A soon-to-be organized list of R packages for use in cybersecurity research, DFIR, risk analysis, metadata collection, document/data processing and more (not just by me, but the current list is made up of ones I’ve created or resurrected). If you want your packages to appear here, add the r-cyber topic to GitLab or GitHub repos and this list will be automagically periodically updated.
- AnomalyDetection : ⏰ Anomaly Detection with R (separately maintained fork of Twitter’s AnomalyDetection ?) (
r,rstats,anomaly-detection,anomalydetection,r-cyber) - aquarium : ???? Validate ‘Phishing’ ‘URLs’ with the ‘PhishTank’ Service (
r,rstats,phishing,phishtank,r-cyber) - astools : ⚒ Tools to Work With Autonomous System (‘AS’) Network and Organization Data (
r,rstats,autonomous-systems,routeviews,r-cyber) - blackmagic : ? Automagically Convert XML to JSON an JSON to XML (
r,rstats,xmltojson,xml-to-json,xml-js,json-to-xml-converter,json-to-xml,jsontoxml,r-cyber) - burrp : ? Tools to Import and Process ‘PortSwigger’ ‘Burp’ Proxy Data (
rstats,r,burpsuite,proxy,har,r-cyber) - carbondater : ? Estimate the Age of Web Resources (
r,rstats,r-cyber) - cc : ⛏Extract metadata of a specific target based on the results of “commoncrawl.org” (
r,rstats,common-crawl,domains,urls,reconnaissance,recon,r-cyber) - cdx : ? Query Web Archive Crawl Indexes (‘CDX’) (
r,rstats,cdx,web-archives,r-cyber) - censys : R interface to the Censys “cyber”/scans search engine • https://www.censys.io/tutorial (
censys-data,censys-api,r,rstats,r-cyber) - clandnstine : ㊙️ Perform ‘DNS’ over ‘TLS’ Queries (
r,rstats,dns-over-tls,getdnsapi,getdns,dns,r-cyber) - crafter : ? An R package to work with PCAPs (
r,rstats,pcap,pcap-files,pcap-analyzer,packet-capture,r-cyber) - curlconverter : ➰➡️➖ Translate cURL command lines into parameters for use with httr or actual httr calls (R) (
curl,httr,r,rstats,r-cyber) - curlparse : ?Parse ‘URLs’ with ‘libcurl’ (
r,rstats,libcurl,url-parse,r-cyber) - cymruservices : ? package that provides interfaces to various Team Cymru Services (
r,rstats,team-cymru-webservice,malware-hash-registry,bogons,r-cyber) - czdaptools : R tools for downloading zone data from ICANN’s CZDS application (
r,rstats,r-cyber,czdap) - decapitated : Headless ‘Chrome’ Orchestration in R (
r,rstats,headless-chrome,web-scraping,javascript,r-cyber) - devd : Install, Start and Stop ‘devd’ Instances from R (
r,rstats,devd,r-cyber) - dnsflare : ❓?Query ‘Cloudflare’ Domain Name System (‘DNS’) Servers over ‘HTTPS’ (
r,dns,dns-over-https,cloudflare,cloudflare-1-dot-1-dot-1-dot-1,1-dot-1-dot-1-dot-1,rstats,r-cyber) - dnshelpers : ℹ Tools to Process ‘DNS’ Response Data (
r,rstats,dns,dns-parser,r-cyber) - domaintools : R API interface to the DomainTools API (
r,rstats,domaintools,domaintools-api,r-cyber) - dshield : Query ‘SANS’ ‘DShield’ ‘API’ (
r,rstats,dshield,isc,r-cyber) - exiv : ? Read and Write ‘Exif’ Image/Media Tags with R (
r,rstats,exiv2-library,exiv2,exif,r-cyber) - gdns : Tools to work with the Google DNS over HTTPS API in R (
spf-record,google-dns,dns,rstats,r,r-cyber) - gepetto : ? ScrapingHub Splash-like REST API for Headless Chrome (
headless-chrome,nodejs,node-js,npm,hapi,hapijs,splash,r-cyber) - greynoise : Query ‘GreyNoise Intelligence ‘API’ in R (
r,rstats,r-cyber,greynoise-intelligence) - hgr : ? Tools to Work with the ‘Postlight’ ‘Mercury’ ‘API’ — https://mercury.postlight.com/web-parser/ — in R (
r,rstats,postlight-mercury-api,postlight,r-cyber) - hormel : ⚙️ Retrieve and Process ‘Spamhaus’ Zone/Host Metadata (
r,rstats,spamhaus,spam,block-list,r-cyber) - htmltidy : ? Tidy Up and Test XPath Queries on HTML and XML Content in R (
r,rstats,html,xml,r-cyber) - htmlunit : ??☕️Tools to Scrape Dynamic Web Content via the ‘HtmlUnit’ Java Library (
r,rstats,htmlunit,web-scraping,javascript,r-cyber) - htmlunitjars : ☕️ Java Archive Wrapper Supporting the ‘htmlunit’ Package (
