security
The Ultimate Information Gathering Toolkit. A Python-based toolkit for Information Gathering and Reconnaissance.
Argus is an all-in-one, Python-powered toolkit designed to streamline the process of information gathering and reconnaissance. With a user-friendly interface and a suite of powerful modules, Argus empowers you to explore networks, web applications, and security configurations efficiently and effectively.
Pro Bono Bug Hunting & Volunteer Hackers. Helping those who help.
Volunteer hackers to help nonprofits and NGOs strengthen their digital security.
CLI tool to automate docker image updates. Selective, notifications, autoprune, no pre-pulling.
Code signing and transparency for containers and binaries. Signing OCI containers (and other artifacts) using Sigstore! Cosign aims to make signatures invisible infrastructure.
Related contents:
CapibaraZero aim to be a cheap alternative to FlipperZero™. It's based on ESP32 boards especially on ESP32-S3 but we want to port firmware to all ESP family boards.
Intelligent Prompt Gateway.
Arch is an intelligent prompt gateway. Engineered with (fast) LLMs for the secure handling, robust observability, and seamless integration of prompts with APIs - all outside business logic. Built by the core contributors of Envoy proxy, on Envoy.
Arch is an intelligent Layer 7 gateway designed to protect, observe, and personalize LLM applications (agents, assistants, co-pilots) with your APIs.
The Open-Source Tool Democratizing Multi-Cloud Security Testing by Arpan Sarkar.
Multi-Cloud Security Testing Tool to execute a comprehensive array of attack techniques across multiple surfaces via a simple web interface.
Halberd is a powerful, multi-cloud security testing tool. Born out of the need for a unified, easy-to-use tool, Halberd enables you to proactively assess your cloud defenses by executing a comprehensive array of attack techniques across Entra ID, M365, Azure, and AWS. With its intuitive web interface, you can simulate real-world attacks, generate valuable telemetry, and validate your security controls with ease & speed.
Gato, or GitHub Attack Toolkit, is an enumeration and attack tool that allows both blue teamers and offensive security practitioners to identify and exploit pipeline vulnerabilities within a GitHub organization's public and private repositories.
API Security Vulnerability Scanner designed to help you secure your APIs.
Your First Line of Defense in API Security. Scan your APIs for vulnerabilities with VulnAPI.
Help developers and security professionals quickly and efficiently scan their APIs for security vulnerabilities and weaknesses.
🐍 A toolkit for testing, tweaking and cracking JSON Web Tokens
Automatic authorization enforcement detection extension for burp suite written in Jython developed by Barak Tawily in order to ease application security people work and allow them perform an automatic authorization tests.
AuthMatrix is a Burp Suite extension that provides a simple way to test authorization in web applications and web services.
OpenClarity is an open source platform to enhance security and observability of cloud native applications and infrastructure.
OpenClarity is an open source tool for agentless detection and management of Virtual Machine Software Bill Of Materials (SBOM) and security threats such as vulnerabilities, exploits, malware, rootkits, misconfigurations and leaked secrets.
Related contents:
eBPF implementation that runs on top of Windows.
eBPF is a well-known technology for providing programmability and agility, especially for extending an OS kernel, for use cases such as DoS protection and observability. This project is a work-in-progress that allows existing eBPF toolchains and APIs familiar in the Linux ecosystem to be used on top of Windows. That is, this project takes existing eBPF projects as submodules and adds the layer in between to make them run on top of Windows.
KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities of container images and filesystems. It scans both runtime K8s clusters and CI/CD pipelines for enhanced software supply chain security.
Custom bash scripts used to automate various penetration testing tasks including recon, scanning, enumeration, and malicious payload creation using Metasploit. For use with Kali Linux.
Slack enumeration and exposed secrets detection tool. Monitoring and enumerating Slack for exposed secrets
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
Docker is one of the most popular services to run containerized applications and it utilizes containerd and runc at a low level. This became popular because of its ease of use and intuitive experience. There are some misconfigurations that are left in the setup that can easily be exploited and few of them even let you break out of the containerized environment.
