zaproxy

...

DevSecOpsGuideline

OWASP DevSecOps Guideline The OWASP DevSecOps Guideline explains how we can implement a secure pipeline and use best practices and introduce tools that we can use in this matter. Also, the project is trying to help us promote the shift-left security culture in our development process. This projec...

tailsnitch

Tailsnitch A security auditor for Tailscale configurations. Tailsnitch scans your tailnet for 57 misconfigurations, overly permissive access controls, and security best practice violations. Quick Start root@kitploit: 1. Set your Tailscale API credentials export TSAPIKEY="tskey-api-..." 2. Run aud...

authelia

!OpenSSF Best...

kube-bench

kube-bench is a tool that checks whether Kubernetes is deployed securely by running the checks documented in the...

wstg

Guía de Pruebas de Seguridad Web de OWASP Bienvenido al repositorio oficial de la Guía de Pruebas de Seguridad Web del Open Worldwide Application Security Project® OWASP® WSTG. La WSTG es una guía completa para probar la seguridad de aplicaciones web y servicios web. Creada por el esfuerzo...

coreruleset

Rama| Estado ---|--- main| 🛡️ OWASP CRS...

popeye

Popeye: Kubernetes Live Cluster Linter Popeye is a utility that scans live Kubernetes clusters and reports potential issues with deployed resources and configurations. As Kubernetes landscapes grows, it is becoming a challenge for a human to track the slew of manifests and policies that orchestra...

popeye

Popeye: Linter de clústeres Kubernetes en vivo Popeye es una utilidad que escanea clústeres Kubernetes en ejecución e informa posibles problemas con los recursos y configuraciones desplegados. A medida que el panorama de Kubernetes crece, se vuelve un desafío para un humano hacer seguimiento de l...

aws-security-assessment-solution

Soluciones de Evaluación de Seguridad Self-Service v2.0 La ciberseguridad sigue siendo un tema muy importante y un punto de preocupación para muchos CIOs, CISOs y sus clientes. Para abordar estas importantes inquietudes, AWS ha desarrollado un conjunto principal de servicios que los clientes debe...

scorecard

OpenSSF Scorecard...

mesh-kridik

mesh-kridik Enhance your Kubernetes service mesh security !! mesh-kridik is an open-source security checker that performs various security checks on a Kubernetes cluster with istio service mesh and outputs a security report The security checks tests are the full implementation of istio security...

docker-bench-security

Docker Bench for Security The Docker Bench for Security is a script that checks for dozens of common best-practices around deploying Docker containers in production. The tests are all automated, and are based on the CIS Docker Benchmark v1.6.0. We are making this available as an open-source utili...

API-Security

OWASP API Security Top 10 This project is designed to address the ever-increasing number of organizations that are deploying potentially sensitive APIs as part of their software offerings. These APIs are used for internal tasks and to interface with third parties. Unfortunately, many APIs do not...

awesome-security-hardening

awesome-security-hardening A collection of awesome security hardening guides, best practices, checklists, benchmarks, tools and other resources. This is work in progress: please contribute by sending your suggestions. You may do this by creating issue tickets or forking, editing and sending pull...

Software-Component-Verification-Standard

OWASP Software Component Verification Standard El Estándar de Verificación de Componentes de Software SCVS es un esfuerzo impulsado por la comunidad para establecer un marco de referencia que permita identificar actividades, controles y mejores prácticas, que pueden ayudar a identificar y reducir...

mongoaudit

mongoaudit is a CLI tool for auditing MongoDB servers, detecting poor security settings and performing automated penetration testing. Installing Clone this repository and run the setup: root@kitploit: git clone https://github.com/stampery/mongoaudit.git cd mongoaudit python setup.py install...

AndroBugs_Framework

AndroBugs Framework AndroBugs Framework es un sistema de análisis de vulnerabilidades Android que ayuda a desarrolladores o hackers a encontrar potenciales vulnerabilidades de seguridad en aplicaciones Android. Sin una interfaz gráfica llamativa, pero el más eficiente menos de 2 minutos por escan...

IRM

Spanish version Deprecated The Spanish version is available here. These cheat sheets have been written in English and Russian, and translated into Spanish by Francisco Neira from the OAS...

Johnson Controls Inc. TL280

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to access sensitive information on the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for...