Services on CIRCL

Pandora Document and File Analysis

Mon, 01 Jan 0001 00:00:00 +0000

Pandora Document and File Analysis

Pandora is an analysis framework designed to determine if a file is suspicious, conveniently displaying the results. Pandora provides a user-friendly content preview interface for large documents, including a preview of the metadata. This allows users to view files without the need to open them locally.

Pandora performs static analysis and is the recommended service for documents and other binaries. For dynamic analysis of Linux-based malware, use Kunai Sandbox.

Passive DNS

Mon, 01 Jan 0001 00:00:00 +0000

Passive DNS version 2.0

CIRCL Passive DNS is a database that stores historical DNS records from various resources, including malware analysis and partners. The DNS historical data is indexed, making it searchable for incident handlers, security analysts, or researchers.

In November 2023, CIRCL released version 2.0 of its Passive DNS service. The new version is backward-compatible with the previous 1.0 version. The output format remains Passive DNS - Common Output Format, and the query interface is similar. New headers were introduced to support some new functionalities, including filtering and pagination. If no headers are set, the Passive DNS API falls back to the previous 1.0 version’s behavior.

Vulnerability-Lookup Service

Mon, 01 Jan 0001 00:00:00 +0000

Multi-Source Vulnerability-Lookup and Collaboration

Vulnerability-Lookup facilitates quick correlation of vulnerabilities from various sources, independent of vulnerability IDs, and streamlines the management of Coordinated Vulnerability Disclosure (CVD).

Vulnerability-Lookup is accessible via a web interface, RSS/Atom and an HTTP API. Vulnerability-Lookup is an interface to search publicly known information from security vulnerabilities in software and hardware along with their corresponding exposures. You can also register and collaborate on the vulnerability intelligence by adding comments or even reporting vulnerabilities.

BGP Ranking

Mon, 01 Jan 0001 00:00:00 +0000

BGP Ranking is a public service operated by CIRCL that gathers external security data to calculate the security ranking of Internet service providers. It helps analysts identify malicious activity associated with an autonomous system (AS) and follow its ranking over time.

Use BGP Ranking

Open the public BGP Ranking service to explore autonomous-system rankings.
Consult the BGP Ranking documentation for the JSON API and Python client.
Browse the source code to learn about the software or contribute.

For historical IP address announcements, see CIRCL’s IP to ASN Mapping Whois Service.

CIRCL hashlookup

Mon, 01 Jan 0001 00:00:00 +0000

CIRCL hashlookup (hashlookup.circl.lu)

CIRCL hashlookup is a public API for looking up file hashes in known-file databases. It includes the NSRL Reference Data Set (RDS) and several other data sources. The service is available through an HTTP REST API, which is documented using an OpenAPI specification. It is free to use and provided on a best-effort basis.

Sources included in CIRCL hashlookup

Common Windows 10 and Windows 11 builds (French, Dutch, German, UK, and US)
NIST NSRL - All RDS hash sets, including current, modern, Android, iOS, and legacy sets, with SHA-256 mappings
Ubuntu distribution packages
CentOS core operating system distribution
Fedora Project EPEL repository
Kali Linux distribution packages
openSUSE distribution packages
OpenBSD binary tar.gz archives
CDNJS
Snap public repository

Is this a database of malicious or non-malicious file hashes?

The CIRCL hashlookup service only provides details about known files that appear in one or more of its source databases. These details provide context for file hashes encountered during investigations or digital forensic analysis. A match does not, by itself, indicate whether a file is malicious.

MISP - Open Source Threat Intelligence Platform

Mon, 01 Jan 0001 00:00:00 +0000

CIRCL-operated sharing communities

Turn threat information into collective defence

MISP is an open-source threat intelligence and sharing platform. It gives analysts, incident responders and automated security tools a common, structured way to collect, enrich, correlate and exchange knowledge about threats.

Request community access Explore the MISP project ↗

Open source
Threat intelligence

More than an IOC database

MISP models both technical and contextual intelligence: observables and indicators, incidents, threat actors, campaigns, vulnerabilities, tactics and techniques, and the relationships between them. Instead of moving unstructured lists between teams, contributors build reusable knowledge that can be searched, correlated, enriched and acted upon.

MISP - Open Source Threat Intelligence Platform & Open Standards For Threat Information Sharing - Training Materials

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

In a continuous effort since 2016, CIRCL frequently gives practical training sessions about MISP (Open Source Threat Intelligence Platform & Open Standards For Threat Information Sharing). The purpose is to reach out to security analysts using MISP as a threat intelligence platform along with users using it as an information sharing platform.

The MISP training repository is the reference for the training materials and their LaTeX source code. It covers core MISP software and standards, threat intelligence and OSINT, and workshops on building information sharing communities.

Passive SSL

Mon, 01 Jan 0001 00:00:00 +0000

Passive SSL

CIRCL Passive SSL is a database storing historical X.509 certificates seen per IP address. The Passive SSL historical data is indexed per IP address, which makes it searchable for incident handlers, security analysts or researchers.

