v3.0

Release Notes: sys3num v3.0

New Features:

• Honeypot Detection (Advanced Deception Hunting): We've added comprehensive checks to determine if you are executing within a trap. The script now parses /etc/passwd for known honeypot users, detects fake Python-masqueraded binaries (intercepting curl/wget), identifies Cloud Metadata Canaries, and spots virtualization MAC OUIs.
• GTFOBins Auto-Exploitation: Stop manually searching GTFOBins! The script now contains an offline associative dictionary of GTFObins payloads. It automatically correlates your current sudo -l permissions and SUID binaries to output instant, context-aware privilege escalation one-liners.
• Cryptominer & EDR Detection: Added detection for illicit cryptoming processes (XMRig, Kinsing) running in memory-backed storage (/dev/shm), and checks for Cloud-Native EDR modules (Falco, Tracee).
• JSON Output: Added the --json flag for clean pipeline ingestion and automated reporting.