Skip to content

Commit 3076223

Browse files
author
bad-antics
committed
feat: NullSec Linux v4.0 - 90+ tools, new hardening features
## What's New in v4.0 ### New Tools (19 added) - nullsec-cppsentry (C++) - Packet sentinel - nullsec-fsharpsignal (F#) - Signal correlator - nullsec-adashield (Ada) - Crypto validator - nullsec-crystalrecon (Crystal) - Network recon - nullsec-kotlinguard (Kotlin) - Container scanner - nullsec-swiftsentinel (Swift) - macOS monitor - nullsec-ocamlparse (OCaml) - Policy parser - nullsec-clusterguard (Erlang) - Distributed IDS - nullsec-reporaider (Clojure) - Secret scanner - nullsec-luashield (Lua) - WAF engine - nullsec-juliaprobe (Julia) - Anomaly detector - nullsec-perlscrub (Perl) - Log sanitizer - nullsec-vvault (V) - Credential vault - nullsec-nimhunter (Nim) - Memory forensics - nullsec-zigscan (Zig) - Binary analyzer - nullsec-shelltrace (Tcl) - Command auditor - nullsec-flowtrace (Haskell) - Flow analyzer - nullsec-dlangaudit (D) - Security auditor - nullkia v2.0 - Mobile framework ### Security - LUKS2 + Argon2id encryption - Landlock LSM support - CET/Shadow stack - FORTIFY_SOURCE=3 - Kernel lockdown mode ### New Editions - Cloud (AWS/GCP/Azure) - Air-gapped - Apple Silicon
1 parent 7374808 commit 3076223

2 files changed

Lines changed: 498 additions & 123 deletions

File tree

‎README.md‎

Lines changed: 161 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,16 @@
11
<div align="center">
22

3-
# 🐧 NullSec Linux
3+
# �� NullSec Linux
44

55
### Security-Focused Linux Distribution with Maximum Hardening
66

77
**by bad-antics development**
88

99
[![License: NPL](https://img.shields.io/badge/License-NullSec%20Public-red.svg)](LICENSE)
10-
[![Base](https://img.shields.io/badge/Base-Debian%2012-blue.svg)]()
11-
[![Tools](https://img.shields.io/badge/Security%20Tools-50+-green.svg)]()
10+
[![Base](https://img.shields.io/badge/Base-Debian%2013-blue.svg)]()
11+
[![Tools](https://img.shields.io/badge/Security%20Tools-90+-green.svg)]()
1212
[![Hardened](https://img.shields.io/badge/Security-Maximum%20Hardening-gold.svg)]()
13+
[![Version](https://img.shields.io/badge/Version-4.0-purple.svg)]()
1314
[![GitHub](https://img.shields.io/badge/GitHub-bad--antics-black?logo=github)](https://github.com/bad-antics)
1415

1516
```
@@ -19,9 +20,11 @@
1920
/ /| / /_/ / / / ___/ / __/ /__ / /___/ / / / / /_/ /> <
2021
/_/ |_/\__,_/_/_/ /____/\___/\___/ /_____/_/_/ /_/\__,_/_/|_|
2122
22-
[ bad-antics development | Security Distribution v3.0 ]
23+
[ bad-antics development | Security Distribution v4.0 ]
2324
```
2425

26+
### 🔑 **[Join discord.gg/killers](https://discord.gg/killers)** for premium tools & support!
27+
2528
</div>
2629

2730
---
@@ -38,27 +41,30 @@ Stripped, hardened, production-ready images with maximum security features.
3841

