778 matches found
ci-supplychain-guard
CI Supply Chain Guard A static analysis tool for detecting malicious dependencies in CI/CD pipelines before they're merged into your codebase. Author: Otsmane Ahmed Status: Research Prototype v1.0 Quick Start root@kitploit: 1. Clone and install git clone...
metlo
Metlo API Security Secure Your API. Metlo is an open-source API security platform Metlo is an open source API security tool you can setup in 15 minutes that inventories your endpoints, detects bad actors and blocks malicious traffic in real time. Detect API attacks in real time. Automatically blo...
scan-shai-hulud
scan-shai-hulud A fast, zero-dependency Bash scanner to detect whether your machine is affected by the CVE-2026-45321 "Mini Shai-Hulud" supply chain attack. On May 11, 2026, over 170 npm packages and 2 PyPI packages across TanStack, Mistral AI, UiPath, OpenSearch, and Guardrails AI were...
api-security-audit-action
GitHub Action: اختبار الأمان الثابت لواجهات REST API من 42Crunch يبحث إجراء اختبار الأمان الثابت لواجهات REST API عن عقود REST API التي تتبع مواصفة OpenAPI OAS، المعروفة سابقًا باسم Swagger ويجري فحوصات أمان شاملة عليها. يتم دعم كل من OAS v2 و v3.0.x، بتنسيقي JSON و YAML. يمكنك استخدام هذا الإجرا...
Bug-Bounty-Arsenal-v.3
BugBounty Arsenal A free, full-stack security scanning platform for bug bounty hunters and security researchers — 50+ detectors, continuous monitoring, and CI/CD gating from a single dashboard. ▶ Live app:bugbounty-arsenal.net — free, no credit card. If this is useful, please ⭐ the repo — it...
botb
Break out the Box BOtB BOtB is a container analysis and exploitation tool designed to be used by pentesters and engineers while also being CI/CD friendly with common CI/CD technologies. What does it do? BOtB is a CLI tool which allows you to: Exploit common container vulnerabilities Perform commo...
botb
बॉक्स से बाहर निकलें BOtB BOtB एक कंटेनर विश्लेषण और शोषण उपकरण है जिसे पेंटेस्टर्स और इंजीनियरों द्वारा उपयोग के लिए डिज़ाइन किया गया है, साथ ही यह सामान्य CI/CD तकनीकों के साथ CI/CD अनुकूल है। यह क्या करता है? BOtB एक CLI टूल है जो आपको निम्न की अनुमति देता है: सामान्य कंटेनर कमजोरियों का शोषण...
CVE-2026-45321-Tanstack
Simulasi Supply Chain Attack — CVE-2026-45321 TanStack Educational Lab for Understanding npm Supply Chain Attacks, CI/CD Abuse, and Install-Time Code Execution Disclaimer Project ini dibuat hanya untuk: pembelajaran keamanan siber, riset defensive security, simulasi local lab, memahami konsep...
trajan
ट्राजन: CI/CD सुरक्षा स्कैनर ट्राजन CI/CD पाइपलाइनों में सुरक्षा कमजोरियों को स्कैन करता है जिनका उपयोग हमलावर सॉफ्टवेयर आपूर्ति श्रृंखलाओं से समझौता करने के लिए करते हैं। यह GitHub Actions, GitLab CI, Azure DevOps, Jenkins और JFrog का समर्थन करता है। यह क्या करता है ट्राजन वर्कफ़्लो YAML फ़ाइलों...
kube-score
kube-score kube-score is a tool that performs static code analysis of your Kubernetes object definitions. The output is a list of recommendations of what you can improve to make your application more secure and resilient. You can test kube-score out in the browser with the...
tanscript-exploit-check
هجوم سلسلة التوريد Mini Shai-Hulud — مدقق IOC root@kitploit: curl -fsSL https://raw.githubusercontent.com/nkopylov/tanscript-exploit-check/main/check-tanstack-exploit.sh | bash أو استنسخ وشغّل محليًا: root@kitploit: git clone https://github.com/nkopylov/tanscript-exploit-check.git cd...
Mobile-Security-Framework-MobSF
Mobile Security Framework MobSF Mobile Security Framework MobSF is a security research platform for mobile applications in Android, iOS and Windows Mobile. MobSF can be used for a variety of use cases such as mobile application security, penetration testing, malware analysis, and privacy analysis...
smokedmeat
SmokedMeat CI/CD Red Team Framework Like Metasploit, but for CI/CD pipelines. From the makers of thepoutine Build Pipeline SAST scanner at BoostSecurity Labs. Warning: This tool is for authorized security testing only. SmokedMeat exists because CI/CD pipeline threats are deeply underestimated...
Argus
Argus इस रिपॉजिटरी में हमारे USENIX Security '23 पेपर "ARGUS: A Framework for Staged Static Taint Analysis of GitHub Workflows and Actions" का कोड शामिल है। Argus एक व्यापक सुरक्षा विश्लेषण उपकरण है जो विशेष रूप से GitHub Actions के लिए डिज़ाइन किया गया है। CI/CD वर्कफ़्लो की सुरक्षा बढ़ाने के...
CVE-2026-45321-Tanstack
Supply Chain Attack Simulation — CVE-2026-45321 TanStack Educational Lab for Understanding npm Supply Chain Attacks, CI/CD Abuse, and Install-Time Code Execution Disclaimer This project is created only for: cybersecurity learning, defensive security research, local lab simulation, understanding t...
graphql-cop
GraphQL Cop - أداة تدقيق أمني لـ GraphQL حول GraphQL Cop هي أداة بايثون صغيرة لتشغيل اختبارات أمنية شائعة ضد واجهات برمجة تطبيقات GraphQL. GraphQL Cop مثالية لتشغيل فحوصات CI/CD في GraphQL. إنها خفيفة الوزن، وتغطي قضايا أمنية مثيرة للاهتمام في GraphQL. تتيح لك GraphQL Cop إعادة إنتاج النتائج من...
nord-stream
Nord Stream Nord Stream هي أداة تسمح لك باستخراج الأسرار المخزنة داخل بيئات CI/CD عن طريق نشر خطوط أنابيب خبيثة. تدعم حاليًا Azure DevOps وGitHub وGitLab. اعرف المزيد في مقال المدونة التالي: https://www.synacktiv.com/publications/cicd-secrets-extraction-tips-and-tricks جدول المحتويات Nord Stream...
CVE-2026-1337-AI-Coding-Assistant-Prompt-Injection-to-Sandbox-Escape
CVE-2026-1337 – Injection par invite d'assistant IA de codage menant à une exécution de code à distance 📖 Vue d'ensemble Une vulnérabilité d'injection par invite dans un bot de revue de code basé sur l'IA permet à un attaquant d'injecter des commandes shell arbitraires en manipulant la suggestion...
DEFCON-CICD-pipelines-workshop
CI/CD : إلدورادو الجديد؟ الملخص أصبحت خطوط أنابيب CI/CD بشكل متزايد جزءًا من البنية التحتية القياسية داخل فرق التطوير، ومع ظهور أساليب جديدة مثل البنية التحتية كرمز Infrastructure as Code، يتصاعد مستوى حساسية هذه الخطوط بسرعة. في حال حدوث اختراق، لم تعد التطبيقات وحدها هي المعرضة للخطر، بل الأنظم...