r,rstats,rjava,htmlunit,web-scraping,r-cyber) - ipapi : An R package to geolocate IPv4/6 addresses and/or domain names using ip-api.com’s API (
r,rstats,r-cyber,ipapi) - ipinfo : ℹ Collect Metadata on ‘IP’ Addresses and Autonomous Systems (
r,rstats,ipv4,ipv6,asn,ipinfo,r-cyber) - ipstack : ⛏ Tools to Query ‘IP’ Address Information from the ‘ipstack’ ‘API’ (
r,rstats,ipstack,ip-reputation,ip-geolocation,r-cyber) - iptools : ? A toolkit for manipulating, validating and testing IP addresses and ranges, along with datasets relating to IP add… (
iptools,rstats,r,ipv4-address,r-cyber) - iptrie : ? Efficiently Store and Query ‘IPv4’ Internet Addresses with Associated Data (
r,rstats,ip-address,cidr,trie,r-cyber,ipv4-trie,ipv4-address,internet-address,ip-trie) - jerichojars : Java Archive Wrapper Supporting the ‘jericho’ R Package (
r,rstats,r-cyber,jeric) - jwatr : ? Tools to Query and Create Web Archive Files Using the Java Web Archive Toolkit in R (
r,rstats,java,warc,r-cyber) - longurl : ℹ️ Small R package for no-API-required URL expansion (
r,rstats,url-shortener,url,r-cyber) - mactheknife : ? Various ‘macOS’-oriented Tools and Utilities in R (
r,rstats,reticulate,python,ds-store,macos,r-cyber) - MACtools : ⬢ Tools to Work with Media Access Control (‘MAC’) Addresses (
r,rstats,mac-address,r-cyber,mac-age-database) - mhn : ? Analyze and Visualize Data from Modern Honey Network Servers with R (
r,rstats,mhn,r-cyber,honeypot) - middlechild : R interface to MITM (
r,rstats,r-cyber,mitm,mitmproxy) - mqtt : ? Interoperate with ‘MQTT’ Message Brokers with R (
r,rstats,mqtt,mosquitto,r-cyber) - mrt : Tools to Retrieve and Process ‘BGP’ Files in R (
r,rstats,mrt,rib,router,bgp,r-cyber) - msgxtractr : ? Extract contents from Outlook ‘.msg’ files in R (
r,rstats,outlook,msg,attachment,r-cyber) - myip : Tools to Determine Your Public ‘IP’ Address in R (
r,rstats,ip-address,ip-info,httpbin,icanhazip,ip-echo,amazon-checkip,akamai-whatismyp,opendns-checkip,r-cyber) - ndjson : ♨️ Wicked-Fast Streaming ‘JSON’ (‘ndjson’) Reader in R (
r,ndjson,rstats,json,r-cyber) - newsflash : Tools to Work with the Internet Archive and GDELT Television Explorer in R (
internet-archive,gdelt-television-explorer,r,rstats,r-cyber) - nmapr : Perform Network Discovery and Security Auditing with ‘nmap’ in R (
r,rstats,nmap,r-cyber) - ooni : Tools to Access the Open Observatory of Network Interference (‘OONI’) (
r,rstats,ooni,censorship,internet-measurements,r-cyber) - opengraph : Tools to Mine ‘Open Graph’-like Tags From ‘HTML’ Content (
r,rstats,opengraph,r-cyber) - osqueryr : ⁇ ‘osquery’ ‘DBI’ and ‘dbplyr’ Interface for R (
r,rstats,osquery,dplyr,tidyverse,dbi,r-cyber) - passivetotal : Useful tools for working with the PassiveTotal API in R (
r,rstats,passivetotal,passive-dns-data,r-cyber) - passwordrandom : ? Access the PasswordRandom.com API in R (
r,rstats,r-cyber) - pastebin : ? Tools to work with the pastebin API in R (
rstats,r,pastebin,pastebin-client,r-cyber) - pdfbox : ?◻️ Create, Maniuplate and Extract Data from PDF Files (R Apache PDFBox wrapper) (
r,rstats,pdfbox,pdf-document,pdf-files,pdfbox-wrapper,r-cyber) - pdfboxjars : Java ‘.jar’ Files for ‘pdfbox’ (
r,rstats,java,r-cyber) - porc : ? Tools to Work with ‘Snort’ Rules, Logs and Data (
r,rstats,snort,snort-rules,cybersecurity,cyber,r-cyber) - publicwww : Query the ‘PublicWWW’ Source Code Search Engine in R (
r,rstats,publicwww,r-cyber) - radb : ? Tools to Query the ‘Merit’ ‘RADb’ Network Route Server (
r,rstats,merit,radb,r-cyber) - rappalyzer : ? :: WIP :: R port of Wappalyzer (
r,rstats,wappalyzer,r-cyber) - reapr : ?→ℹ️ Reap Information from Websites (
r,rstats,web-scraping,r-cyber,rvest,html,xpath) - rgeocodio : Tools to Work with the https://geocod.io/ API (