3942
| Edition | Description | Size | Download |
4043
|---------|-------------|------|----------|
41-
| **NullSec Pro — Full** | Complete hardened system for installation | 3.2 GB | [ISO](https://github.com/bad-antics/nullsec-linux/releases/download/v3.0/nullsec-pro-3.0-amd64.iso) |
42-
| **NullSec Pro — USB** | Bootable USB with encrypted persistence | 4.1 GB | [IMG](https://github.com/bad-antics/nullsec-linux/releases/download/v3.0/nullsec-pro-usb-3.0-amd64.img) |
43-
| **NullSec Pro — Minimal** | CLI-only, minimal attack surface | 890 MB | [ISO](https://github.com/bad-antics/nullsec-linux/releases/download/v3.0/nullsec-pro-minimal-3.0-amd64.iso) |
44+
| **NullSec Pro — Full** | Complete hardened system | 3.4 GB | [ISO](https://github.com/bad-antics/nullsec-linux/releases/download/v4.0/nullsec-pro-4.0-amd64.iso) |
45+
| **NullSec Pro — USB** | Bootable USB with encrypted persistence | 4.3 GB | [IMG](https://github.com/bad-antics/nullsec-linux/releases/download/v4.0/nullsec-pro-usb-4.0-amd64.img) |
46+
| **NullSec Pro — Minimal** | CLI-only, minimal attack surface | 920 MB | [ISO](https://github.com/bad-antics/nullsec-linux/releases/download/v4.0/nullsec-pro-minimal-4.0-amd64.iso) |
47+
| **NullSec Pro — Cloud** | AWS/GCP/Azure optimized | 1.8 GB | [AMI/VMDK](https://github.com/bad-antics/nullsec-linux/releases/download/v4.0/nullsec-pro-cloud-4.0.tar.gz) |
4448

4549
### Premium Features:
4650
- ✅ Kernel hardening (KSPP, grsecurity principles)
4751
- ✅ Zero telemetry — completely stripped
48-
- ✅ Full disk encryption by default
49-
- ✅ Secure boot support
52+
- ✅ Full disk encryption (LUKS2 + Argon2id)
53+
- ✅ Secure boot with custom keys
5054
- ✅ Anti-forensics capabilities
5155
- ✅ MAC spoofing on boot
56+
- ✅ Tor/I2P integration
57+
- ✅ 90+ security tools pre-installed
5258

5359
---
5460

5561
## 🐧 Standard Editions
5662

5763
| Edition | Description | Size | Download |
5864
|---------|-------------|------|----------|
59-
| **Full** | Complete toolkit (50+ tools) | 4.8 GB | [ISO](https://github.com/bad-antics/nullsec-linux/releases/download/v3.0/nullsec-full-3.0-amd64.iso) |
60-
| **Lite** | Essential tools only | 2.4 GB | [ISO](https://github.com/bad-antics/nullsec-linux/releases/download/v3.0/nullsec-lite-3.0-amd64.iso) |
61-
| **NetInstall** | Minimal, downloads during install | 450 MB | [ISO](https://github.com/bad-antics/nullsec-linux/releases/download/v3.0/nullsec-netinst-3.0-amd64.iso) |
65+
| **Full** | Complete toolkit (90+ tools) | 5.2 GB | [ISO](https://github.com/bad-antics/nullsec-linux/releases/download/v4.0/nullsec-full-4.0-amd64.iso) |
66+
| **Lite** | Essential tools only | 2.6 GB | [ISO](https://github.com/bad-antics/nullsec-linux/releases/download/v4.0/nullsec-lite-4.0-amd64.iso) |
67+
| **NetInstall** | Minimal, downloads during install | 480 MB | [ISO](https://github.com/bad-antics/nullsec-linux/releases/download/v4.0/nullsec-netinst-4.0-amd64.iso) |
6268

6369
---
6470

@@ -68,9 +74,10 @@ Boot directly without installation — leaves no trace on host system.
6874

6975
| Edition | Description | Size | Download |
7076
|---------|-------------|------|----------|
71-
| **Live Standard** | Full toolkit in RAM | 3.6 GB | [ISO](https://github.com/bad-antics/nullsec-linux/releases/download/v3.0/nullsec-live-3.0-amd64.iso) |
72-
| **Live Stealth** | Anti-forensics, RAM-only | 2.8 GB | [ISO](https://github.com/bad-antics/nullsec-linux/releases/download/v3.0/nullsec-live-stealth-3.0-amd64.iso) |
73-
| **Live Forensics** | DFIR focused, read-only mounts | 4.2 GB | [ISO](https://github.com/bad-antics/nullsec-linux/releases/download/v3.0/nullsec-live-forensics-3.0-amd64.iso) |
77+
| **Live Standard** | Full toolkit in RAM | 3.8 GB | [ISO](https://github.com/bad-antics/nullsec-linux/releases/download/v4.0/nullsec-live-4.0-amd64.iso) |
78+
| **Live Stealth** | Anti-forensics, RAM-only | 3.0 GB | [ISO](https://github.com/bad-antics/nullsec-linux/releases/download/v4.0/nullsec-live-stealth-4.0-amd64.iso) |
79+
| **Live Forensics** | DFIR focused, read-only mounts | 4.5 GB | [ISO](https://github.com/bad-antics/nullsec-linux/releases/download/v4.0/nullsec-live-forensics-4.0-amd64.iso) |
80+
| **Live Air-Gapped** | No network stack, offline only | 2.2 GB | [ISO](https://github.com/bad-antics/nullsec-linux/releases/download/v4.0/nullsec-live-airgap-4.0-amd64.iso) |
7481