In this series, I will be explaining to you the basic concepts of the docker internals and how you can exploit certain misconfigurations to gain root user access or breakout of the containerization via both remote and local exploits. Also later in this course, you will learn how to secure your existing docker environment by following best practices from the experts.
A high-performance port spoofing tool built in Rust. Confuse port scanners with dynamic service emulation across all ports. Features customizable signatures, efficient async handling, and easy traffic redirection.
Ghostport is a sophisticated port spoofing tool designed to confuse and mislead port scanners. It's a Rust implementation inspired by the concept of portspoof, offering enhanced performance and flexibility.
Octoscan is a static vulnerability scanner for GitHub action workflows.
Twistr is a Domain name permutation and enumeration library powered by Rust. It aims to directly port the well-known dnstwist tool allowing for fast and flexible interfacing capabilities with the core libraries based on client's requirements.
A flexible detection platform that simplifies rule management and deployment with K8s CronJob and Helm. Venator is flexible enough to run standalone or with other job schedulers like Nomad.
Venator is optimized for Kubernetes deployment but is flexible enough to run standalone or with other job schedulers like Nomad. It provides a highly adaptable detection engine that prioritizes simplicity, extensibility, and ease of maintenance. Supporting multiple query engines and publishers, Venator allows you to easily switch between different data lakes or services with minimal changes, avoiding vendor lock-in and dependence on specific SIEM solutions for signal generation.
Control Your Infrastructure, Scale Your Scanning—On Your Terms. Easily distribute arbitrary binaries and scripts using any of our seven supported cloud providers.
The Ax Framework is a free and open-source tool utilized by Bug Hunters and Penetration Testers to efficiently operate in multiple cloud environments. It helps build and deploy repeatable infrastructure tailored for offensive security purposes.
LOLESXi features a comprehensive list of binaries/scripts natively available in VMware ESXi that adversaries have utilised in their operations. The information on this site is compiled from open-source threat research.
Segugio allows the execution and tracking of critical steps in the malware detonation process, from clicking on the first stage to extracting the malware's final stage configuration. Segugio was created to address the need for speeding up the extraction of IoCs from malicious artifacts within the analysis environment. Malware analysis often involves time-consuming activities like static and dynamic analysis, which require extensive knowledge in reverse engineering and code analysis.
Records an executable's network activity into a Full Packet Capture file (.pcap) and much more.
Monitors network activity made by a process through the use of Windows Event Tracing (ETW) and Full Packet Capture (FPC). Filters a generated .pcap file with BPF based on the detected network activity made by the process. This application makes process network monitoring hella' easy.
Comprehensive Open Source Security and SBOM Management. Secure Your Products From Repo to Release.
Stop vulnerabilities, automate compliance, and mitigate third-party risk in your applications.
Giving Kubernetes Superpowers to everyone.
k8sgpt is a tool for scanning your Kubernetes clusters, diagnosing, and triaging issues in simple English. It has SRE experience codified into its analyzers and helps to pull out the most relevant information to enrich it with AI.
A Runtime Application Self Protection agent for Python applications and serverless functions. Relies on AI, syntax analysis, and underlying OS capabilities to seamlessly provides accurate protection from within, without updates.
PyRASP is a Runtime Application Self Protection package for Python-based Web Servers (Flask, FastAPI and Django) and Serverless Functions (AWS Lambda, Azure and Google Cloud Functions).
Malware analysis tool. Cuckoo3 is a Python 3 open source automated malware analysis system.
Cuckoo3 is an open-source tool to test suspicious files or links in a controlled environment. It will test them in a sandboxed platform emulator(s) and generate a report, showing what the files or websites did during the test.
CloudShovel is a tool designed to search for sensitive information within public or private Amazon Machine Images (AMIs). It automates the process of launching instances from target AMIs, mounting their volumes, and scanning for potential secrets or sensitive data.
OPEN SOURCE ORCHESTRATION AND CORRELATION TOOL. ASOC, ASPM, DevSecOps, Vulnerability Management Using ArcherySec.
