hoppr-cop

Hoppr-Cop For Policing Your SBOM Vulnerabilities Hoppr Cop is a cli and python library that generates high quality vulnerability information from a cyclone-dx Software Bill of Materials SBOM by aggregating data from multiple vulnerability databases. This project is offered as part of the hoppr...

minimal

Small, hardened container images, free and MIT-licensed. Built from source with Chainguard's apko and Wolfi packages, rebuilt every six hours. Every image is cosign-signed, ships an SPDX SBOM attestation, and carries SLSA Level 3 build provenance. You can verify all of it without an account. 🌐...

Dependency Scanning

Component for Dependency and License Scanning This component generates a CycloneDX Software Bill of Materials, which is used by GitLab to identify a project's dependencies, and their licenses. This CycloneDX Software Bill of Materials is compatible with the GitLab taxonomy. Additionally, this...

puncia

PantheraP.uncia Official CLI utility for Subdomain Center & Exploit Observer Puncia is the official command-line client for two A.R.P. Syndicate intelligence APIs — point it at a domain, a brand, or a vulnerability ID and get structured JSON back in seconds, no browser required: 🕸️ Subdomain Cente...

osv.dev

Documentation Comprehensive documentation is available here. API documentation is available here. Data Dump We have data dumps available from a GCS bucket at gs://osv-vulnerabilities. For more information check out our documentation. Viewing the web UI An instance of OSV's web UI is deployed at...

sbomlyze

sbomlyze git diff for your SBOM. Compare two Software Bills of Materials and see what changed between builds, versions, and releases. sbomlyze compares component hashes, not only version strings. When an attacker swaps a package without bumping its version, sbomlyze flags it. Generators and...

dependency-track

OWASP Dependency-Track Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials SBO...

trivy-plugin-attest

trivy-plugin-attest Publicar atestación de SBOM Instalación root@kitploit: $ trivy plugin install github.com/aquasecurity/trivy-plugin-attest Uso root@kitploit: A Trivy plugin that publish SBOM attestation Usage: attest flags Examples: trivy attest --type PREDICATETYPE --predicate PREDICATEPATH...

dockle

Dockle - Container Image Linter for Security, Helping build the Best-Practice Docker Image, Easy to start Dockle helps you: 1. Build Best Practice Docker images 2. Build secure Docker images Checkpoints includes CIS Benchmarks root@kitploit: $ brew untap goodwithtech/dockle who use 0.1.16 or olde...

Startup-SBOM

Startup-SBOM Startup-SBOM is a universal utility designed to provide an insider view of which packages are executed during the startup of a Linux system or within a Docker container. By analyzing service files, init scripts, and container entrypoints, the tool maps every booting process to its...

grepmarx

Grepmarx - Application Security Platform Grepmarx is a web application providing a single platform to quickly understand, analyze and identify vulnerabilities in possibly large and unknown code bases. Features SAST Static Analysis Security Testing capabilities: Multiple languages support: C/C++, ...

bomber

bomber 是一款扫描 SBOM 以发现安全漏洞的应用程序。 概述 你向某个供应商索要其一个闭源产品的软件物料清单（SBOM），他们给了你一个 JSON 文件……然后呢？ 你首先要做的事情就是查看 SBOM 中列出的组件是否存在安全漏洞，以及这些组件拥有何种许可证。这将帮助你识别使用该产品可能承担的风险。 查找 SBOM 中标识的组件的安全漏洞和许可证信息，正是 bomber 的用途。bomber 可以读取任何基于 JSON 或 XML 的 CycloneDX 格式，或者 JSON 格式的 SPDX 或 Syft 格式的 SBOM，并能很快告诉你是否存在漏洞。 目录 开源 vs 闭源 ...

SBOM-VEX-Taint-Analysis

SBOM → VEX Agent Genere automáticamente documentos CycloneDX VEX firmados a partir de SBOM utilizando un pipeline de IA multiagente seguro, construido de acuerdo con las directrices del proyecto OWASP GenAI Security. El Problema Generar un SBOM revela cientos de CVEs. En la práctica, más del 90% ...

CTWall

CTWall - ChainThreatWall GitHub release --- As more teams move to virtualized development environments to reduce software supply-chain risk, one challenge remains: malicious dependencies can still slip through and reach production. CTWall ChainThreatWall platform helps Security, DevOps, and Produ...

syft

Syft Una herramienta CLI y una biblioteca de Go para generar una Lista de Materiales de Software SBOM a partir de imágenes de contenedores y sistemas de archivos. Excepcional para la detección de vulnerabilidades cuando se usa con un escáner comoGrype...

KubeLight

OWASP KubeLight - Escáner de Seguridad para Kubernetes Escanea tu clúster de Kubernetes en busca de seguridad y cumplimiento 1. Escanea clústeres de K8s para detectar configuraciones incorrectas. 2. Ligero, Python puro, rápido y con múltiples hilos. 3. Motor de consultas NoSQL. 4. Alertas en tiem...

emba

EMBA 嵌入式设备固件安全分析器 EMBA 被设计为中央固件分析与 SBOM 工具，适用于渗透测试人员、产品安全团队、开发者和产品经理。它支持从 固件提取 、 静态分析 、通过仿真进行 动态分析 ，到构建 SBOM 以及最终生成基于 Web 的漏洞报告的完整安全分析流程。 EMBA 自动发现固件中可能存在的薄弱点和漏洞，例如不安全的二进制文件、过时或陈旧的软件组件、可能存在漏洞的脚本，以及硬编码密码。 EMBA 是一个命令行工具，并能够生成易于使用的 Web 报告以供进一步分析。 EMBA 帮助渗透测试人员、产品安全团队和开发者识别固件镜像中的薄弱点和漏洞。 EMBA...

jsonorg-fp1

Falso positivo de json.org CVE-2022-45688 El proyecto contiene una dependencia de json.org con CVE-2022-45688, pero no invoca la clase vulnerable. Por lo tanto, la vulnerabilidad no puede explotarse para un ataque DoS. Los análisis de composición de software basados en metadatos producirán un fal...

craready-test-java-vulns

craready-test-java-vulns CRAReady SBOM/CVE scanner test fixture — DO NOT USE IN PRODUCTION This repository contains intentionally vulnerable Java Maven dependencies for testing the CRAReady SBOM generation and vulnerability detection pipeline. Includes some of the most significant CVEs of recent...

Supply-Chain

Software Supply Chain Security A comprehensive three-book series on software supply chain security, covering threats, defenses, and governance. This open-source manuscript provides security professionals, developers, and organizational leaders with practical guidance for securing modern software...