7582
---
7683

@@ -79,19 +86,18 @@ Boot directly without installation — leaves no trace on host system.
7986
| Architecture | Description | Download |
8087
|--------------|-------------|----------|
8188
| **AMD64/x86_64** | Standard 64-bit PCs | All editions above |
82-
| **ARM64/aarch64** | Raspberry Pi 4/5, ARM servers | [ISO](https://github.com/bad-antics/nullsec-linux/releases/download/v3.0/nullsec-3.0-arm64.iso) |
83-
| **RISC-V** | StarFive, experimental | [ISO](https://github.com/bad-antics/nullsec-linux/releases/download/v3.0/nullsec-3.0-riscv64.iso) |
89+
| **ARM64/aarch64** | Raspberry Pi 4/5, ARM servers | [ISO](https://github.com/bad-antics/nullsec-linux/releases/download/v4.0/nullsec-4.0-arm64.iso) |
90+
| **RISC-V** | StarFive VisionFive 2 | [ISO](https://github.com/bad-antics/nullsec-linux/releases/download/v4.0/nullsec-4.0-riscv64.iso) |
91+
| **Apple Silicon** | M1/M2/M3 via Asahi | [IMG](https://github.com/bad-antics/nullsec-linux/releases/download/v4.0/nullsec-4.0-asahi.img) |
8492