Automate Your Application Security Orchestration And Correlation (ASOC) Using ArcherySec.
ArcherySec allow to interact with continuous integration/continuous delivery (CI/CD) toolchains to specify testing, and control the release of a given build based on results. Its include prioritization functions, enabling you to focus on the most critical vulnerabilities. ArcherySec uses popular open source tools to perform comprehensive scanning for web application and network. The developers can also utilize the tool for implementation of their DevOps CI/CD environment.
Free and open-source vulnerability scanner.
Mageni is an open source vulnerability management platform. Mageni provides a faster, enjoyable, and leaner vulnerability management experience for modern cybersecurity programs.
a simple protocol for decentralizing social media that has a chance of working. a truly censorship-resistant alternative to Twitter that has a chance of working.
A better internet is possible: decentralize Twitter, eBay, IoT and other stuff.
Smart-client/dumb-server architecture that can create the free and open internet we were promised.
Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64.
Dive into a new Pentesting Experience with Athena OS!
Athena OS is an open-source, NixOS-based distribution intended to build a new concept of pentesting operating system. Its purpose is to offer a different experience than the most used pentesting distributions by providing reproducibility, flexibility, isolation, default packages that fit with the user needs, diverse hacking resources and learning materials.
Credentials gathering tool automating remote procdump and parse of lsass process.
Spraykatz is a tool without any pretention able to retrieve credentials on Windows machines and large Active Directory environments.
It simply tries to procdump machines and parse dumps remotely in order to avoid detections by antivirus softwares as much as possible.
Zircolite is a standalone tool written in Python 3. It allows to use SIGMA rules on : MS Windows EVTX (EVTX, XML and JSONL format), Auditd logs, Sysmon for Linux and EVTXtract logs.
Linux enumeration tool for pentesting and CTFs with verbosity levels.
This shell script will show relevant information about the security of the local Linux system, helping to escalate privileges. From version 2.0 it is mostly POSIX compliant and tested with shellcheck and posh.
It can also monitor processes to discover recurrent program executions. It monitors while it is executing all the other tests so you save some time. By default it monitors during 1 minute but you can choose the watch time with the -p parameter.
Go CLI and Library for quickly mapping organization network ranges using ASN information.
secator is a task and workflow runner used for security assessments. It supports dozens of well-known security tools and is designed to improve productivity for pentesters and security researchers.
grep rough audit - source code auditing tool.
graudit is a simple script and signature sets that allows you to find potential security flaws in source code using the GNU utility grep. It's comparable to other static analysis applications like RATS, SWAAT and flaw-finder while keeping the technical requirements to a minimum and being very flexible.
Sigstore is an open source project for improving software supply chain security. The Sigstore framework and tooling empowers software developers and consumers to securely sign and verify software artifacts such as release files, container images, binaries, software bills of materials (SBOMs), and more. Signatures are generated with ephemeral signing keys so there’s no need to manage keys. Signing events are recorded in a tamper-resistant public log so software developers can audit signing events.
Related contents:
- Streamline security with keyless signing and verification in GitLab @ GitLab.
- Annotate container images with build provenance using Cosign in GitLab CI/CD @ GitLab.
- Episode #497: sécurisation de la chaîne d’approvisionnement logicielle (software supply chain) @ NoLimitSecu :fr:.
- Blueprinting Security in CI/CD: Building Trust Through Open Source @ CD Foundation.
Your Microsoft Security test automation framework!
Monitor your Microsoft 365 tenant's security configuration using Maester!
Maester is an open source PowerShell-based test automation framework designed to help you monitor and maintain the security configuration of your Microsoft 365 environment.
Tracking ransomware's victims since April 2022
A ransomware is a type of malware used by cybercriminals to encrypt the victim's files and make them inaccessible unless they pay the ransom. Today cybercriminals are more sophisticated, and they not only encrypt the victim's files also they leaking their data to the Darknet unless they will pay the ransom.
Ransomware.live is originally a fork of ransomwatch and inspired by ransomlook. Ransomware.live is a ransomware leak site monitoring tool. It will scrape all of the entries on various ransomware leak sites and published them.
