1159 matches found
fuzzable
Fuzzable Marco para automatizar el descubrimiento de objetivos Fuzzable mediante análisis estático Introducción Los investigadores de vulnerabilidades que realizan evaluaciones de seguridad a menudo aprovechan las capacidades del fuzzing guiado por cobertura mediante herramientas potentes como...
fuzzable
Fuzzable Framework for Automating Fuzzable Target Discovery with Static Analysis Introduction Vulnerability researchers conducting security assessments on software will often harness the capabilities of coverage-guided fuzzing through powerful tools like AFL++ and libFuzzer. This is important as ...
testing-handbook
Trail of Bits Testing Handbook The Trail of Bits Testing Handbook is a resource for developers and security professionals on configuring, optimizing, and automating many static and dynamic analysis tools we use at Trail of Bits. Preview Testing Handbook: https://appsec.guide 🌐 Why is this needed?...
androwarn
Androwarn Otro analizador de código estático para aplicaciones Android maliciosas Descripción Androwarn es una herramienta cuyo objetivo principal es detectar y advertir al usuario sobre posibles comportamientos maliciosos desarrollados por una aplicación Android. La detección se realiza mediante...
security-harness
Security Harness A multi-agent application-security review harness for Claude Code and, later, other AI agents. One router skill dispatches to a full offensive-security pipeline that maps a codebase, hunts vulnerabilities with a per-class knowledge base, chains findings into escalations, verifies...
mariana-trench
Mariana Trench Mariana Trench is a security focused static analysis platform targeting Android. This guide will walk you through setting up Mariana Trench on your machine and get you to find your first remote code execution vulnerability in a small sample app. These instructions are also availabl...
mariana-trench
Mariana Trench Mariana Trench es una plataforma de análisis estático enfocada en seguridad dirigida a Android. Esta guía te guiará a través de la configuración de Mariana Trench en tu máquina y te llevará a encontrar tu primera vulnerabilidad de ejecución remota de código en una pequeña aplicació...
huskyCI
Este artículo también se puede leer enportugués brasileño. Introducción huskyCI es una herramienta de código abierto que orquesta pruebas de seguridad y centraliza todos los resultados en una base de datos para análisis y métricas posteriores. Puede realizar análisis de seguridad estática en Pyth...
NixImports
NixImports Un cargador de malware .NET, que utiliza API-Hashing e invocación dinámica para evadir el análisis estático ¿Cómo funciona? NixImports utiliza mi implementación gestionada de API-Hashing, HInvoke, para resolver dinámicamente la mayoría de sus funciones llamadas en tiempo de ejecución...
pkgxray
pkgxray — pre-install security for npm packages, MCP servers, and AI agents Inspect an npm package or MCP server before you install or connect to it, and get a deterministic, evidence-backed SAFE, REVIEW, or BLOCK verdict. Local, zero-dependency static analysis — normal scans never execute packag...
Sighthound
Sighthound Escáner de vulnerabilidades estático basado en Tree-sitter con coincidencia de patrones y análisis de flujo de contaminación taint-flow. Qué hace Escanea código fuente en busca de problemas de seguridad usando reglas conscientes del AST. Soporta modo de patrón y modo de contaminación...
msf_shellcode_analysis
Static analysis of a Metasploit shellcode For a first blogpost, I thought it'd be nice to analyze a common Metasploit shellcode - it's a great opportunity to discuss topics such as encoding, PEB, Windows shellcodes and Export Address Tables. Getting started We start with an intercepted, long...
semgrep-rules
semgrep-rules Welcome! This repository contains Semgrep's Community Edition rules. In addition to the rules in this repository, the Semgrep Registry offers proprietary Pro rules that offer additional language coverage, and unlock crossfile and deep dataflow analysis. Find rules: search for...
octoscan
:octocat: octoscan Octoscan is a static vulnerability scanner for GitHub action workflows. Table of Contents Table of Contents Installation Usage download remote workflows analyze GitHub action Rules dangerous-checkout dangerous-action dangerous-write expression-injection runner-label repo-jackin...
ai-reverse-engineering
Rev·Deck — AI-Assisted Reverse Engineering with Ghidra Rev·Deck is a local, single-user static-analysis workstation. It pairs an evidence-first web UI with an LLM copilot over a binary analyzed by a headless Ghidra service: browse deterministic evidence functions, strings, imports,...
kube-linter
Static analysis for Kubernetes What is KubeLinter? KubeLinter analyzes Kubernetes YAML files, Helm charts, and Kustomize manifests, and checks them against a variety of best practices, with a focus on production readiness and security. KubeLinter runs sensible default checks, designed to give you...
fickling
Fickling Fickling is a decompiler, static analyzer, and bytecode rewriter for Python pickle object serializations. You can use fickling to detect, analyze, reverse engineer, or even create malicious pickle or pickle-based files, including PyTorch files. Fickling can be used both as a python libra...
Android-Security-Teryaagh
AST - Seguridad Android Teryaagh 🔥 Guías de seguridad de Android, hoja de ruta, herramientas, documentación, cursos, informes y teryaagh. 📚¡Visita el sitio web de documentación completo aquí! Generado automáticamente con MkDocs Invítame un café ☕ USDTERC20 :...
Gixy-Next
Gixy-Next: NGINX Configuration Security Scanner for Security Audits Overview Gixy-Next Gixy is an open-source NGINX configuration security scanner and hardening tool that statically analyzes your nginx.conf to detect security misconfigurations, hardening gaps, and common performance pitfalls befo...