8593
---
8694

8795
## 🔍 Verify Downloads
8896

89-
Always verify your downloads before use!
90-
9197
```bash
9298
# Download checksums
93-
wget https://github.com/bad-antics/nullsec-linux/releases/download/v3.0/SHA256SUMS
94-
wget https://github.com/bad-antics/nullsec-linux/releases/download/v3.0/SHA256SUMS.sig
99+
wget https://github.com/bad-antics/nullsec-linux/releases/download/v4.0/SHA256SUMS
100+
wget https://github.com/bad-antics/nullsec-linux/releases/download/v4.0/SHA256SUMS.sig
95101

96102
# Verify checksum
97103
sha256sum -c SHA256SUMS 2>/dev/null | grep nullsec-pro
@@ -103,66 +109,121 @@ gpg --verify SHA256SUMS.sig SHA256SUMS
103109

104110
---
105111

106-
## �� Security Hardening
107-
108-
All NullSec Linux editions include:
112+
## 🛡️ Security Hardening
109113

110114
### Kernel Hardening
111115
- KASLR enabled
112116
- SMEP/SMAP enabled
113117
- PTI (Meltdown mitigation)
114118
- Retpoline (Spectre mitigation)
115119
- Kernel module signing enforced
120+
- Lockdown mode (integrity)
121+
- KFENCE memory safety
116122

117123
### Binary Hardening
118124
- PIE (Position Independent Executables)
119125
- Full RELRO
120126
- Stack canaries
121-
- FORTIFY_SOURCE=2
127+
- FORTIFY_SOURCE=3
122128
- NX/DEP enabled
129+
- CET (Control-flow Enforcement)
130+
- Shadow stack
123131

124132
### Network Hardening
125-
- Firewall enabled by default
133+
- nftables firewall default
126134
- IPv6 privacy extensions
127135
- SYN cookies enabled
128136
- Reverse path filtering
137+
- TCP timestamps disabled
138+
- ICMP redirect disabled
129139

130140
### Application Hardening
131141
- AppArmor profiles
132-
- Seccomp filters
142+
- Seccomp-bpf filters
133143
- Namespace isolation
134144
- Capability dropping
145+
- Landlock LSM
146+
- IMA/EVM integrity
135147

136148
---
137149

138-
## 🛠️ Pre-Installed Security Tools (50+)
150+
## 🛠️ Pre-Installed Security Tools (90+)
139151

140-
All tools feature **maximum security hardening** with:
141-
- ✅ Input validation
142-
- ✅ Bounds checking
143-
- ✅ Secure memory zeroing
144-
- ✅ Constant-time crypto
145-
- ✅ Rate limiting
146-
- ✅ Defense in depth
152+
### Offensive Tools
153+
154+
| Tool | Language | Purpose |
155+
|------|----------|---------|
156+
| [nullsec-injector](https://github.com/bad-antics/nullsec-injector) | Rust | Memory-safe process injection |
157+
| [nullsec-shellcraft](https://github.com/bad-antics/nullsec-shellcraft) | Racket | Shellcode generation DSL |
158+
| [nullsec-exploit](https://github.com/bad-antics/nullsec-exploit) | C | Binary exploitation framework |
159+
| [nullsec-c2](https://github.com/bad-antics/nullsec-c2) | Go | Command & control server |
160+
| [nullsec-phish](https://github.com/bad-antics/nullsec-phish) | Python | Phishing framework |
147161

148-
### Hardened Tool Suite
162+
### Network Tools
149163

150164
| Tool | Language | Purpose |
151165
|------|----------|---------|
152-
| [nullsec-memcorrupt](https://github.com/bad-antics/nullsec-memcorrupt) | Zig | Memory corruption analysis |
153166
| [nullsec-netprobe](https://github.com/bad-antics/nullsec-netprobe) | Nim | Stealthy network recon |
154-
| [nullsec-shellcraft](https://github.com/bad-antics/nullsec-shellcraft) | Racket | Shellcode generation DSL |
155-
| [nullsec-cryptwrap](https://github.com/bad-antics/nullsec-cryptwrap) | Ada/SPARK | Formally verified crypto |
156-
| [nullsec-procspy](https://github.com/bad-antics/nullsec-procspy) | Forth | Minimal process monitor |
157-
| [nullsec-injector](https://github.com/bad-antics/nullsec-injector) | Rust | Memory-safe injection |
158-
| [nullsec-stealth](https://github.com/bad-antics/nullsec-stealth) | Crystal | Steganography toolkit |
159167
| [nullsec-portscan](https://github.com/bad-antics/nullsec-portscan) | Elixir | Async port scanner |
160-
| [nullsec-hashwitch](https://github.com/bad-antics/nullsec-hashwitch) | Julia | Hash analysis/cracking |
168+
| [nullsec-netseer](https://github.com/bad-antics/nullsec-netseer) | Haskell | Traffic analysis |
169+
| [nullsec-sniffer](https://github.com/bad-antics/nullsec-sniffer) | Clojure | Packet capture |
170+
| [nullsec-flowtrace](https://github.com/bad-antics/nullsec-flowtrace) | Haskell | Flow analyzer |
171+
| [nullsec-crystalrecon](https://github.com/bad-antics/nullsec-crystalrecon) | Crystal | Network reconnaissance |
172+
173+
### Analysis Tools
174+
175+
