dnscontrol

DNSControl DNSControl 是用于 DNS 的基础设施即代码（Infrastructure as Code）工具。它包含一门功能完备的配置语言（兼容 JavaScript），以及能够与 DNS 提供商 API（如 AWS Route 53、Cloudflare 和 Gandi）通信的“插件”。它可以将相同的 DNS 记录发送到多个提供商。它可以在任何 Go 能运行的地方运行（Linux、macOS、Windows）。提供商模型是可扩展的，因此可以不断添加新的提供商。 示例 dnsconfig.js： root@kitploit: // define our registr...

KaiMonkey

KaiMonkey - 脆弱的基础设施即代码环境 KaiMonkey 提供脆弱的基础设施即代码（IaC），帮助探索和理解通过 IaC 暴露的常见云安全威胁。 介绍 KaiMonkey 旨在提供一个包含脆弱 IaC 的演练场，帮助分析和制定从代码到云端的安全策略。 该项目可以帮助你熟悉 IaC 安全问题，并验证你的 IaC 扫描器 是否正常工作。项目会持续维护和增强，以增加更多类型的问题，并支持更多的 IaC 和云提供商。欢迎贡献。 要了解更多关于 KaiMonkey 中的安全风险，你可以利用 Terrascan —— 我们的开源工具，用于在配置基础设施前检测合规性和安全违规。你也可以使用...

tf-mythic-azure

Mythic 的 Terraform 部署 本项目允许操作人员在 Azure 中部署多个 Mythic C2 服务器。可选地，还可以创建 Azure CDN 重定向器。其理念是您可以通过此 Terraform 代码创建多个"项目"进行管理。这样，操作人员可以以代码形式在中心位置管理其基础设施资源。 用法 在 main.tf 文件中有一个 projects 映射。您可以向该映射添加项目。每个项目都将拥有自己的 Mythic C2 实例。可以添加不同的变量来配置 Mythic，例如凭据和要安装的 C2 代理。例如： root@kitploit: locals projects = Custo...

iac-scan-runner

IaC Scan Runner Service that scans your Infrastructure as Code for common vulnerabilities...

iac-scan-runner

IaC Scan Runner Servicio que escanea tu Infraestructura como Código en busca de vulnerabilidades comunes...

checkov

...

binaryalert

BinaryAlert: Serverless, Real-Time & Retroactive Malware Detection .. image:: https://travis-ci.org/airbnb/binaryalert.svg?branch=master :target: https://travis-ci.org/airbnb/binaryalert :alt: Build Status .. image:: https://coveralls.io/repos/github/airbnb/binaryalert/badge.svg?branch=master...

cfn_nag

背景 cfn-nag 工具用于查找 CloudFormation 模板中可能表明基础设施不安全的模式。大致来说，它会查找： 过于宽松（通配符）的 IAM 规则 过于宽松（通配符）的安全组规则 未启用的访问日志 未启用的加密 密码字面量 关于该工具的更多背景，请参阅 Stelligent 博客上的这篇文章： 利用 "cfn-nag" 在 CloudFormation 模板开发流程早期发现安全问题 安装 Gem 安装 假设已安装 Ruby = 2.5.x，安装只需： root@kitploit: gem install cfn-nag Brew 安装 在 MacOS 或 Linux...

GHSA-76P8-FHRM-VPC7 vulnerabilities

Vulnerabilities for packages: gitlab-runner-fips, wave-fips, verticadb-operator, crossplane-provider-aws-serverlessrepo, sonobuoy, crossplane-provider-aws-account, newrelic-nri-kube-events-fips, chainloop-artifact-cas-fips, grafana-alloy, frankenphp-8.2, crossplane-provider-terraform,...

GO-2022-0968 vulnerabilities

Vulnerabilities for packages: k3d, kubeflow, terraform-provider-sendgrid-fips, dynamic-localpv-provisioner-fips, dynamic-localpv-provisioner, terraform-provider-sendgrid, kubeflow-fips...

GO-2025-4135 vulnerabilities

Vulnerabilities for packages: opa-envoy, fulcio, argo-events, buildkitd, kubevela, crossplane-provider-aws-rds, helm-mapkubeapis, thanos, k3s, kube-vip, gcsfuse, jaeger, undock, op-geth, flannel, hcloud, hugo, velero-plugin-for-microsoft-azure, gh, sftpgo-plugin-auth, opentofu, kine,...

@aligent/cdk-esbuild (>=2.0.0, <=2.1.0), @aligent/cdk-graphql-mesh-server (>=0.1.5, <=2.17.0) +613 more potentially affected by unknown CVE via aws-cdk-lib (>=2.0.0, <=2.252.0)

aws-cdk-lib NPM version =2.0.0, =2.0.0, =0.1.5, =2.3.7, =2.0.1, =2.0.0, =2.0.0-beta, =0.0.3, =1.2.15, =5.0.0-ampgenconfig.0, =2.7.0-a-cdkv2-graphql-15.0, =5.0.0-beta.0, =4.1.10-alpha.74, =3.0.0-ampgenconfig.0, =3.7.28 and more Source cves: unknown CVE Source advisory: SNYK:JS-AWSCDKLIB-18318518...

aks-poc-setup

AKS Production-Grade POC Setup A comprehensive, production-re...

Operation-Molasses

🍯 OPERATION MOLASSES PEKMEZ Zencefil Efendi's Cyber Dow...

IaC Inventory: A Unified View Across Code, Deployments, and Cloud

As AI applications introduce a new class of infrastructure resources, visibility into what your IaC creates, where it runs, and whether it has drifted has never been more critical...

devops-security-pipeline-poc

DevOps Security Pipeline POC A security-integrated CI/CD pipe...

Can Developers Rely on LLMs for Secure IaC Development?

We investigated the capabilities of GPT-4o and Gemini 2.0 Flash for secure Infrastructure as Code IaC development. For security smell detection, on the Stack Overflow dataset, which primarily contains small, simplified code snippets, the models detected at least 71% of security smells when prompt...

Holoscope: Open and Lightweight Distributed Telescope and Honeypot Platform

The complexity and scale of Internet attacks call for distributed, cooperative observatories capable of monitoring malicious traffic across diverse networks. Holoscope is a lightweight, cloud-native platform designed to simplify the deployment and management of distributed telescope passive and...

lw-cnapp-microservices-iac

Project 2: Microservices with Infrastructure as Code ⚠️ WAR...

The Hidden Dangers of Public Serverless Repositories: An Empirical Security Assessment

Serverless computing has rapidly emerged as a prominent cloud paradigm, enabling developers to focus solely on application logic without the burden of managing servers or underlying infrastructure. Public serverless repositories have become key to accelerating the development of serverless...