How do you collect the SSL certificates?

The CIRCL Passive SSL database uses public scanning datasets like the excellent scans.io project.

For more information, Passive SSL was presented at FIRST 2015 in Berlin.

Digital Forensic - Training Materials

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

An introduction to file-system post-mortem forensic analysis. This page links to the materials used during forensic trainings and presentations, including slides and links to the disk images.

Training Materials: Bad out of Hell - Bad Cluster Forensics - FAT32

Many progress gained during Hackathon 2026

Slide Deck: Bad out of Hell
Materials: Disk Image

Training Materials: 75 TF-CSIRT Meeting - DFIR-1.0.1

Slide Deck: From Zero to Hero - Digital Forensics 1.0.1
Exercises: From Zero to Hero - Exercises 1.0.1
Solutions: Solutions for the exercises can be request via email at: info@circl.lu
Materials: All files incl. disk images SHA1:2f9667a83abec81066d40d425397c0c0a0ae0b63

CIRCL - Virtual Summer School (VSS) 2025

Slide Deck: Digital Forensics 1.0.1 - From Zero to Hero
Video Recording: Digital Forensics 1.0.1 - From Zero to Hero

Training Materials: Edition December 2024

Slide Deck: Digital Forensics 1.0.1 - Introduction: Post-mortem Digital Forensics
Slide Deck: Digital Forensics 1.0.2 - Introduction: File System Forensics and Data Recovery
Slide Deck: Digital Forensics 1.0.3 - Introduction: Windows-, Memory- and File Forensics
Disk Image: Exercises SHA1:0dff633fded030dd7ac58c871a928afe93d260e9
Commands: Command Line Cheat Sheet v0.1

AUSCERT2024

Slides: As We Are Many - The spooky USB stick
Materials: All files incl. disk images SHA1:2f9667a83abec81066d40d425397c0c0a0ae0b63

Follow the instructions on the sildes and the provided training materials to create your own spooky USB stick. Take care, as some of the parameters likely vary sligthly on you own computer. Take care using dd with root rights. We are not responible if you wipe your own disk by accident.

IP to ASN Mapping Whois Service

Mon, 01 Jan 0001 00:00:00 +0000

IP to ASN Mapping Service with History

There are several services on the Internet to map IP addresses to their corresponding BGP AS number like the renowned IP to ASN mapping of Team Cymru.

During incident handling, we were lacking an historical view of IP address announcement evolution over time. It is not uncommon to have IP addresses announced by different BGP AS number over a period of time. We developed a service, freely accessible to the whole community, to look up IP addresses announcements in the past. Currently, the service covers a time span of more than 4 years until today.

Lookyloo Website Analysis

Mon, 01 Jan 0001 00:00:00 +0000

Lookyloo Website Analysis

Lookyloo is CIRCL’s public service for examining websites. It captures a page in a browser and displays a tree of the domains, requests, redirects, and resources loaded while visiting it. This helps analysts understand the behavior of a suspicious link without opening it in their own browser.

Users who encounter a suspicious URL in an email or while browsing can submit it to the online Lookyloo instance.

MISP & Threat Sharing for the financial sector

Mon, 01 Jan 0001 00:00:00 +0000

Information security and fraud detection are often transversal activities within banking or financial operators. One financial organization alone cannot perform all upcoming threat analysis and requires additional information shared by others. In that scope, CIRCL co-developed MISP (a threat sharing platform) to support information sharing in the context of cyber security as well as within the context of fraud. Financial services, like any other type of organization with an increased attack surface, need simple ways to share information while being able to ensure an adequate balance between privacy, confidentiality and the need of sharing to protect customers and users of financial services.

AIL - Analysis Information Leak framework - Training Materials

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

AIL project and AIL framework - Framework for Analysis of Information Leaks

AIL is a modular framework to analyse potential information leaks from unstructured data sources like pastes from Pastebin or similar services or unstructured data streams (such as Tor hidden services). AIL framework is flexible and can be extended to support other functionalities to mine sensitive information.

AIL framework - FIRST virtual Training/Workshop.
AIL workshop slides including Darknet and Social Network Monitoring Introduction to Challenges, Concepts and Data Mining of the Deep Web.

Bug Report or Issues

AIL framework is a free and open source software available at https://github.com/ail-project/ail-framework. If you encounter any issues, bugs or you want to contribute, free free to open an issue.

CCWget

Mon, 01 Jan 0001 00:00:00 +0000

CCWget

Common Crawl wGET turns large-scale web archives into targeted, reproducible lookups. Find the record you need, then retrieve only the selected WARC object.

Benefits

Search historical URLs — Enumerate exact URLs, hosts, domains and time ranges across indexed Common Crawl snapshots.
Follow content by digest — Use hexadecimal or Base32 SHA-1 digests to locate matching archived content without guessing its URL.
Retrieve the HTTP header and web object — Inspect metadata first, then retrieve the WARC header and the matching archived web object without transferring the full archive.