| Tool | Language | Purpose |
176+
|------|----------|---------|
177+
| [nullsec-memcorrupt](https://github.com/bad-antics/nullsec-memcorrupt) | Zig | Memory corruption analysis |
161178
| [nullsec-bingaze](https://github.com/bad-antics/nullsec-bingaze) | C++20 | Binary analysis |
162179
| [nullsec-kernspy](https://github.com/bad-antics/nullsec-kernspy) | Go | Kernel module analyzer |
163-
| [nullsec-netseer](https://github.com/bad-antics/nullsec-netseer) | Haskell | Network traffic analysis |
164-
| [nullsec-sniffer](https://github.com/bad-antics/nullsec-sniffer) | Clojure | Packet analysis |
165-
| [nullsec-keysniff](https://github.com/bad-antics/nullsec-keysniff) | F# | Input monitoring |
180+
| [nullsec-zigscan](https://github.com/bad-antics/nullsec-zigscan) | Zig | Binary entropy analyzer |
181+
| [nullsec-nimhunter](https://github.com/bad-antics/nullsec-nimhunter) | Nim | Memory forensics |
182+
| [nullsec-ocamlparse](https://github.com/bad-antics/nullsec-ocamlparse) | OCaml | Security policy parser |
183+
184+
### Cryptography Tools
185+
186+
| Tool | Language | Purpose |
187+
|------|----------|---------|
188+
| [nullsec-cryptwrap](https://github.com/bad-antics/nullsec-cryptwrap) | Ada/SPARK | Formally verified crypto |
189+
| [nullsec-hashwitch](https://github.com/bad-antics/nullsec-hashwitch) | Julia | Hash analysis |
190+
| [nullsec-adashield](https://github.com/bad-antics/nullsec-adashield) | Ada | Protocol validator |
191+
| [nullsec-vvault](https://github.com/bad-antics/nullsec-vvault) | V | Credential vault |
192+
193+
### Defense Tools
194+
195+
| Tool | Language | Purpose |
196+
|------|----------|---------|
197+
| [nullsec-cppsentry](https://github.com/bad-antics/nullsec-cppsentry) | C++ | Packet sentinel |
198+
| [nullsec-swiftsentinel](https://github.com/bad-antics/nullsec-swiftsentinel) | Swift | macOS event monitor |
199+
| [nullsec-kotlinguard](https://github.com/bad-antics/nullsec-kotlinguard) | Kotlin | Container scanner |
200+
| [nullsec-clusterguard](https://github.com/bad-antics/nullsec-clusterguard) | Erlang | Distributed IDS |
201+
| [nullsec-luashield](https://github.com/bad-antics/nullsec-luashield) | Lua | WAF rules engine |
202+
203+
### OSINT & Recon
204+
205+
| Tool | Language | Purpose |
206+
|------|----------|---------|
207+
| [nullsec-reporaider](https://github.com/bad-antics/nullsec-reporaider) | Clojure | Git secret scanner |
208+
| [nullsec-juliaprobe](https://github.com/bad-antics/nullsec-juliaprobe) | Julia | Anomaly detector |
209+
| [nullsec-perlscrub](https://github.com/bad-antics/nullsec-perlscrub) | Perl | Log sanitizer |
210+
| [nullsec-shelltrace](https://github.com/bad-antics/nullsec-shelltrace) | Tcl | Command auditor |
211+
| [nullsec-fsharpsignal](https://github.com/bad-antics/nullsec-fsharpsignal) | F# | Signal correlator |
212+
213+
### Mobile Security
214+
215+
| Tool | Language | Purpose |
216+
|------|----------|---------|
217+
| [nullkia](https://github.com/bad-antics/nullkia) | Multi | Mobile security framework |
218+
| [nullsec-apkanalyzer](https://github.com/bad-antics/nullsec-apkanalyzer) | Kotlin | APK analysis |
219+
| [nullsec-iosextract](https://github.com/bad-antics/nullsec-iosextract) | Swift | iOS forensics |
220+
221+
### Automation & Scripting
222+
223+
| Tool | Language | Purpose |
224+
|------|----------|---------|
225+
| [nullsec-framework](https://github.com/bad-antics/nullsec-framework) | Python | Unified framework |
226+
| [nullsec-dlangaudit](https://github.com/bad-antics/nullsec-dlangaudit) | D | Security auditor |
166227
| [nullsec-beacon](https://github.com/bad-antics/nullsec-beacon) | Erlang | Network beacon |
167228

168229
---
@@ -173,16 +234,16 @@ All tools feature **maximum security hardening** with:
173234

174235
| Component | Minimum | Recommended |
175236
|-----------|---------|-------------|
176-
| CPU | 64-bit x86_64 | Multi-core |
177-
| RAM | 2 GB | 8 GB |
178-
| Storage | 20 GB | 50 GB |
237+
| CPU | 64-bit x86_64 | Multi-core (4+) |
238+
| RAM | 2 GB | 16 GB |
239+
| Storage | 20 GB | 100 GB SSD |
179240
| Graphics | Any | Hardware accel |
180241

181242
### Create Bootable USB
182243

183244
```bash
184245
# Linux/macOS
185-
sudo dd if=nullsec-pro-3.0-amd64.iso of=/dev/sdX bs=4M status=progress conv=fsync
246+
sudo dd if=nullsec-pro-4.0-amd64.iso of=/dev/sdX bs=4M status=progress conv=fsync
186247

