legitify

Strengthen the security posture of your source-code management! Detect and remediate misconfigurations, security and compliance issues across all your GitHub and GitLab assets with ease 🔥 by Legit Security. Wonder what Legit Security does? Legit Security is an application security posture...

GPOHound

GPOHound GPOHound is a tool for dumping and analysing Group Policy Objects GPOs extracted from the SYSVOL share. It provides a structured, formalized format to help uncover misconfigurations, insecure settings, and privilege escalation paths in Active Directory environments. The tool integrates...

nerve

Network Exploitation, Reconnaissance & Vulnerability Engine N.E.R.V.E Table of Contents Continuous Security About NERVE What is NERVE Features Prerequisites Installation Deployment Recommendations Installation - Docker Installation - Bare Metal Installation - Multi Node Upgrade Security Usage...

S3Scanner

S3Scanner Features - Usage - Quick Start - Installation - Discuss A tool to find open S3 buckets in AWS or other cloud providers: AWS DigitalOcean DreamHost GCP Linode Scaleway Custom Features ⚡️ Multi-threaded scanning 🔭 Supports many built-in S3 storage providers or custom 🕵️‍♀️ Scans all...

hammer

Overview Dow Jones Hammer is a multi-account cloud security tool for AWS. It identifies misconfigurations and insecure data exposures within most popular AWS resources, across all regions and accounts. It has near real-time reporting capabilities e.g. JIRA, Slack to provide quick feedback to...

gixy

GIXY Overview Gixy is a tool to analyze Nginx configuration. The main goal of Gixy is to prevent security misconfiguration and automate flaw detection. Currently supported Python versions are 2.7, 3.5, 3.6 and 3.7. Disclaimer: Gixy is well tested only on GNU/Linux, other OSs may have some issues...

linuxprivchecker

Linuxprivchecker.py A Linux Privilege Escalation Check Script Orginal Author: Mike Czumak Tv3rn1x -- @SecuritySift Current Maintainer: Michael Contino @Sleventyeleven This script is intended to be executed locally on a Linux box to enumerate basic system info and search for common privilege...

DIAL

DIAL Workloads on cloud provide equal opportunities for hackers as much as they do for internal teams. Cloud-native companies are open to attacks from both outside forces and from within. With ever growing risk of a security breach and cloud misconfiguration being one of the most common factor of...

KubeLight

OWASP KubeLight - Kubernetes Security Scanner Scan your Kubernetes Cluster for Security & Compliance 1. Scan K8s clusters to detect Misconfiguration. 2. Lightweight, Pure python, fast, multithreaded tool. 3. NoSQL Query Engine. 4. Realtime alerts on Slack 5. SBOM generation and Image Vulnerabilit...

nerva

Nerva Nerva: CLI de fingerprinting de servicios rápido Características • Instalación • Inicio rápido • Uso • Protocolos • Biblioteca • Casos de uso • Solución de problemas Fingerprinting de servicios de alto rendimiento escrito en Go. Identifica más de 170 protocolos de red en los transportes TCP...

Adalanche

Adalanche Código Abierto Visualizador y Explorador de Grafos de Ataque Adalanche ofrece resultados instantáneos, mostrándole qué permisos tienen los usuarios y grupos en un Directorio Activo. Es útil para visualizar y explorar quién puede tomar el control de cuentas, máquinas o el dominio complet...

cloudmapper

CloudMapper Nota : La funcionalidad de Visualización de Red comando prepare ya no se mantiene. CloudMapper te ayuda a analizar tus entornos de Amazon Web Services AWS. El propósito original era generar diagramas de red y mostrarlos en tu navegador funcionalidad ya no mantenida. Ahora contiene muc...

audit_couchdb

Auditoría de CouchDB: La evaluación de seguridad simple y clara de CouchDB Audit CouchDB es una herramienta simple con un mensaje poderoso. Dada una URL de Apache CouchDB, te dirá todo lo que siempre quisiste saber sobre su seguridad. Objetivo Audit CouchDB realizará las siguientes acciones: 1...

electronegativity

Electronegativity ⚠️ Ya no mantenemos activamente este proyecto ⚠️ ¿Qué es Electronegativity? Electronegativity es una herramienta para identificar configuraciones incorrectas y anti-patrones de seguridad en aplicaciones basadas en Electron. Aprovecha el análisis de AST y DOM para buscar...

dbdtct

dbgdtct Desctiption dbgdtct is a Python-based tool designed to help you detect if a web application is deployed in debug mode—a critical misconfiguration that can expose sensitive information and increase the risk of exploitation in production environments. Installation git clone...

nginxpwner

Nginxpwner Nginxpwner es una herramienta simple para buscar configuraciones incorrectas y vulnerabilidades comunes de Nginx. Instalación: cd /opt git clone https://github.com/stark0de/nginxpwner cd nginxpwner chmod +x install.sh ./install.sh Instalar usando Docker git clone...

openshield

Open source Cloud Security Posture Management CSPM for Azure detect misconfigurations, map them to CIS / NIST / ISO 27001 / SOC 2, remediate with one command, and identify cryptographic assets requiring quantum-safe migration. Website · Documentation · Roadmap · Changelog · Security Policy ·...

Nuclei_Templates

🎯 Nuclei Templates A large personal collection of 50,000+...

Gixy-Next v0.7.1

Gixy-Next: NGINX Configuration Security Scanner for Security Audits Overview Gixy-Next Gixy is an open-source NGINX configuration security scanner and hardening tool that statically analyzes your nginx.conf to detect security misconfigurations, hardening gaps, and common performance pitfalls befo...

ImCurvin

ImCurvin' ImCurvin 是一款开源 Web 安全审计与渗透测试工具，作为概念验证（PoC）设计，用于自动化检测环境错误配置、追踪暴露的配置蓝图，并探测后端漏洞。 关于 ImCurvin 的详细信息，请访问 https://github.com/Skokoo/ImCurvin/blob/main/Mode.md 本项目完全在智能手机上使用 Termux 进行工程开发与调试。 截图。 您可以查看界面与流程的完整详解。请参阅截图画廊。 安装与使用方法 项目正在修复中，请暂时不要使用，我正在修复它 从 GitHub Releases 页面 下载并安装最新的 .deb 包：...