security
Zircolite is a standalone tool written in Python 3. It allows to use SIGMA rules on : MS Windows EVTX (EVTX, XML and JSONL format), Auditd logs, Sysmon for Linux and EVTXtract logs.
Linux enumeration tool for pentesting and CTFs with verbosity levels.
This shell script will show relevant information about the security of the local Linux system, helping to escalate privileges. From version 2.0 it is mostly POSIX compliant and tested with shellcheck and posh.
It can also monitor processes to discover recurrent program executions. It monitors while it is executing all the other tests so you save some time. By default it monitors during 1 minute but you can choose the watch time with the -p parameter.
Go CLI and Library for quickly mapping organization network ranges using ASN information.
secator is a task and workflow runner used for security assessments. It supports dozens of well-known security tools and is designed to improve productivity for pentesters and security researchers.
grep rough audit - source code auditing tool.
graudit is a simple script and signature sets that allows you to find potential security flaws in source code using the GNU utility grep. It's comparable to other static analysis applications like RATS, SWAAT and flaw-finder while keeping the technical requirements to a minimum and being very flexible.
Sigstore is an open source project for improving software supply chain security. The Sigstore framework and tooling empowers software developers and consumers to securely sign and verify software artifacts such as release files, container images, binaries, software bills of materials (SBOMs), and more. Signatures are generated with ephemeral signing keys so there’s no need to manage keys. Signing events are recorded in a tamper-resistant public log so software developers can audit signing events.
Related contents:
- Streamline security with keyless signing and verification in GitLab @ GitLab.
- Annotate container images with build provenance using Cosign in GitLab CI/CD @ GitLab.
- Episode #497: sécurisation de la chaîne d’approvisionnement logicielle (software supply chain) @ NoLimitSecu :fr:.
- Blueprinting Security in CI/CD: Building Trust Through Open Source @ CD Foundation.
Your Microsoft Security test automation framework!
Monitor your Microsoft 365 tenant's security configuration using Maester!
Maester is an open source PowerShell-based test automation framework designed to help you monitor and maintain the security configuration of your Microsoft 365 environment.
Tracking ransomware's victims since April 2022
A ransomware is a type of malware used by cybercriminals to encrypt the victim's files and make them inaccessible unless they pay the ransom. Today cybercriminals are more sophisticated, and they not only encrypt the victim's files also they leaking their data to the Darknet unless they will pay the ransom.
Ransomware.live is originally a fork of ransomwatch and inspired by ransomlook. Ransomware.live is a ransomware leak site monitoring tool. It will scrape all of the entries on various ransomware leak sites and published them.
This project is specifically made for brand new directories and ease their creation with all security rules in place:
- Remove legacy protocols/setup used by Microsoft for compliance purposes
- Enforce the use of modern alogrithm for cyphering and authentication
- Enforce LDAPS when a client requests a connection to your DC
- Enforce the default password strategy to match with modern expectation
- Add other Domain Controllers to your secured domain
Related contents:
Automatic Open Source WAF & API Security.
open-appsec is a machine learning security engine that preemptively and automatically prevents threats against Web Application & APIs.
Policy-based control for cloud native environments. Flexible, fine-grained control for administrators across the stack.
Open Policy Agent (OPA) is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack.
Related contents:
- Guardrails for Your Cloud: A Simple Guide to OPA and Terraform @ Sami Banerjee's Medium.
- Getting Open Policy Agent Up and Running @ The New Stack.
- Simplify Kubernetes Security With Kyverno and OPA Gatekeeper @ The New Stack.
- Automating policy enforcements for infrastructure using Open Policy Agent (OPA) in Terraform — Part 1 @ Ashay Maheshwari's Medium.
- Terraform governing with OPA @ DevOpsOnTheTrail.
- Blueprinting Security in CI/CD: Building Trust Through Open Source @ CD Foundation.
- From Kubernetes Gatekeeper to Full-Stack Governance with OPA @ Pulumi.
- Governing infrastructure as code using pattern-based policy as code @ AWS Security Blog.
BlockingList.
