sast-scan

Introduction root@kitploit: ███████╗ ██████╗ █████╗ ███╗ ██╗ ██╔════╝██╔════╝██╔══██╗████╗ ██║ ███████╗██║ ███████║██╔██╗ ██║ ╚════██║██║ ██╔══██║██║╚██╗██║ ███████║╚██████╗██║ ██║██║ ╚████║ ╚══════╝ ╚═════╝╚═╝ ╚═╝╚═╝ ╚═══╝ Scan is a free open-source security tool for modern DevOps teams. With an...

chaos

chaos chaos is an 'origin' IP scanner developed by RST in collaboration with ChatGPT. It is a niche utility with an intended audience of mostly penetration testers and bug hunters. An origin-IP is a term-of-art expression describing the final public IP destination for websites that are publicly...

laforge

Laforge Security Competition Infrastructure Automation Framework Laforge enables rapid development of infrastructure for the purpose of information security competitions. Using a simple and intuitive configuration language, Laforge manages a dependency graph and state management and allows for...

Nebula

Nebula Nebula is a Cloud and hopefully DevOps Penetration Testing framework. It is build with modules for each provider and each functionality. As of April 2021, it only covers AWS, but is currently an ongoing project and hopefully will continue to grow to test GCP, Azure, Kubernetes, Docker, or...

nord-stream

Nord Stream Nord Stream es una herramienta que permite extraer secretos almacenados en entornos CI/CD mediante el despliegue de pipelines maliciosos. Actualmente es compatible con Azure DevOps, GitHub y GitLab. Puedes encontrar más información en el siguiente artículo de blog:...

threatcl

threatcl Threat Modeling with HCL What happened to hcltm? hcltm has been renamed to threatcl. Welcome! Overview !TIP Want to read the new documentation? Head over to threatcl.dev There are many different ways in which a threat model can be documented. From a simple text file, to more in-depth wor...

ADOKit

ADOKit Description Azure DevOps Services Attack Toolkit - ADOKit is a toolkit that can be used to attack Azure DevOps Services by taking advantage of the available REST API. The tool allows the user to specify an attack module, along with specifying valid credentials API key or stolen...

DevSecOpsGuideline

OWASP DevSecOps Guideline The OWASP DevSecOps Guideline explains how we can implement a secure pipeline and use best practices and introduce tools that we can use in this matter. Also, the project is trying to help us promote the shift-left security culture in our development process. This projec...

kubestriker

A Blazing fast Security Auditing tool for kubernetes!!...

ObfuscatedSharpCollection

Obfuscated SharpCollection Intento rápido y sucio de ofuscación automatizada utilizando yetAnotherObfuscator por @0xcc00 junto con compilaciones recientes de herramientas ofensivas comunes en C, de forma CDI mediante canalizaciones de lanzamiento de Azure DevOps. Obfuscated SharpCollection no...

cumulus

OWASP Cumulus - Modelado de amenazas en la nube Cumulus es la forma sencilla de introducir la seguridad en los equipos de cloud y devOps. Como variante del juego de cartas Elevation of Privilege, sigue la idea de realizar modelado de amenazas de un sistema mediante la gamificación. Este enfoque...

DevSec-Defense

DevSec-Defense DevSec Defense 演示的配套 PowerShell 模块与示例 DevSec Defense：DevOps 实践如何推动防御者的检测开发...

glue

OWASP Glue Glue is a framework for running a series of tools. Generally, it is intended as a backbone for automating a security analysis pipeline of tools. Recommended Usage For those wishing to run Glue, we recommend using the docker image because it should have the other tools it uses available...

archerysec

...

Security Bulletin: Multiple vulnerabilities in IBM DevOps Solution Workbench

Summary Multiple vulnerabilities were addressed in IBM DevOps Solution Workbench version 5.2.2 Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time...

Dop2Mop

Dop2Mop A proof-of-concept OpenGraph collector for BloodHound that maps attack paths from DevOps to MLOps infrastructure. Based on Pipelines of Privilege: Attack Paths from DevOps to MLOps Infrastructure by Brett Hawkins @h4wkst3r. Table of Contents Acknowledgments Overview Supported Platforms...

azuredevops-enum

ado-enum Una herramienta de línea de comandos para enumerar organizaciones de Azure DevOps mediante un token de acceso personal PAT. Consulta la API REST de Azure DevOps para exponer proyectos, repositorios, conexiones de servicio, compilaciones, artefactos de compilación y ajustes de seguridad,...

Ingress-Nginx Controller - Remote Code Execution

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. Note...

POC-CVE-2026-42826-2026-42826-Microsoft-Azure-DevOps-Information-Disclosure-Vulnerability

CVE-2026-42826 — PoC de divulgación de información de Azure DevOps Resumen...

SharpCollection

SharpCollection Compilaciones nocturnas de herramientas ofensivas comunes en C, recién salidas de sus respectivas ramas master, compiladas y publicadas de forma CDI mediante canalizaciones de lanzamiento de Azure DevOps. ¿Falta tu herramienta favorita? No dudes en abrir un issue o enviarme un...