Access to CCWget must be requested from CIRCL. To request access, please contact CIRCL.

Network exposure change detection service

Mon, 01 Jan 0001 00:00:00 +0000

Network exposure change detection service

A periodic external view on the exposure of network services can help identifying network service outages. But further more it can detect if new services have been established, either by an employee, a supplier or an attacker. Sometimes new services are places on purpose, sometimes by accident, or for instance to maintain access by criminals.

This service is based on periodic network port scans. It is able to detect and send the result to an email address, containing the changes seen since the last subsequent scans.

Penetration Testing - An Introduction

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

In the past CIRCL gave practical trainings “Penetration Testing 1.0.1 - Introduction: Penetration Testing & Ethical Hacking”.

This page links to the materials used during a training including slides and links to the virtual machines download pages.

Instructions for setting up the private / personal lab is part of the slides.

Duration

This training is available in to formats:

1 day - All exercises are demonstrated. Attendees can practice the exercises later on, back at home.
2 day - Hands-on exercises. Attendees will practice all exercises during the training with support from the instructor.

VMs

Slides

Penetration Testing 1.0.1 - Introduction: Penetration Testing & Ethical Hacking

License

Materials are licensed under the CC-BY license.

Updates

2016-12-02 - Initial release of slides version 1.0.0
2021-05-28 - Initial release of slides version 1.0.1

Topic Classifier

Mon, 01 Jan 0001 00:00:00 +0000

Topic Classifier

Topic Classifier is an API service for classifying content with the MISP content-classification taxonomy through an Ollama-backed AI engine.

The project is part of AIPITCH, an international consortium focused on AI-based tools for cybersecurity operations and founded by the European Commission. Its source code is available on GitHub.

How can I access the service?

The Topic Classifier service is operated by CIRCL and offered on request. To request access, contact info@circl.lu.

CIRCL Cybersecurity Training Initiatives

Mon, 01 Jan 0001 00:00:00 +0000

CIRCL Cybersecurity Training Initiatives

CIRCL (Computer Incident Response Center Luxembourg) has established a robust set of training initiatives to enhance cybersecurity capabilities across various sectors. These initiatives are supported by numerous European projects and funding programs, aiming to strengthen technical expertise, improve cybersecurity practices, and foster collaborative knowledge sharing. Below is an overview of our key training projects and co-funded by EU projects:

MISP-NG (CEF 2016-LU-IA-0098)

The MISP-NG project focuses on providing training for the MISP platform. Supported by the CEF (Connecting Europe Facility) funding, this training empowers organizations to utilize MISP for threat intelligence and information sharing.

Kunai Sandbox

Mon, 01 Jan 0001 00:00:00 +0000

Kunai Sandbox

Kunai Sandbox is CIRCL’s malware sandbox for Linux-based malware. It executes submitted Linux samples in an isolated environment and records their behaviour with Kunai, providing analysts with a complete dynamic-analysis report.

Kunai Sandbox replaces CIRCL’s former Dynamic Malware Analysis (DMA) service. DMA is no longer offered, and its service page now redirects here.

What files should I submit?

Use Kunai Sandbox when you need to observe the runtime behaviour of a Linux-based malware sample.

Services on CIRCL

Pandora Document and File Analysis

Pandora Document and File Analysis

Passive DNS

Passive DNS version 2.0

Vulnerability-Lookup Service

Multi-Source Vulnerability-Lookup and Collaboration

BGP Ranking

Use BGP Ranking

CIRCL hashlookup

CIRCL hashlookup (hashlookup.circl.lu)

Sources included in CIRCL hashlookup

Is this a database of malicious or non-malicious file hashes?

MISP - Open Source Threat Intelligence Platform

Turn threat information into collective defence

More than an IOC database

MISP - Open Source Threat Intelligence Platform & Open Standards For Threat Information Sharing - Training Materials

Introduction

Passive SSL

Passive SSL

How do you collect the SSL certificates?

Digital Forensic - Training Materials

Introduction

Training Materials: Bad out of Hell - Bad Cluster Forensics - FAT32

Training Materials: 75 TF-CSIRT Meeting - DFIR-1.0.1

CIRCL - Virtual Summer School (VSS) 2025

Training Materials: Edition December 2024

AUSCERT2024

IP to ASN Mapping Whois Service

IP to ASN Mapping Service with History

Lookyloo Website Analysis

Lookyloo Website Analysis

MISP & Threat Sharing for the financial sector

Information sharing within the financial sector

AIL - Analysis Information Leak framework - Training Materials

Introduction

Bug Report or Issues

CCWget

CCWget

Benefits

Network exposure change detection service

Network exposure change detection service

Penetration Testing - An Introduction

Introduction

Duration

VMs

Slides

License

Updates

Topic Classifier

Topic Classifier

How can I access the service?

CIRCL Cybersecurity Training Initiatives

CIRCL Cybersecurity Training Initiatives

MISP-NG (CEF 2016-LU-IA-0098)

Kunai Sandbox

Kunai Sandbox

What files should I submit?