Rusty Tools

What it is

Rusty Tools is a personal collection of security tools, named for the language they're written in. It's grown from a single port scanner into six: a port scanner, a live traffic analyzer, a decoy-service honeypot, an auth log analyzer, a file integrity monitor, and a security config auditor. Every tool works as a standalone command-line program, and every one is also available through a small local web dashboard, so someone who isn't comfortable in a terminal can still point-and-click their way through it.

Finding open doors: the port scanner

The first tool checks a device — or a whole range of devices on a network — to see which "doors" (ports) are open and what services are listening behind them. That's the same kind of reconnaissance step used both by attackers scoping out a target and by defenders auditing their own network for anything exposed that shouldn't be, which makes it a foundational skill for SOC and pentesting work alike.

Watching the wire: live traffic analysis

The second tool watches network traffic as it happens and turns it into something readable — what's talking to what, over which kind of connection, with basic decoding of things like DNS lookups and plain (unencrypted) web requests. It also watches live for a couple of suspicious patterns: one device suddenly hitting a lot of different ports in a few seconds (a possible scan), or a device on the network suddenly showing up with a different hardware address than before (a possible spoofing attempt). A session can also be saved to a file and reopened later in tools like Wireshark for a closer look.

Setting a trap: the honeypot listener

The third tool takes the opposite approach — instead of looking for open doors, it puts a few obvious-looking ones out as bait. It binds a handful of commonly-targeted ports (SSH, FTP, RDP, and others), logs every connection attempt against them with a fake service banner to keep things convincing, and raises an alert when one source hits several of those decoy ports in quick succession — a strong signal of an automated scanner. It's a small taste of the deception side of defense: not just detecting attacks, but attracting and studying them.

Reading the paper trail: the auth log analyzer

The fourth tool moves from the network to the host: it watches the system's authentication log for SSH logins and sudo activity, and flags brute-force attempts — and, more importantly, a successful login that follows a burst of failed ones, which is exactly the kind of detail that's easy to miss scrolling through raw logs by hand but is what a SOC analyst is trained to catch.

Noticing what changed: the file integrity monitor

The fifth tool takes a fingerprint of a directory's contents and checks it again later, flagging anything added, removed, or modified. It's a classic host-based defense: if something changes a file it shouldn't have touched, this is how you'd find out.

Checking the locks: the security config auditor

The sixth tool is the odd one out — instead of watching for something to happen, it checks the system's configuration once and reports what's already wrong: risky SSH settings, accounts that shouldn't have root access, an inactive firewall, unusual setuid binaries, and permissions that are looser than they should be. It's the proactive counterpart to the other five, which are all reactive.

Why I built it

I wanted a hands-on way to practice the core skills a SOC analyst role leans on — finding exposed services, reading raw network traffic, watching auth logs for signs of compromise, and auditing a system's own configuration for gaps — rather than just reading about them. It's also been a solid ongoing project for building real, working software while I keep learning Rust.