187248
# Or use Ventoy for multi-ISO boot
188249
sudo ventoy -i /dev/sdX
@@ -201,8 +262,11 @@ nullsec-fetch
201262
# Launch framework
202263
nullsec-framework
203264

204-
# Apply hardening
205-
nullsec-harden --apply
265+
# Apply hardening profile
266+
nullsec-harden --profile maximum
267+
268+
# Start anonymity mode
269+
nullsec-anon --tor --mac-spoof
206270
```
207271

208272
---
@@ -211,21 +275,61 @@ nullsec-harden --apply
211275

212276
```
213277
/opt/nullsec/
214-
├── bin/ # All NullSec tools
278+
├── bin/ # 90+ NullSec tools
215279
├── configs/ # Configuration files
216280
├── payloads/ # Payload templates
217281
├── wordlists/ # Curated wordlists
218282
├── scripts/ # Automation scripts
283+
├── modules/ # Framework modules
219284
└── docs/ # Documentation
220285
221286
/etc/nullsec/
222287
├── hardening/ # Hardening profiles
223-
├── firewall/ # Firewall rules
224-
└── apparmor/ # AppArmor profiles
288+
├── firewall/ # nftables rules
289+
├── apparmor/ # AppArmor profiles
290+
├── seccomp/ # Seccomp filters
291+
└── integrity/ # IMA policies
225292
```
226293

227294
---
228295

296+
## 🆕 What's New in v4.0
297+
298+
### New Tools Added
299+
- `nullsec-cppsentry` - C++20 packet sentinel
300+
- `nullsec-fsharpsignal` - F# signal correlator
301+
- `nullsec-adashield` - Ada crypto validator
302+
- `nullsec-crystalrecon` - Crystal network recon
303+
- `nullsec-kotlinguard` - Kotlin container scanner
304+
- `nullsec-swiftsentinel` - Swift macOS monitor
305+
- `nullsec-ocamlparse` - OCaml policy parser
306+
- `nullsec-clusterguard` - Erlang distributed IDS
307+
- `nullsec-reporaider` - Clojure secret scanner
308+
- `nullsec-luashield` - Lua WAF engine
309+
- `nullsec-juliaprobe` - Julia anomaly detector
310+
- `nullsec-perlscrub` - Perl log sanitizer
311+
- `nullsec-vvault` - V credential vault
312+
- `nullsec-nimhunter` - Nim memory forensics
313+
- `nullsec-zigscan` - Zig binary analyzer
314+
- `nullsec-shelltrace` - Tcl command auditor
315+
- `nullsec-flowtrace` - Haskell flow analyzer
316+
- `nullsec-dlangaudit` - D security auditor
317+
- `nullkia` v2.0 - Mobile security framework
318+
319+
### Security Improvements
320+
- LUKS2 with Argon2id
321+
- Landlock LSM support
322+
- CET/Shadow stack
323+
- FORTIFY_SOURCE=3
324+
- Kernel lockdown mode
325+
326+
### New Editions
327+
- Cloud edition (AWS/GCP/Azure)
328+
- Air-gapped edition
329+
- Apple Silicon support
330+
331+
---
332+
229333
## 🔗 Related Projects
230334

231335
| Project | Description |
@@ -234,7 +338,8 @@ nullsec-harden --apply
234338
| [nullsec-payloads](https://github.com/bad-antics/nullsec-payloads) | Payload templates |
235339
| [nullsec-wordlists](https://github.com/bad-antics/nullsec-wordlists) | Curated wordlists |
236340
| [nullsec-configs](https://github.com/bad-antics/nullsec-configs) | Dotfiles & configs |
237-
| [nullsec-docs](https://github.com/bad-antics/nullsec-docs) | Full documentation |
341+
| [nullkia](https://github.com/bad-antics/nullkia) | Mobile security framework |
342+
| [bad-antics.github.io](https://bad-antics.github.io) | Download portal |
238343

239344
---
240345

0 commit comments

Comments
 (0)