prowler

Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security...

cloudquery

CloudOps, without the chaos CloudQuery is a cloud asset inventory built for platform teams. Sync your cloud infrastructure metadata into your data warehouse, powering insights and automation. Unify data and provide context across AWS, Azure, GCP, and 70+ cloud and SaaS sources such as Wiz, Finout...

barq

barq barq：AWS 云后渗透框架！ 这是什么？ barq 是一个后渗透框架，允许您轻松地对正在运行的 AWS 基础设施执行攻击。它允许您攻击正在运行的 EC2 实例，而无需拥有原始实例的 SSH 密钥对。它还允许您枚举和提取 AWS 中存储的 Secrets 和 Parameters。 先决条件 一个现有的 AWS 账户访问密钥 ID 和密钥（某些情况下还需要 Token） Python 2 或 3。两者均可运行。 要运行 msfvenom payload，您需要在工作站上安装 msfvenom，并正确设置 PATH。 安装 对于 Python 2： pip install -r...

cloudsploit

CloudSploit by Aqua - Cloud Security Scans Quick Start Generic $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ npm install $ ./index.js -h Docker $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ docker build . -t cloudsploit:0.0.1 $...

cynative

独自のセキュリティエージェントを構築する インフラストラクチャへのライブかつ読み取り専用アクセスを備えたセキュリティエージェント向けのオープンソースフレームワーク。 クイックスタート · 組み込みエージェント · 最初のエージェント · ドキュメント インフラストラクチャについて何でも質問できます。 Cynative はフロンティアモデルをコード、クラウド、ランタイム全体で実行し、GitHub、GitLab、AWS、GCP、Azure、Kubernetes を単一のシステムとして推論し、検証済みの回答を返します。bash cynative "what in my cloud is...

overlord

Overlord – 레드팀 자동화 Red Teaming Automation Overlord는 파이썬 기반 콘솔 CLI를 제공하며, 이를 통해 레드팀 인프라를 자동으로 구축할 수 있습니다. 사용자는 도구의 모듈예: C2, 이메일 서버, HTTP 웹 전달 서버, 피싱 서버 등을 사용하여 입력을 제공하고, 선택한 클라우드 제공업체에 전체 인프라/모듈 및 스크립트가 자동으로 생성됩니다. 현재 AWS와 Digital Ocean을 지원합니다. 이 도구는 아직 개발 중이며, GitHub에서 찾을 수 있는 Red-Baron Terraform...

Le Panthéon de la Souveraineté

🏠 개발 환경: GitLab | 🪞 자동 미러: GitHub 🏛️ 주권의 판테온 GAFAM에서 완전히 독립하도록 설계된 100% 주권적이고, 중복되며, 보안된 클라우드 인프라스트럭처. 버전 1.1: 프라이빗 네트워크 기반, 서버 DNS 요청 암호화DoT, 멀티 데이터센터 백업 아키텍처스위스, 독일, 핀란드. ⚠️ 중요 경고 및 방법론 1. 프로젝트 배경 및 버전 관리 이 프로젝트는 완전한 주권에 대한 필요에서 탄생했으며 반복적인 진화를 따릅니다: 배경: 주로 스위스Infomaniak에 호스팅되는 인프라로, 데이터는 독일 과...

AzureGoat

AzureGoat : 脆弱なAzureインフラストラクチャ 攻撃者にとって、組織のクラウドインフラストラクチャを侵害することは、金鉱を手に入れるようなものです。そして、単純な設定ミスやWebアプリケーションの脆弱性があれば、攻撃者がインフラ全体を侵害するのに十分な場合があります。クラウドは比較的新しいため、多くの開発者は脅威の状況を完全に認識しておらず、脆弱なクラウドインフラストラクチャをデプロイしてしまいがちです。Microsoft...

pack

Password Analysis and Cracking Kit by Peter Kacherginsky iphelix PACK Password Analysis and Cracking Toolkit is a collection of utilities developed to aid in analysis of password lists in order to enhance password cracking through pattern detection of masks, rules, character-sets and other passwo...

CVE-2023-44487-HTTP-2-Rapid-Reset-Attack

PoC - CVE-2023-44487: HTTP/2 Rapid Reset Attack このリポジトリには、CVE-2023-44487 （別名 HTTP/2 Rapid Reset Attack ）の脆弱性の悪用を実証する Proof of Concept（PoC）が含まれています。この脆弱性は HTTP/2 プロトコルに影響を与え、攻撃者が RSTSTREAM を使ってすばやく閉じられるストリームを利用して Web サーバーに過大な負荷をかけることを可能にします。 📌 説明 CVE-2023-44487 は HTTP/2...

azure-vulnerability-remediation-project

脆弱性調査と修復: Azure Cloud Infrastructure プロジェクト概要 このプロジェクトは、クラウドホスト型Windows Server 2025インスタンス（CyberVM）を対象としたエンドツーエンドの脆弱性管理ライフサイクルを文書化したものです。本ラボでは、直接的なソフトウェアパッチとアーキテクチャ上の補完的制御の両方を用いて、高深刻度のセキュリティリスクを特定、分析、無効化するプロアクティブなアプローチを示します。 1. 特定とベースライン評価 Nessus Essentials...

cynative v1.11.3

Build your own security agents Open-source framework for security agents with live, read-only access to your infrastructure. Quickstart · Built-in agents · Your first agent · Docs Ask your infrastructure anything. Cynative runs frontier models across your code, cloud and runtime - reasoning throu...

agent-bom v0.104.0

Open security scanner and self-hosted control plane for AI, MCP, and cloud infrastructure. Self-host · Deployment models · Quick start · Product tour · Docs agent-bom finds the AI agents, MCP servers, packages and credentials in a repository, w...

cloudquery cli-v6.42.2

CloudOps, without the chaos CloudQuery is a cloud asset inventory built for platform teams. Sync your cloud infrastructure metadata into your data warehouse, powering insights and automation. Unify data and provide context across AWS, Azure, GCP, and 70+ cloud and SaaS sources such as Wiz, Finout...

CVE-2026-71417

creationtimestamp| type| source ---|---|--- 2026-08-18 22:35:05+00:00| published-proof-of-concept| https://github.com/Netflix/lemur/security/advisories/GHSA-pxmc-2ffp-8j67...

CVE-2026-67620

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULTDENYLIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticate...

EUVD-2026-54793

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULTDENYLIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticate...

CVE-2026-48034: Improper Access Control

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket. This issue has been patched in version 1.4.0...

GO-2026-5609 OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS) in github.com/openbao/openbao

OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction DoS in github.com/openbao/openbao...

Cloud-native Security for your Windows environment: Announcing the Wiz Runtime Sensor for Windows

Secure your Windows fleet without sacrificing performance. Wiz pairs real-time threat detection with a memory-safe architecture that scales efficiently to protect your essential cloud infrastructure...