639 matches found
metarget
中文 | English 1 项目介绍 Metarget的名称来源于meta-（元）加target（目标，靶机），是一个脆弱基础设施自动化构建框架，主要用于快速、自动化搭建从简单到复杂的脆弱云原生靶机环境。 「绿盟科技研究通讯」上发布了一篇阐述Metarget的设计理念和技术目标的文章，见Metarget：云原生攻防靶场开源啦！。 1.1 项目的缘起 在研究漏洞时，我们经常会发现“环境搭建”这一步骤本身就会占用大量的时间，与之相比，真正测试PoC、ExP的时间可能非常短。由于许多官方镜像在国内的网络环境下并不方便获得，加上云原生组件自身的复杂性，在云原生安全领域，前述问题尤为明显。...
HybridTestFramework
HybridTestFramework Unterstützt von In der Ära der Cloud-native-Welt können wir uns nicht auf ein bestimmtes Framework festlegen, aber aufgrund von Projektanforderungen müssen wir die bestehende Testlösung oft so weiterentwickeln, dass sie mehrere Testanforderungen erfüllen kann. Daher zielt dara...
NetLogic
NetLogic Mapeador de Superfície de Ataque Nativo em Nuvem e Correlacionador de Vulnerabilidades — v3.0 NetLogic é uma plataforma de segurança de rede que combina varredura ativa de portas, correlação de CVEs API NVD ao vivo, análise SSL/TLS, auditoria de segurança HTTP, avaliação de segurança...
Krawl
Krawl A modern, customizable web honeypot server designed to detect and track malicious activity from attackers and web crawlers through deceptive web pages, fake credentials, and canary tokens. Table of Contents Demo What is Krawl? Krawl Dashboard Deployment Modes Krawl Banlist Quickstart Docker...
matano
Data lake di sicurezza open source per AWS Matano Open Source Security data lake è un open source, costruito per i team di sicurezza su AWS...
KubeArmor
KubeArmor è un sistema di enforcement della sicurezza runtime cloud-native che limita il comportamento come l'esecuzione di processi, l'accesso ai file e le operazioni di rete di pod, container e nodi VM a livello di sistema. KubeArmor sfrutta moduli di sicurezza Linux LSM come AppArmor, SELinux ...
ThreatMapper
ThreatMapper - Gestione delle minacce in runtime ed enumerazione dei percorsi di attacco per Cloud Native...
kratos
Chat · Discussioni · Newsletter · Documentazione · Prova Ory Network · Lavora con noi Ory Kratos è un sistema di gestione delle identità e degli utenti basato su API per applicazioni cloud native. Centralizza i flussi di login, registrazione, recupero, verifica e gestione del profilo in modo che ...
vulhub
Vulhub is an open-source collection of pre-built, ready-to-use vulnerable Docker environments. With just one command you can launch a vulnerable environment for security research, learning, or demonstration, no prior Docker experience required. 中文版本Chinese version Quick Start Install Docker examp...
apache_skywalking
Apache SkyWalking SkyWalking : un sistema APM monitoraggio delle prestazioni delle applicazioni, progettato appositamente per architetture basate su microservizi, cloud native e container Docker, Kubernetes, Mesos. Sommario SkyWalking è un sistema APM open source, che include funzionalità di...
Dragonfly2 < 2.1.0-beta.1 - Hardcoded JWT Secret
Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation CNCF as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, "Secret Key", is hard coded, which leads to...
lockc
lockc is open source sofware for providing MAC Mandatory Access Control type of security audit for container workloads. The main reason why lockc exists is that containers do not contain. Containers are not as secure and isolated as VMs. By default, they expose a lot of information about host OS...
bpflock
bpflock - Lock Linux machines bpflock - eBPF driven security for locking and auditing Linux machines. Note: bpflock is currently in experimental stage , it may break, options and security semantics may change, some BPF programs will be updated to use Cilium ebpf library. Sections 1. Introduction...
dsiem
Dsiem Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system. Dsiem provides OSSIM-style correlation for normalized logs/events, perform lookup/query to threat intelligence and vulnerability information sources, an...
lightwave
Was ist Lightwave Project Lightwave ist ein Open-Source-Projekt, das aus Enterprise-Identitäts- und Zugriffsverwaltungsdiensten besteht, die auf kritische Sicherheits-, Governance- und Compliance-Herausforderungen für Cloud-native Apps im Unternehmen abzielen. Durch die Integration mit Project...
GO-2026-6112 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-sqs, crossplane-provider-aws-eks, terraform-provider-grafana, crossplane-provider-aws-kinesis, kubevela, dataplaneapi, crossplane-provider-aws-memorydb, hugo, grafana, crossplane-provider-azure-managedidentity, crossplane-provider-aws-route53,...
GO-2024-2978 vulnerabilities
Vulnerabilities for packages: vcluster, minio, smarter-device-manager, pulumi-language-dotnet, terraform-docs, gomplate-fips, k8sgpt-operator, grafana-mimir, kube-rbac-proxy-fips, cilium, opentelemetry-collector-contrib-fips, cloudnative-pg, minio-fips, ferretdb, tempo, k3d, zot, kube-rbac-proxy,...
GO-2025-4257 vulnerabilities
Vulnerabilities for packages: k8sgpt, kserve...
TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign
A new analysis has uncovered that the threat actor tracked as TeamPCP has been active on the cybercrime scene as far back as 2020, indicating the group has been compromising internet-facing infrastructure for years before training their sights on the software supply chain. "The connection is...
