βββββββββββ βββ ββββββ βββββββ βββββββ βββ ββββββββββ βββββββ ββββββββββ βββββββ ββββββββ
βββββββββββ βββββββββββββββββββββββββββββββ ββββββββββββββββββββββββββββββββββββββ ββββββββ
βββββββββββββββββββββββββββ ββββββ ββββββ ββ βββββββββββββββββββββββββ ββββββ ββββββββββ
βββββββββββββββββββββββββββ ββββββ βββββββββββββββββββββββββββββββββββ ββββββ βββββββββ
βββββββββββ ββββββ βββββββββββββββββββββββββββββββββββββββββ βββββββββββββββββββββββββββββββ
βββββββββββ ββββββ ββββββββββ βββββββ ββββββββ βββββββ βββ βββββββββββββ βββββββ ββββββββ
The Complete Cybersecurity Arsenal β 12-Module Platform
From real-time infrastructure monitoring to honeypots, SIEM, C2 orchestration, OSINT and AI-driven threat analysis β everything in one unified command center.
π Live Demo β’ π¦ Modules β’ π Deploy β’ π° Support
ShadowBridge is a self-hosted, modular cybersecurity platform built for security researchers, homelab operators, red/blue teams, and CTF players.
It connects 12 microservices into a single command center β real-time dashboards, honeypots, threat intelligence, C2 orchestration, AI analysis, and 100+ offensive tools β all accessible from your browser.
shadowbridge@nox ~$ status --all
β Monitor 8 machines online Β· 0 alerts
β SENTINEL Cowrie honeypot active Β· 12 IPs in blacklist
β SIEM 3 new IDS alerts since last check
β VAULT 2 pending crack jobs Β· ETA 4min
β ATLAS 14 TTPs tracked Β· 6 mitigated
β NOX-BRAIN AI engine online Β· model: qwen2.5-coder
β HexStrike-AI 104 tools loaded Β· CTF mode ready
β Villain C2 1 active session Β· 185.220.101.44
shadowbridge@nox ~$ _| Module | Description | Type |
|---|---|---|
| π₯οΈ Infrastructure Monitor | Real-time CPU, RAM, disk, network across all machines. WebSocket-streamed, NAT-friendly. | Monitoring |
| π― SENTINEL | Cowrie SSH honeypot + HTTP canary tokens + aggregation API. Every hit TTP-tagged automatically. | Deception |
| π‘οΈ SIEM | Live Suricata EVE JSON + Wazuh alerts. Kill chain reconstruction from honeypot + IDS correlation. | Detection |
| π€ NOX-BRAIN | Local AI (Ollama) grounded on live threat context. Multi-model, multi-node AI fleet. | AI Analysis |
| π OSIRIS | OSINT engine β domain enum, IP reputation, breach data, social footprint in one dashboard. | Intelligence |
| β οΈ Villain C2 | REST bridge over Villain C2. Manage sessions, generate implants, stream loot via API. | Offensive |
| π VAULT | Async hash cracking β John the Ripper + hashcat. RockYou, FastTrack, custom wordlists. | Credentials |
| π― ATLAS | Purple team MITRE ATT&CK tracker. 14 tactics, 200+ techniques. Auto-populated from events. | Purple Team |
| β‘ NOX-COMMAND | Kill chain orchestrator: OSINT β Recon β Vuln Scan β Exploitation β C2 β Loot β Report. | Orchestration |
| π» HexStrike-AI | 104+ security tools with AI parameterization β nmap, sqlmap, nikto, ffuf, hydra and more. | CTF / Pentest |
| π‘ RuView | WiFi DensePose β detect presence and vital signs from WiFi signals. No camera required. | Physical Layer |
| π― HoneyAI | AI-generated SSH shell that fools attackers into believing they're on a real production server. | Deception |
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β SHADOWBRIDGE PLATFORM β
β β
β Your Machines ShadowBridge AI Fleet β
β [agent.py WS] βββΆ [FastAPI + SQLite] βββΆ [Ollama] β
β β β
β βΌ β
β Threat Intelligence β
β [SIEM Β· Honeypot Β· ATLAS] β
β β β
β βΌ β
β Your Browser β
β [Live Dashboard] β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
Key properties:
- π Agent-based, NAT-friendly β machines connect outbound, no open ports needed
- 𧩠Microservice architecture β each module is independent, independently scalable
- π€ AI-first β every module feeds context to the AI analysis layer
- β‘ WebSocket-streamed β zero-latency live data, no polling
# Clone
git clone https://github.com/webwizardg99/shadowbridge-web
cd shadowbridge-web
# Deploy to your cPanel hosting (requires API token)
bash deploy.sh
# Or open index.html locally
open index.htmlStack: Pure HTML/CSS/JS β zero dependencies, zero build step. Drop it anywhere.
| Repo | Description |
|---|---|
| shadow-lab | Core monitoring backend β FastAPI + SQLite + WebSocket |
| sentinel | Multi-source honeypot aggregator |
| atlas | Purple team MITRE ATT&CK TTP tracker |
| honeyai | AI-powered SSH honeypot response generator |
| hexstrike-ai | 150+ security tools MCP framework |
| Feature | Monitor | Pro | Arsenal |
|---|---|---|---|
| Real-time machine stats | β | β | β |
| Up to machines | 3 | 10 | β |
| Honeypot + SIEM | β | β | β |
| AI analysis | β | β | β |
| C2 + VAULT + HexStrike | β | β | β |
| OSINT + Kill chain | β | β | β |
| Price | Free | $12/mo | $49/mo |
π§ Early Access: Monitor is free without registration. Arsenal is currently free for registered users.
This is a solo-built platform. If it saves you time or sparks ideas, consider supporting:
| Method | Details |
|---|---|
| β Buy Me A Coffee | buymeacoffee.com/86szabadosy |
| π³ Revolut | @szg86 Β· IBAN: LT26 3250 0016 3929 |
| βΏ Bitcoin | [coming soon] |
| Ξ Ethereum | [coming soon] |
ShadowBridge Arsenal modules (C2, credential cracking, offensive tools) are for authorized security testing, CTF competitions, homelab research, and educational purposes only. You are responsible for ensuring you have proper authorization before using any offensive capabilities.
MIT License β see LICENSE
Built for the shadows. β
