checkov

...

jira-mobile-ssrf-exploit

CVE-2022-26135 - Full-Read Server Side Request Forgery in Mobile Plugin for Jira Data Center and Server About Assetnote Assetnote automatically maps your external assets and monitors them for changes and security issues to help prevent serious breaches. This research was performed by Assetnote's...

Threat matrix: Mapping threats across cloud web applications

In this article 1. Overview 2. Technique Catalog 3. Privilege Escalation 4. Mitigation and protection guidance 5. References 6. Learn more Microsoft introduces the cloud web applications threat matrix, a MITRE ATT &CK-aligned framework that helps defenders understand, prioritize, and mitigate...

f8x

A brand-new IaC automated deployment tool RedC, built on Terraform + Wails GUI for automated multi-cloud deployment and project orchestration—give it a try! Red/Blue team environment automation deployment tool Start • Options • Example • FAQ • License English | 简体中文...

gobuster

Gobuster 💻 Introduction A fast and flexible brute-forcing tool written in Go Gobuster is a high-performance directory/file, DNS and virtual host brute-forcing tool written in Go. It's designed to be fast, reliable, and easy to use for security professionals and penetration testers. ✨ Features 🚀...

CVE-2022-22947_EXP

1. Spring Cloud Gateway Remote Code Execution Vulnerability Hazard Level: High POC/EXP: Public CNVD ID: CNNVD-2022-16402 CVE ID: CVE-2022-22947 2. Affected Versions: VMWare Spring Cloud GateWay 3.1.0 VMWare Spring Cloud GateWay =3.0.0, =3.0.6 VMWare Spring Cloud GateWay 3.0.0 3. Vulnerability...

cloud-audit

Project Introduction cloud-audit Cloud Security Audit Assistant is a tool for detecting the exploitation of leaked AK/SK from public cloud vendors. It periodically calls cloud platform APIs to audit logs and identifies suspected intrusions based on abnormal behavior, black features, and baselines...

nightcrawler

Nightcrawler An autonomous penetration testing agent that runs entirely on a smartphone. Drop the phone on a network, walk away, and it discovers hosts, maps services, finds vulnerabilities, and generates a pentest report — all without cloud connectivity. root@kitploit: ░█▄░█ █ █▀▀ █░█ ▀█▀ █▀▀ █▀...

desktop-2fa

🛡️ Desktop-2FA A secure, offline two-factor authentication 2FA manager for desktop environments. Built with Python, featuring strong encryption and no cloud dependencies. 🌐 Landing Page : desktop-2fa.org ✨ Features...

whoc

whoc A container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform! WhoC at Defcon 29 Cloud Village Azurescape - whoc-powered research, the first cross-account container takeover i...

MAAD-AF

MAAD Attack Framework MAAD-AF es una herramienta de ataque en la nube de código abierto para entornos de Microsoft 365 y Entra ID Azure AD. MAAD-AF ofrece pruebas de seguridad simples, rápidas y efectivas. Valide los controles en la nube de Microsoft y pruebe las capacidades de detección y...

XploitSPY

A cloud based Android Monitoring Tool, powered by NodeJS Features GPS Logging Microphone Recording View Contacts SMS Logs Send SMS Call Logs View Installed Apps View Stub Permissions Live Clipboard Logging Live Notification Logging WhatsApp, Facebook, Instagram, Gmail and more .... View WiFi...

AWSGoat

AWSGoat : A Damn Vulnerable AWS Infrastructure Compromising an organization's cloud infrastructure is like sitting on a gold mine for attackers. And sometimes, a simple misconfiguration or a vulnerability in web applications, is all an attacker needs to compromise the entire infrastructure. Since...

metarget

中文 | English 1 Introduction Metarget = meta- + target, a framework providing automatic constructions of vulnerable infrastructures, used to deploy simple or complicated vulnerable cloud native targets swiftly and automatically. 1.1 Why Metarget? During security researches, we might find that the...

baserunner

Baserunner A tool for exploring and exploiting Firebase datastores. See this post on our blog for an overview of how Firebase works and why we developed this tool. Set up 1. git clone https://github.com/iosiro/baserunner.git 2. cd baserunner 3. npm install 4. npm run build 5. npm start 6. Go to...

CloudGrappler

CloudGrappler Permiso: https://permiso.io Read our release blog: https://permiso.io/blog/cloudgrappler-a-powerful-open-source-threat-detection-tool-for-cloud-environments CloudGrappler is a purpose-built tool designed for effortless querying of high-fidelity and single-event detections related to...

cloudtoolkit

CloudToolKit Inglés | 简体中文 Kit de validación defensiva multinube para flujos de trabajo de detección, telemetría e investigación de CSPM / CNAPP en entornos autorizados. CloudToolKit ofrece a los equipos de seguridad una forma práctica de verificar si los controles en la nube son descubribles,...

overlord

Overlord – Automatización de Red Teaming Overlord proporciona una CLI de consola basada en Python que se utiliza para construir infraestructura de Red Teaming de manera automatizada. El usuario debe proporcionar entradas utilizando los módulos de la herramienta por ejemplo, C2, Servidor de Correo...

overlord

Overlord – Red Teaming Automation Overlord provides a python-based console CLI which is used to build Red Teaming infrastructure in an automated way. The user has to provide inputs by using the tool’s modules e.g. C2, Email Server, HTTP web delivery server, Phishing server etc. and the full infra...

hacktricks-cloud

HackTricks Cloud Hacktricks logos & motion designed by @ppieranacho .1 Run HackTricks Cloud Locally The workflow below follows Git's documented clone, checkout, and pull operations and the repository's published language branches and container setup.238910 root@kitploit: Download latest version o...