guest@mamoru: ~Last update 2026-10-25

whoami

A working white-hat hacker explains how attacks work and how to defend against them.Guides to security tools, a record of data breaches announced in Japan, and security articles, all with sources.

ls -l ~/

cat RULES.md

Use the tools listed here only on systems you own or have permission to test.

ls ./tools --latest

Latest tool reviews

Local only
Stays on your machine and sends nothing out
Reaches others
Sees other people's traffic or sends traffic to their devices
Can harm others
Can do real harm to others: intrusion, tampering, or load

AdGuard Home

Impact Reaches others
adguardteam/adguardhome

A self-hosted DNS server that blocks DNS lookups for ads, trackers, and dangerous domains across a whole home or small-office network.

Purpose
Defense
Type
Self-hosted server
Difficulty
Intermediate
License
CopyleftGPL-3.0
Category
Defense and hardening / Network
Actively updatedstars37,685Last update 2026-10-23
Read the AdGuard Home review

Authelia

Impact Local only
authelia/authelia

An authentication server that works with your reverse proxy to put a login portal and multi-factor authentication in front of your own web apps. It also provides single sign-on and OpenID Connect.

Purpose
Defense
Type
Self-hosted server
Difficulty
Advanced
License
PermissiveApache-2.0
Category
Defense and hardening / AppSec and DevSecOps
Actively updatedstars29,401Last update 2026-10-25
Read the Authelia review

CyberChef

Impact Local only
gchq/cyberchef

A web app for converting and analyzing data by chaining operations such as Base64 and hex decoding, hashing, and text extraction into a "recipe". Processing happens in your browser.

Purpose
Defense
Type
Web service
Difficulty
Beginner
License
PermissiveApache-2.0
Category
Cryptography and passwords / Forensics
Actively updatedstars36,203Last update 2026-10-23
Read the CyberChef review

Infisical

Impact Local only
infisical/infisical

A secrets management platform that keeps API keys and passwords in one place and hands them to apps and CI at runtime. Use Infisical Cloud or run it yourself.

Purpose
Defense
Type
Self-hosted server
Difficulty
Intermediate
License
Check termsMIT(ee ディレクトリは商用の Enterprise ライセンス)
Category
Defense and hardening / AppSec and DevSecOps
Actively updatedstars29,981Last update 2026-10-25
Read the Infisical review

JumpServer

Impact Reaches others
jumpserver/jumpserver

An open-source bastion host (privileged access management, PAM) that funnels operators' access to servers and databases through one place and records who did what and when.

Purpose
Defense
Type
Self-hosted server
Difficulty
Intermediate
License
CopyleftGPL-3.0
Category
Defense and hardening
Actively updatedstars31,832Last update 2026-10-23
Read the JumpServer review

Keycloak

Impact Local only
keycloak/keycloak

A self-hosted identity and access management server that handles login for your apps, with single sign-on, multi-factor authentication, identity brokering, and user management.

Purpose
Defense
Type
Self-hosted server
Difficulty
Intermediate
License
PermissiveApache-2.0
Category
Defense and hardening / AppSec and DevSecOps
Actively updatedstars37,505Last update 2026-10-25
Read the Keycloak review
See all toolsls ./tools --all

sort -k severity ./incidents | head -5

Most severe data breaches in Japan, last 30 days

  1. 5CriticalPizza Hut JapanOnline ordering payment API
  2. 5CriticalLindt & Sprungli Japanonline shop and app
  3. 5CriticalfutureshopSaaS e-commerce platform
  4. 5CriticalMoss Food ServicesMos Card (contractor Value Design)
  5. 5CriticalLawsonLawson ID and app reservations
See all incidentsls ./incidents --all

cat ./guides/lab-setup.md

New to security tools?

Your PCIsolated networkTest VMTarget VMInternet

How to Build a Safe Security Test Lab

A practical guide to building an isolated Hyper-V analysis lab using FLARE-VM and REMnux, managing virtual switches, and adhering to legal boundaries.

guides/lab-setup.md