GreenSnow is a team consisting of the best specialists in computer security, we harvest a large number of IPs from different computers located around the world. GreenSnow is comparable with SpamHaus.org for attacks of any kind except for spam. Our list is updated automatically and you can withdraw at any time your IP address if it has been listed.
Proactive Bot Detection,Screening, & Banning.
BotScout helps prevent automated web scripts, known as "bots", from registering on forums, polluting databases, spreading spam, and abusing forms on web sites. We do this by tracking the names, IPs, and email addresses that bots use and logging them as unique signatures for future reference. We make this signature data available through a simple yet powerful API that you can use to test forms when they're submitted on your site.
Protect your business and PBX's against VoIP Fraud. Minimize the risks of attacks on your Telephony Server. Save bandwidth by using Geolocation filtering.
VoIPBL is a distributed VoIP blacklist that is aimed to protects against VoIP Fraud and minimizing abuse for network that have publicly accessible PBX's.
Privacy redefined, The first messenger without user IDs.
private and secure messenger without any user IDs (not even random).
🛡 A GraphQL tool to ease the creation of permission layer. GraphQL Permissions Framework for Complex Authorisation Systems. Implement your server permissions in a clear and deterministic way and let it guard access to your schema.
GraphQL Shield helps you create a permission layer for your application. Using an intuitive rule-API, you'll gain the power of the shield engine on every request and reduce the load time of every request with smart caching. This way you can make sure your application will remain quick, and no internal data will be exposed.
Unexpected Exposures in SSH. SSHamble is a research tool for SSH implementations.
SSHamble simulates potential attack scenarios, including unauthorized remote access due to unexpected state transitions, remote command execution in post-session login implementations, and information leakage through unlimited high-speed authentication requests. The SSHamble interactive shell provides raw access to SSH requests in the post-session (but pre-execution) environment, allowing for simple testing of environment controls, signal processing, port forwarding, and more.
Connect and Secure Your IT Infrastructure in Minutes. Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls. NetBird combines a configuration-free peer-to-peer private network and a centralized access control system in a single open-source platform, making it easy to create secure private networks for your organization or home.
Related contents:
- Episode 575: Brent's Busted Builds @ Linux Unplugged.
- Ep 13: Cyberdeck Cyberwhat Selfhosted VPN networks and is Wireguard Hard @ Linux Prepper (Episode 13 Shownotes - Cyberdeck Cyberwhat and is Wireguard Hard @ Learning Together).
- NetBird : VPN mesh WireGuard auto-hébergé et souverain @ DevSecOps :fr:.
- How I Use NetBird to Connect My Entire Network @ Techdox's YouTube.
Video Management Software. Use up to 64 cameras (webcams, network IP cams, analog cards, or your Windows PC desktop). Capture JPEG snapshots or movies in standard MP4, AVI, advanced DVR, or Windows Media file formats.
- jshridha/blueiris @ Docker Hub (BlueIris in a docker container!).
- Episode 575: Brent's Busted Builds @ Linux Unplugged.
🧑🚀 The better identity infrastructure for developers and the open-source alternative to Auth0.
Logto is an Auth0 alternative designed for modern apps and SaaS products. It offers a seamless developer experience and is well-suited for individuals and growing companies.
Docker Authorization Plugin.
A basic extendable Docker authorization plugin that runs directly on the host or inside a container. The framework depends on docker authentication plugin support. Basic authorization is provided when Docker daemon is started with --tlsverify flag (username is extracted from the certificate common name).
Find and verify secrets. Find leaked credentials.
TruffleHog is the most powerful secrets Discovery, Classification, Validation, and Analysis tool. In this context secret refers to a credential a machine uses to authenticate itself to another machine. This includes API keys, database passwords, private encryption keys, and more...
Related contents:
HellPot is a cross-platform portal to endless suffering meant to punish unruly HTTP bots. Notably it implements a toml configuration file, has JSON logging, and comes with significant performance gains.
