• This repository has been archived on 14/Jan/2022
  • Stars
    star
    116
  • Rank 303,894 (Top 6 %)
  • Language
    Shell
  • License
    GNU Affero Genera...
  • Created almost 5 years ago
  • Updated about 4 years ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

thethe

The Threat Hunting Environment

You are a Threat Hunter. While investigating, did you find yourself with more than 20 tabs opened in your browser, scattered .txt files with data and some terminals showing up in the background?

theTHE centralizes all the information on an investigation in a single project and shares its results with your team (and with nobody else). theTHE caches your API responses, so you don't need to repeat the requests. Don’t share your keys, let the users make calls to the services.

theTHE also contains some command-line tools integrated so you don't have to open a terminal and pipe the results in a .txt file.

Your feedback is welcome.

What's new

See releases


Installation

There is a install.sh script to ease installation. Either download and execute it by doing:

curl -sSL https://raw.githubusercontent.com/ElevenPaths/thethe/master/install.sh | bash

or clone this repository with:

git clone --recurse-submodules https://github.com/ElevenPaths/thethe

and inside thethe directory, move the install script one level up and execute it:

mv thethe/install.sh
./install.sh

You MUST have a .env file with the following structure in thethe root directory:

MONGO_INITDB_ROOT_USERNAME=
MONGO_INITDB_ROOT_PASSWORD=
MONGO_INITDB_DATABASE=thethe
THETHE_SECRET=
  • Select a secure user/pass/secret combination at your own for each value.
  • Leave MONGO_INITDB_DATABASE with "thethe" value.

Running thethe

Inside thethe directory:

./start.sh

Are you a developer?

./start dev

API keys

There are not API keys stored by default on the system.

To add an API key, there is an option in the user menu (upper-right corner) to manage your keys.


Database backups and restoration

Mongodb has a bind volume to ease external storage and backups in a folder mongodb_data

In any case, we have provided you with a couple of scripts to backup (a compressed file) and restore data from your mongo container.

Inside utils folder:

Make a backup

backup_thethe_db.sh <mongo_user> <mongo_password>

Restore from a backup

restore_thethe_db.sh <mongo_user> <mongo_password>

backup filename is db.dump.gz


External storage

There is a folder called external for everything theTHE should store outside a database: files, images, etc.

Backup this folder according to your backup policy.


Updating thethe

See updating thethe


Development environment

If you want to collaborate with the project, a development version is provided:

Get the repositories:

git clone --recurse-submodules https://github.com/ElevenPaths/thethe.git

and only for the first time...

cd thethe_frontend
npm install
cd ..

Now you have a dev environment. Every time you need to code, just run thethe with:

./start.sh dev

More info

Website: https://thethe.e-paths.com

License: https://raw.githubusercontent.com/ElevenPaths/thethe/master/LICENSE

More Repositories

1

FOCA

Tool to find metadata and hidden information in the documents.
C#
2,950
star
2

EvilFOCA

Tool to analyze and test security in IPv4 and IPv6 data networks
C#
750
star
3

neto

Neto | A tool to analyse browser extensions
Python
87
star
4

DirtyTooth-RaspberryPi

Exploit the hack for IOS 11.1.2 and earlier to collect leaked information.
Python
81
star
5

siemframework

Python
41
star
6

PESTO

Python
26
star
7

tacyt-maltego-transforms

Python
19
star
8

iPhoneRestrictionsPasscodeBF

C#
15
star
9

Telefonica-WannaCry-FileRestorer-Desktop

C#
15
star
10

GoogleIndexRetriever

Java
12
star
11

EasyDoH

A Firefox plugin that allows you to choose easily between different DNS over HTTPS servers
Python
12
star
12

Wild-Wild-WiFi

Wild Wild WiFi
C#
10
star
13

AtomShields

Security testing framework for repositories and source code
JavaScript
10
star
14

tacyt-sdk-python

Python
7
star
15

AtomShields-cli

Python
7
star
16

m33tfinder

Python
6
star
17

DevicePairedTool

Objective-C
5
star
18

AMSIext

AMSIext
JavaScript
5
star
19

Gists

PowerShell
5
star
20

tacyt-sdk-java

Java
5
star
21

thethe_server

The-The Server
Python
4
star
22

diario-commandline-tools

Python
4
star
23

PinPatrol-Firefox

JavaScript
3
star
24

pyshell2bin

pyshell2bin
Python
3
star
25

sealsigndss-open-client

Java
2
star
26

PySCTChecker

Python
2
star
27

PinPatrol-Chrome

JavaScript
2
star
28

metashield-clean-up-sdk-python

Python
2
star
29

SealSign-BSSAndroidSDK-Samples

Java
2
star
30

MEC

MEC
C#
2
star
31

SealSignDSSLDAPModule

Once registered in a Web App, the HTTP module will capture all requests and check the authentication header for basic credentials. If present, it will authenticate the credentials against the LDAP configured. If not, a 401 response will be sent back to client. The authenticated account will be added to the IIS security context and WCF context through PrimaryIdentity for further processing.
C#
2
star
32

thethe_frontend

The-The Frontend
Vue
2
star
33

SealSign-DSS-JavaApplet

1
star
34

SealSign-BSSNETSDK-Samples

1
star
35

SealSignRemoteDocumentProvider-NodeJS

1
star
36

latch-plugin-openVPN-AS

1
star
37

SealSign-DSSAndroidSDK-Samples

1
star
38

SealSign-BSSMetroSDK-Samples

1
star
39

SealSign-DSSNETSDK-Samples

1
star
40

SealSign-BSSIOSSDK-Samples

1
star
41

SealSign-DSSJavaSDK-Samples

1
star
42

SealSign-DSSWP8SDK-Samples

1
star
43

SealSign-BSSWP8SDK-Samples

1
star
44

SealSign-BSSWPFSDK-Samples

C#
1
star
45

SealSign-DSSIOSSDK-Samples

1
star
46

ghannel

Java
1
star
47

SealSign-BSSJavaSDK-Samples

1
star
48

SealSignRemoteDocumentProvider-WebAPI

JavaScript
1
star
49

SealSign-DSSMetroSDK-Samples

1
star
50

SealSign-SQS-DotNet

Example application of the SealSign SDK Simple Queue Service (SQS) in windows Form application. Ask for the documents, sign them or delete them. With this example you can take a quick look of how SealSign SQS works.
C#
1
star
51

SealSign-ClickOnceClient

JavaScript
1
star