r,rstats,geocodio,geocoding,reverse-geocoding,reverse-geocode,r-cyber) - ripestat : ? Query and Retrieve Data from the ‘RIPEstat’ ‘API’ (
r,rstats,ripe,ripestat,r-cyber) - robotify : ? Browser extension to check for and preview a site’s robots.txt in a new tab (if it exists) (
browser-extension,robots-txt,r-cyber) - rpdns : R port of CIRCL.LU’s PyPDNS Python module https://github.com/CIRCL/PyPDNS (
r,rstats,passive-dns,circl-lu,dns,r-cyber) - rrecog : ?Pattern Recognition for Hosts, Services and Content (
r,rstats,recognizer,rapid7,r-cyber) - scamtracker : R pacakge interface to the BBB ScamTracker : https://www.bbb.org/scamtracker/us (
r,rstats,r-cyber,scamtracker) - securitytrails : ??♂️Tools to Query the ‘SecurityTrails’ ‘API’ (
r,rstats,securitytrails,cybersecurity,ipv4,ipv6,threat-intelligence,domain-name,whois-lookup,r-cyber) - securitytxt : ? Identify and Parse Web Security Policies Files in R (
r,rstats,securitytxt,r-cyber) - sergeant : ? Tools to Transform and Query Data with ‘Apache’ ‘Drill’ (
drill,parquet-files,sql,dplyr,r,rstats,apache-drill,r-cyber) - shodan : ? R package to work with the Shodan API (
r,rstats,shodan,shodan-api,r-cyber) - simplemagic : ? Lightweight File ‘MIME’ Type Detection Based On Contents or Extension (
r,rstats,magic,mime,mime-types,file-types,r-cyber) - speedtest : ? Measure upload/download speed/bandwidth for your network with R (
r,rstats,bandwidth-test,bandwidth,bandwidth-monitor,r-cyber) - spiderbar : Lightweight R wrapper around rep-cpp for robot.txt (Robots Exclusion Protocol) parsing and path testing in R (
r,rstats,robots-exclusion-protocol,robots-txt,r-cyber) - splashr : ? Tools to Work with the ‘Splash’ JavaScript Rendering Service in R (
r,rstats,web-scraping,splash,selenium,phantomjs,har,r-cyber) - ssllabs : Tools to Work with the SSL Labs API in R (
r,rstats,r-cyber,ssllabs,ssl-labs) - threatcrowd : R tools to work with the ThreatCrowd API (
r,rstats,threatcrowd,r-cyber) - tidyweb : Easily Install and Load Modern Web-Scraping Packages (
r,rstats,r-cyber) - tlsh : #️⃣ Local Sensitivity Hashing Using the ‘Trend Micro’ ‘TLSH’ Implementation (based on https://github.com/trendmicro/… (
r,rstats,tlsh,lsh,lsh-implmentation,r-cyber) - tlsobs : ? Tools to Work with the ‘Mozilla’ ‘TLS’ Observatory ‘API’ in R (
r,rstats,mozilla-observatory,r-cyber) - udpprobe : ? Send User Datagram Protocol (‘UDP’) Probes and Receive Responses in R (
r,rstats,udp-client,udp,ubiquiti,r-cyber) - ulid : ⚙️ Universally Unique Lexicographically Sortable Identifiers in R (
r,rstats,ulid,uuid,r-cyber) - urldiversity : ? Quantify ‘URL’ Diversity and Apply Popular Biodiversity Indices to a ‘URL’ Collection (
r,rstats,species-diversity,url,urls,uri,r-cyber) - urlscan : ? Analyze Websites and Resources They Request (
r,rstats,urlscan,analyze-websites,scanning,urlscan-io,r-cyber) - vershist : ??♀️ Collect Version Histories For Vendor Products (
rstats,r,semantic-versions,version-check,version-checker,r-cyber,release-history) - wand : ? R interface to libmagic – returns file mime type (
r,rstats,magic-bytes,file,r-cyber) - warc : ? Tools to Work with the Web Archive Ecosystem in R (
r,rstats,warc,r-cyber,warc-ecosystem,warc-files) - wayback : ⏪ Tools to Work with the Various Internet Archive Wayback Machine APIs (
r,rstats,wayback-machine,internet-archive,web-scraping,r-cyber,memento,wayback) - webhose : ? Tools to Work with the ‘webhose.io’ ‘API’ in R (
r,rstats,r-cyber,webhose) - whoisxmlapi : ❔ R package to interface with the WhoisXMLAPI.com service (
r,rstats,whoisxmlapi,r-cyber) - xattrs : ? Work With Filesystem Object Extended Attributes — https://hrbrmstr.github.io/xattrs/index.html (
r,rstats,xattr,xattr-support,r-cyber) - xforce : ? Tools to Gather Threat Intelligence from ‘IBM’ ‘X-Force’ (
r,rstats,ibm-xforce,threat-intel,threat-intelligence,r-cyber) - zdnsr : ? Perform Bulk ‘DNS’ Queries Using ‘zdns’ (
r,rstats,zdns,bulk-dns,r-cyber)
