harbian-audit

harbian-audit Hardening Introduction Hardened Debian GNU/Linux and CentOS 8 distro auditing. The main test environment is in debian GNU/Linux 9/10/11/12/13 and CentOS 8 and ubuntu 22, and other versions are not fully tested. There are no implementations of desktop related items in this release. T...

DbDat

DbDat Db Database Assessment Tool DbDat performs numerous checks on a database to evaluate security. The categories of checks performed are configuration, privileges, users, and information. Checks are performed by running queries or reading database configuration files. The goal of this tool is ...

cloudsploit

CloudSploit by Aqua - Cloud Security Scans Quick Start Generic root@kitploit: $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ npm install $ ./index.js -h Docker root@kitploit: $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ docker buil...

colabcat

Colabcat Run Hashcat on Google Colab with session restore capabilities with Google Drive. Usage Go to the link below to open a copy of the colabcat.ipynb file in Google Colab: https://colab.research.google.com/github/someshkar/colabcat/blob/master/colabcat.ipynb Click on Runtime, Change runtime...

fuzzbench

FuzzBench: 퍼저 벤치마킹 서비스 FuzzBench는 실제 세계의 다양한 벤치마크에서 퍼저를 평가하는 무료 서비스로, Google 규모로 운영됩니다. FuzzBench의 목표는 퍼징 연구를 엄격하게 평가하는 과정을 간편하게 만들고, 커뮤니티가 퍼징 연구를 더 쉽게 채택할 수 있도록 하는 것입니다. 연구 커뮤니티 구성원들이 자신의 퍼저를 기여하고 평가 기술 개선에 대한 피드백을 제공해 주시기 바랍니다. FuzzBench는 다음을 제공합니다: 퍼저 통합을 위한 간편한 API 실제 프로젝트의 벤치마크. FuzzBench는 모...

penglab

Penglab Abuse of Google Colab for fun and profit. 🐧 What is it ? Penglab is a ready-to-install setup on Google Colab for cracking hashes with an incredible power, really useful for CTFs. See benchmarks below. It installs by default : Hashcat John Hydra SSH with ngrok And now, it can also : Launch...

csf

ArmourBird CSF - 컨테이너 보안 프레임워크 참고: CSF 클라이언트는 현재 활발히 개발 중이며 더 나은 성능과 아키텍처를 위해 GoLang으로 전환 중입니다. 목차 1. 소개 2. 아키텍처 다이어그램 3. API-CSF 서버 4. 설치/사용법 5. Docker 이미지 빌드 6. 미리보기 7. 할 일 8. 웹사이트 9. 트위터 10. 참고 자료 소개 ArmourBird CSF - 컨테이너 보안 프레임워크 는 Docker 설치 및 컨테이너의 정기적인 보안 모니터링을 위해 CIS 및 기타 사용자 정의 보안 검사에 대해...

dockle

Dockle - 보안을 위한 컨테이너 이미지 린터, 모범 사례 Docker 이미지 구축 지원, 쉽게 시작하기 Dockle은 다음을 도와줍니다: 1. 모범 사례 Docker 이미지 구축 2. 안전한 Docker 이미지 구축 검사 항목에는 CIS Benchmarks가 포함됩니다bash $ brew untap goodwithtech/dockle who use 0.1.16 or older version $ brew install goodwithtech/r/dockle $ dockle YOURIMAGENAME root@kitploit:...

Adhrit

Adhrit is an open source Android APK reversing and analysis suite. The tool is an effort to find an efficient solution to all the needs of mobile security testing and automation. Adhrit has been built with a focus on flexibility and mudularization. Adhrit currently uses the Ghera benchmarks to...

io.zipkin:benchmarks (2.22.1) potentially affected by CVE-2026-82265 via io.zipkin:zipkin-server (2.22.1)

io.zipkin:zipkin-server MAVEN version 2.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.zipkin:zipkin-server and may be impacted: - io.zipkin:benchmarks 2.22.1 Source cves: CVE-2026-82265 Source advisory: SNYK:JAVA-IOZIPKIN-19477049...

From Backlog Items to Security Guidance: Towards Continuous Security Compliance

Continuous software engineering in regulated domains requires engineering teams to address security throughout the development lifecycle. Yet making security requirements explicit in backlog items is still problematic. Engineers must instead infer security relevance of backlog items from brief,...

Exploit for Origin Validation Error in Ultraviolet Cocos_Ai

DugganUSA — IETF Hackathon Contributions Real-world threat-in...

Mythos Didn't Break Your Security Program. Your Exposure Window Could.

The industry spent the initial months after Anthropic's April 7 Mythos reveal focused on volume. How many new CVEs would Mythos add to an already overloaded pipeline? How quickly would the flood of AI-driven discovery overwhelm triage capabilities? How long would it take adversaries to weaponize...

MAStrike: Shapley-Guided Collusive Red-Teaming on Multi-Agent Systems

Hierarchical multi-agent systems MAS are rapidly being deployed in high-stakes workflows across domains such as finance and software engineering. In these systems, safety and security are inherently distributed across role-specialized agents, significantly expanding the attack surface, particular...

InjectV: Modeling Fault Injection Attacks in RISC-V Simulation Environment

Fault Injection Attacks FIAs are a significant threat to hardware security, capable of compromising systems by inducing malicious faults in computation or storage. Evaluating resilience against such attacks is challenging due to the high cost, complexity, and limited availability of physical faul...

Hardening Agent Benchmarks with Adversarial Hacker-Fixer Loops

Agent benchmarks score submissions with outcome verifiers that are typically hand-written and brittle, leaving them open to reward hacking. We audit 1,968 tasks across five terminal-agent benchmarks and find 323 16% hackable by frontier models given only the task description. This corrupts both...

MOLOT System Card: Malicious Operational Logic Observation Transformer

MOLOT Malicious Operational Logic Observation Transformer is a static malicious-code detection system designed for SAST setup where package metadata, maintainer history, and dynamic execution traces may be unavailable or unreliable. The system represents source code as behavior sequences derived...

SeClaw: Spec-Driven Security Task Synthesis for Evaluating Autonomous Agents

Autonomous LLM agents increasingly operate in stateful environments where they access tools, files, memory, and external services. While such capabilities enable complex real-world workflows, they also introduce security risks that are difficult to capture with existing evaluations. Current agent...

Gate AI: LLM Security Benchmark Evaluation Methodology and Results

Published evaluations of prompt-injection and jailbreak detectors for Large Language Models often suffer from two systematic weaknesses: per-dataset threshold tuning and undisclosed operating points. We describe an evaluation harness that addresses both. The detector under evaluation is scored...

MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Models

Diffusion large language models dLLMs generate text by iteratively denoising partially masked sequences under bidirectional context, exposing a safety surface distinct from autoregressive LLMs. Because mask tokens are native inputs and tokens are committed by confidence rather than position,...