A Simple Hardware Authenticator
macro_pack is a tool by @EmericNasi used to automatize obfuscation and generation of Office documents, VB scripts, shortcuts, and other formats for pentest, demo, and social engineering assessments. The goal of macro_pack is to simplify exploitation, antimalware bypass, and automatize the process from malicious macro and script generation to fin…
A companion toolkit for Pentesters & Red Teams.
BallisKit helps by providing automation and weaponization of payload generation. Our products are also equipped with multiple security solution bypasses and ready to use templates to cover any scenarios the RedTeam may face. BallisKit is an array of tools and services developed to help Red Teams and Pentesters in their mission. Capabilities include, among other, penetration testing, demos and social engineering campaigns (email, USB key, etc.).
The CIS Benchmarks™ are prescriptive configuration recommendations for more than 25+ vendor product families. They represent the consensus-based effort of cybersecurity experts globally to help you protect your systems against threats more confidently.
cyber arms for your security program - GRC can be tough: let CISO Assistant help you.
Cyber security program management can be challenging regardless of the size of your company. CISO Assistant one-stop-shop approach provides a pragmatic way to handle the complexity of GRC (Governance, Risk and Compliance) and make the tools work for you instead of the other way around.
Tang binding daemon.
Tang is a server for binding data to network presence.
This sounds fancy, but the concept is simple. You have some data, but you only want it to be available when the system containing the data is on a certain, usually secure, network. This is where Tang comes in.
Automated Encryption Framework
Clevis is a pluggable framework for automated decryption. It can be used to provide automated decryption of data or even automated unlocking of LUKS volumes.
- Clevis/Tang: unattended boot of an encrypted NixOS system @ FOSDEM.
- Clevis & Tang on NixOS.
- Safe automatic decryption of LUKS partition using TPM2 @ 221b.
- Automatic LUKS 2 disk decryption with TPM 2 on Fedora @ kowalski7cc.
- Automatically decrypt your disk using TPM2 @ fedora Magazine.
- Use systemd-cryptenroll with FIDO U2F or TPM2 to decrypt your disk @ fedora Magazine.
- Episode 572: Data Security Only a Maniac Could Love @ Linux Unplugged.
an SSO and OAuth / OIDC login solution for Nginx using the auth_request module.
An SSO solution for Nginx using the auth_request module. Vouch Proxy can protect all of your websites at once.
Vouch Proxy supports many OAuth and OIDC login providers and can enforce authentication
TOTP Authenticator.
A modern and secure Windows app for managing your 2FA authentication codes. It's free, open source, and easy to use. Download it now and get started in minutes.
This Ansible collection provides battle tested hardening for Linux, SSH, nginx, MySQL
API-first Identity Management, Authentication and Authorization. For Secure, Global, GDPR-compliant Apps. The New Identity Stack you have been waiting for.
Traditional IAM solutions do not scale, they are not easy to customize, they are limited in their deployment models, and they don't meet your or your customers' needs
Unix operating systems and derivatives, including GNU/Linux, are playing an important role in the ecosystem of equipments, systems, networks and telecommunications. They are widely deployed in several equipments. This guide focuses mainly on generic system configuration guidelines and on common sense principles that need to be applied during the deployment of hosted services.
A fast and customisable vulnerability scanner powered by simple YAML-based templates.
🎩 simple, fun and transparent SSH (and telnet) bastion server.
Jump host/Jump server without the jump, a.k.a Transparent SSH bastion.
Searching the TrashPanda OSINT bot API to check if your email/domain or password was leaked.
PurpleLab is an efficient and readily deployable lab solution, providing a swift setup for cybersecurity professionals to test detection rules, simulate logs, and undertake various security tasks, all accessible through a user-friendly web interface.
Dependency-Check is a Software Composition Analysis (SCA) tool that attempts to detect publicly disclosed vulnerabilities contained within a project’s dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency. If found, it will generate a report linking to the associated CVE entries.
You can use this tool to generate a valid Permissions Policy HTTP Header, which can be provided by your web server / web application in order to improve the security of your visitors and the data they may be accessing on your site.
Modular and decentralised honeypot.
