gha-lab-e4a85583c3

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of ONSdigital/ras-collection-instrument a...

Argus

Argus Este repositorio contiene el código de nuestro artículo de USENIX Security '23 "ARGUS: A Framework for Staged Static Taint Analysis of GitHub Workflows and Actions". Argus es una herramienta integral de análisis de seguridad diseñada específicamente para GitHub Actions. Construido con el...

octoscan

:octocat: octoscan Octoscan is a static vulnerability scanner for GitHub action workflows. Table of Contents Table of Contents Installation Usage download remote workflows analyze GitHub action Rules dangerous-checkout dangerous-action dangerous-write expression-injection runner-label repo-jackin...

RAUDI

🐳 RAUDI: Imágenes Docker Actualizadas Regular y Automáticamente RAUDI Regularly and Automatically Updated Docker Images genera y mantiene actualizadas automáticamente una serie de imágenes Docker mediante GitHub Actions para herramientas que no son proporcionadas por los desarrolladores. Tabla de...

tun2socks

Features Universal Proxying : Transparently routes all network traffic from any application through a proxy. Multi-Protocol : Supports HTTP/SOCKS/Shadowsocks/SSH/Relay proxies with optional authentication...

zizmor

🌈 zizmor zizmor is a static analysis tool for CI/CD systems. It can find and fix security issues in common CI/CD setups, including GitHub Actions, Dependabot, and pre-commit. Some of the things zizmor finds:...

PoC-AutoSync

🧠 PoC-AutoSync-Github Automatically collects public Proof-of-Concept PoC exploits from poc-in-github.motikan2010.net and keeps the database up to date with automatic updates. Use responsibly — for research and defensive purposes only. Inspired by nomi-sec/PoC-in-GitHub. 🔍 Overview This repository...

vulnerability-spoiler-alert

Alerta de Spoiler de Vulnerabilidad Conoce los parches de seguridad antes de que se publique el CVE. Ver sitio en vivo | Suscribirse vía RSS Un centro de monitoreo que observa repositorios de código abierto populares y utiliza IA para detectar cuándo los commits están parcheando vulnerabilidades ...

BurpSuite-collections

Burp-Suite-collections Colección de proyectos relacionados con BurpSuite, principalmente plugins que no están en BApp Store tienda ¡Toda la localización o uso de BurpSuite se realiza bajo la premisa de que tienes configurado el entorno Java correctamente! Tutorial relacionado La última versión...

PcapPlusPlus

...

spamassassin

Apache SpamAssassin GitHub Actions for testing The Apache SpamAssassin project uses a subversion repo for its development process. A read-only mirror of the repo is maintained on GitHub here. The .github directory containing this README file is not part of the Apache SpamAssassin release package...

awesome-cybersecurity-resources

awesome-cybersecurity-resources Awesome Cybersecurity Resources, more. Purpose This repository stores curated cybersecurity resources gathered from the internet, repository documentation, and selected local notes. The canonical format is: one resource per Markdown file YAML frontmatter as the...

teampcp-supply-chain-attack

TeamPCP Supply Chain Attack: Technical Analysis & Detection Guide CVE-2026-33634 CVSS 9.4 — The most impactful CI/CD supply chain attack of 2026 so far. Between March 19–25, 2026, threat actor TeamPCP also tracked as DeadCatx3, PCPcat, ShellForce, CanisterWorm executed a cascading supply chain...

octoscan

:octocat: octoscan Octoscan は GitHub Action ワークフロー用の静的脆弱性スキャナです。 目次 目次 インストール 使い方 リモートワークフローのダウンロード 分析 GitHub Action ルール dangerous-checkout dangerous-action dangerous-write expression-injection runner-label repo-jacking unsecure-commands bot-check known-vulnerability dangerous-artefact credential...

mitmproxy

mitmproxy !autofix.ci:...

nxlog-ubuntu-githubactions

nxlog-ubuntu-githubactions nxlog ubuntu...

smokedmeat

SmokedMeat CI/CD Red Team Framework Как Metasploit, но для CI/CD-пайплайнов. От создателейpoutine — SAST-сканера пайплайнов сборки в BoostSecurity Labs. Предупреждение: Этот инструмент предназначен только для авторизованного тестирования безопасности. SmokedMeat существует потому, что угрозы...

CVE-2025-24071_POC

Video Tutorial Windows Library File Creator CVE-2025-24071/CVE-2025-24054 Demo A minimalistic Rust application that demonstrates the creation of Windows Library files .library-ms with configurable network paths. Overview This project creates Windows Library Description .library-ms files that poin...

gha-lab-4a8fad8536

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of dbt-labs/actions at commit...

fix-CVE-2020-15228

Fix CVE-2020-15228 set-env, add-path in Github-Actions This script changes lines in your github action file. You give it a directory name, and it searches for all files with the ".sh" or ".yml" extension. It recognizes these lines: root@kitploit: echo ::set-env name=FOOBAR::$FOOBAR echo ::set-env...