This project is specifically made for brand new directories and ease their creation with all security rules in place:
- Remove legacy protocols/setup used by Microsoft for compliance purposes
- Enforce the use of modern alogrithm for cyphering and authentication
- Enforce LDAPS when a client requests a connection to your DC
- Enforce the default password strategy to match with modern expectation
- Add other Domain Controllers to your secured domain
Related contents:
Automatic Open Source WAF & API Security.
open-appsec is a machine learning security engine that preemptively and automatically prevents threats against Web Application & APIs.
Policy-based control for cloud native environments. Flexible, fine-grained control for administrators across the stack.
Open Policy Agent (OPA) is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack.
Related contents:
- Guardrails for Your Cloud: A Simple Guide to OPA and Terraform @ Sami Banerjee's Medium.
- Getting Open Policy Agent Up and Running @ The New Stack.
- Simplify Kubernetes Security With Kyverno and OPA Gatekeeper @ The New Stack.
- Automating policy enforcements for infrastructure using Open Policy Agent (OPA) in Terraform — Part 1 @ Ashay Maheshwari's Medium.
- Terraform governing with OPA @ DevOpsOnTheTrail.
- Blueprinting Security in CI/CD: Building Trust Through Open Source @ CD Foundation.
- From Kubernetes Gatekeeper to Full-Stack Governance with OPA @ Pulumi.
- Governing infrastructure as code using pattern-based policy as code @ AWS Security Blog.
BlockingList.
GreenSnow is a team consisting of the best specialists in computer security, we harvest a large number of IPs from different computers located around the world. GreenSnow is comparable with SpamHaus.org for attacks of any kind except for spam. Our list is updated automatically and you can withdraw at any time your IP address if it has been listed.
Proactive Bot Detection,Screening, & Banning.
BotScout helps prevent automated web scripts, known as "bots", from registering on forums, polluting databases, spreading spam, and abusing forms on web sites. We do this by tracking the names, IPs, and email addresses that bots use and logging them as unique signatures for future reference. We make this signature data available through a simple yet powerful API that you can use to test forms when they're submitted on your site.
Protect your business and PBX's against VoIP Fraud. Minimize the risks of attacks on your Telephony Server. Save bandwidth by using Geolocation filtering.
VoIPBL is a distributed VoIP blacklist that is aimed to protects against VoIP Fraud and minimizing abuse for network that have publicly accessible PBX's.
Privacy redefined, The first messenger without user IDs.
private and secure messenger without any user IDs (not even random).
🛡 A GraphQL tool to ease the creation of permission layer. GraphQL Permissions Framework for Complex Authorisation Systems. Implement your server permissions in a clear and deterministic way and let it guard access to your schema.
GraphQL Shield helps you create a permission layer for your application. Using an intuitive rule-API, you'll gain the power of the shield engine on every request and reduce the load time of every request with smart caching. This way you can make sure your application will remain quick, and no internal data will be exposed.
Unexpected Exposures in SSH. SSHamble is a research tool for SSH implementations.
SSHamble simulates potential attack scenarios, including unauthorized remote access due to unexpected state transitions, remote command execution in post-session login implementations, and information leakage through unlimited high-speed authentication requests. The SSHamble interactive shell provides raw access to SSH requests in the post-session (but pre-execution) environment, allowing for simple testing of environment controls, signal processing, port forwarding, and more.
Connect and Secure Your IT Infrastructure in Minutes. Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls. NetBird combines a configuration-free peer-to-peer private network and a centralized access control system in a single open-source platform, making it easy to create secure private networks for your organization or home.
Related contents:
- Episode 575: Brent's Busted Builds @ Linux Unplugged.
- Ep 13: Cyberdeck Cyberwhat Selfhosted VPN networks and is Wireguard Hard @ Linux Prepper (Episode 13 Shownotes - Cyberdeck Cyberwhat and is Wireguard Hard @ Learning Together).
- NetBird : VPN mesh WireGuard auto-hébergé et souverain @ DevSecOps :fr:.