OpenCanary is a daemon that runs canary services, which trigger alerts when (ab) is used. The alerts can be sent to a variety of sources, including Syslog, emails, and a companion daemon opencanary-correlator.
The Open Vulnerability Project is a collection of Java libraries and a CLI to work with various vulnerability data-sources (NVD, GitHub Security Advisories, CISA Known Exploited Vulnerablity Catalog, FIRST Exploit Prediction Scoring System (EPSS), etc.).
The next-gen open source, crowd-powered & dynamic firewall.
Curated Threat Intelligence Powered by the Crowd. Maximize your security investments with ultra-curated data.
Active Directory Security Assessment. Close Active Directory and Entra ID Security Gaps.
Find and fix security vulnerabilities in AD, now Entra ID, and Okta with Purple Knight, a free AD security vulnerability assessment that helps you uncover hundreds of AD indicators of exposure (IOEs) and compromise (IOCs). Quickly conduct a security assessment of AD—involved in 9 out of 10 cyberattacks.
BTA is an open-source Active Directory security audit framework.
Check for free whether your Laravel website is safe or vulnerable before others do!
This is a free tool to all who wants to optimize and check the security on their Laravel website While there are many security scanners out there, we thought that one was missing. That’s why we made this vulnerability scanner that focus specific on Laravel websites. We focused on known Laravel vulnerabilities, and made the scanner focus on them.
Gitleaks is a fast, light-weight, portable, and open-source secret scanner for git repositories, files, and directories.
Related contents:
An HTTP toolkit for security research.
Hetty is an HTTP toolkit for security research. It aims to become an open source alternative to commercial software like Burp Suite Pro, with powerful features tailored to the needs of the infosec and bug bounty community.
Related contents:
🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.
pinpoint the security issues that actually matter.
BlueHound is an open-source tool that helps blue teams pinpoint the security issues that actually matter. By combining information about user permissions, network access and unpatched vulnerabilities, BlueHound reveals the paths attackers would take if they were inside your network
AD Miner is an Active Directory audit tool that leverages cypher queries to crunch data from the #Bloodhound graph database to uncover security weaknesses.
ADMiner is an Active Directory audit tool that leverages cypher queries to crunch data from the BloodHound graph database (neo4j) and gives you a global overview of existing weaknesses through a web-based static report, including detailed listing, dynamic graphs, key indicators history, along with risk ratings.
- AD Miner - Analyse Active Directory — Emilien Vannier, Jean-Michel Besnard, Tanguy Boisset @ SSTIC :fr:.
- Episode #461 consacré à ADMiner avec Jean-Michel BESNARD @ NoLimitSecu :fr:.
- Not All Paths are Created Equal -- Attackers' Economy (Part 1) @ Riccardo Ancarani - Red Team Adventures.
- Graph theory to assess Active Directory : Smartest vs. Shortest Control Paths @ Jean-Michel BESNARD's LinkedIn.
RansomLord is a proof-of-concept Anti-Ransomware exploitation tool that automates the creation of PE files, used to compromise ransomware pre-encryption.
VirtualGHOST Detection Tool
This repository contains a PowerShell script leveraging VMWare PowerCLI to identify unregistered VMWare Virtual Machines (VMs) that are powered on by comparing the list of VMs registered in the inventory (vCenter or ESXi) vs. those that are powered on.
Docker-Compose file for vulnerability environment.
Vulhub is an open-source collection of pre-built vulnerable docker environments. No pre-existing knowledge of docker is required, just execute two simple commands and you have a vulnerable environment.
Related contents:
To start, or level up, a career in Information Security (aka Cyber) Security you need to be proficient in five key areas of technical skills. You don't have to master each one of them, but you need to have a good understanding of them.
WebCopilot is an automation tool designed to enumerate subdomains of the target and detect bugs using different open-source tools.
An automation tool that enumerates subdomains then filters out xss, sqli, open redirect, lfi, ssrf and rce parameters and then scans for vulnerabilities.
A simple measure of software dependency freshness. It is a single number telling you how up-to-date your dependencies are.