection of Shodan search queries for attack-surface discovery — the interesting, the funny, and the genuinely alarming.
- Attack surface
- OSINT
- ★10 stars
Methodologyfrom $149support & customisation
Cardsz — RFID/NFC Assessment
Full Proxmark3 methodology for physical access control: Mifare, HID, iCLASS and NTAG. The guide behind the badge-cloning half of a physical engagement.
- Proxmark3
- Mifare · HID · iCLASS
- Physical security
Referencefrom $149support & customisation
Hardening & Field Guides
windows-hardening PowerShell baselines, a MITM proxy interception guide, a detailed nmap cheatsheet, and a code-search dorks collection for supply-chain recon.
- Windows hardening
- Nmap
- Dorking
// category 04 · ai & automation
AI & Automation
AI-native infrastructure and automation — a heterogeneous inference engine and an AI document-automation server. Source is public; support, integration and customisation are priced per tool.
AI infrastructurefrom $499support & integration
Peregrine
A from-scratch Rust Mixture-of-Experts inference engine that drives CPU, GPU, RAM and SSD concurrently — engineered to stream very large quantized models straight off disk, behind an OpenAI-compatible API.
- Rust
- MoE inference
- io_uring
AI automationfrom $299support & customisation
OnlyOffice MCP Server
A pure-Python Model Context Protocol server that lets an AI create, read, edit and convert Word, Excel and PowerPoint documents — with a defence-in-depth layer against document-borne attacks and prompt injection.
- Python
- MCP · 77 tools
- docx · xlsx · pptx
AI infrastructurefrom $299support & integration
subnext
A Dynamic Context Runtime: a zero-dependency Rust engine that pairs a small high-attention reasoner with an unbounded memory runtime, so a model works from a small planned working set instead of an ever-growing context window.
- Rust · zero-dep
- LLM context
- MIT
AI researchfrom $499support & integration
unifur
DiffusionBlocks++ — a Rust crate on Burn for block-wise neural-network training: parallel depth denoising, consistency regularization, flow-matching, mixture-of-experts routing and block distillation.
- Rust · Burn
- ML training
- MoE
// category 05 · what we charge for
Paid Work
Bigger than a single tool: rolling the stack out across an estate, building something new from scratch, or a full assessment. Fixed scope, fixed price, agreed in writing before any work begins.
WebR400once-off · single page
Static Websites
Fast, secure, hand-coded static sites from R400 — no page builder, no monthly lock-in, hosted free on a global CDN. Ideal for small businesses, portfolios and landing pages.
- Mobile-responsive
- On-page SEO
- No monthly fee
Tooling serviceQuotedper scope
Deployment & Hardening
We stand any of the above up in your environment — configured, hardened, tuned to your log sources and documented, so your team can run it without us.
- Installed & tuned
- Documented
- Handover included
Tooling serviceQuotedper scope
Custom Module Development
Commission modules for Rustsploit or OpenHack — or a purpose-built tool — for your targets and rules of engagement. You keep the source.
- Built to your ROE
- Memory-safe
- You keep the source
Tooling serviceQuotedper scope
Support & Maintenance
A retainer for teams running this tooling in production: priority fixes, upgrade support, and a direct line to the person who wrote it.
- Priority fixes
- Upgrade support
- Direct line
Engagementfrom $2,500
Web App Pentest — Fixed Scope
A single application, OWASP-based methodology, with a plain-language report and one round of retesting after fixes.
- OWASP
- Report + retest
- Fixed scope
Engagementfrom $3,500
Vendor Product Review
Black-box and white-box assessment of a third-party product or appliance, ending in a clear go/no-go for procurement.
- Black/white-box
- Go/no-go
- Procurement
Engagementfrom $1,800
Code Audit — Sprint
A time-boxed, manual security review of a module or service — line-level findings with severity, impact, and reproducible PoCs.
- Manual review
- Time-boxed
- PoCs
Engagementfrom $4,000
Detection Engineering — Build & Handover
We design, build, tune, and hand over your monitoring stack — Wazuh/Elastic SIEM, pipelines, and DFIR automation, documented and yours to run.
- Build + handover
- Wazuh/Elastic
- Documented
// the fine print
Terms & liability
Authorized, lawful use only. The tooling listed here is offensive- and defensive-security software, published for legitimate security testing, research, and education. You alone are responsible for how you use it. You must have explicit written authorization for any system, network, or application you test. Using these tools against systems you do not own or lack permission to test may be illegal.
No liability. To the maximum extent permitted by law, Cyber Sec and Stephan Botes accept no liability for any direct, indirect, incidental, or consequential damage, data loss, service disruption, financial loss, or legal consequence arising from the download or use — or misuse — of any tool listed here. Everything is provided as-is and without warranty of any kind.
What the per-tool fee buys. Prices shown are a starting point for a single tool and cover installation and configuration help, bug fixes and improvements prioritised for you, and customisation to your environment and rules of engagement. Anything larger is quoted per scope. The source stays published either way — you are paying for the work and the time, not for access.
Paid work is scoped, priced and authorized in writing before it starts. Questions about scope, licensing, or authorization? Get in touch first.