legitify

增强您的源代码管理安全态势！ 检测并修复所有GitHub和GitLab资产中的错误配置、安全与合规问题 🔥 由 Legit Security 提供。 想知道 Legit Security 是做什么的吗？ Legit Security 是一个应用程序安全态势管理（ASPM）和软件供应链安全解决方案。 更多信息请查看 对比表 https://user-images.githubusercontent.com/107790206/210602039-2d022692-87ea-4005-b9c6-f091158de3ce.mov 安装 可以通过多种方式安装： 在 macOS（或 Linux）上...

red-kube

Red Team K8S Adversary Emulation Based on kubectl Red Kube is a collection of kubectl commands written to evaluate the security posture of Kubernetes clusters from the attacker's perspective. The commands are either passive for data collection and information disclosure or active for performing...

ElectricEye

ElectricEye ElectricEye 是一款多云、多 SaaS 的 Python CLI 工具，用于资产管理、安全态势管理和攻击面监控，支持数百种服务和评估，以强化您的 CSP 和 SaaS 环境，控制措施映射至超过 20 个行业、监管和最佳实践控制框架。...

drs-malware-scan

Perform malware scan analysis of on-prem servers using AWS services Challenges with on-premises malware detection It can be difficult for security teams to continuously monitor all on-premises servers due to budget and resource constraints. Signature-based antivirus alone is insufficient as moder...

opencspm

OpenCSPM Open Cloud Security Posture Management, OpenCSPM, es una plataforma de código abierto para obtener una visión más profunda de la configuración y los metadatos de su nube, ayudando a comprender y reducir el riesgo a lo largo del tiempo. ¿Para quién es OpenCSPM? Equipos de seguridad que...

aws-recon

AWS Recon 一款用 Ruby 编写的多线程 AWS 安全清单收集工具。 该工具旨在高效收集大量 AWS 资源属性与元数据。它目标是收集与 AWS 环境安全配置及状态相关的几乎所有内容。 现有工具（例如 AWS Config）虽然能执行某些资源收集，但在覆盖范围和特异性上不足以准确衡量安全状态（例如详细的资源属性数据、完整解析的策略文档以及嵌套的资源关系）。 AWS Recon 通过利用自动重试（无论是网络可靠性问题还是 API 限流）、自动分页处理大型响应（每次 API 调用超过 100 个资源）以及多线程并行请求来加速收集，从而处理大型账户的收集工作。 项目目标...

honeypot

🍯 Proyecto de Investigación de Honeypots ¿Qué es un Honeypot? Un honeypot es un sistema informático o red que se deja intencionalmente vulnerable a los hackers para detectar, analizar y responder a posibles amenazas de seguridad. El objetivo de un honeypot es recopilar información sobre las...

internal-security-detect

Internal Security Detection via Safebase Los portales SafeBase expuestos atienden a dos públicos a la vez: prospectos que necesitan pruebas de tu postura de seguridad e investigadores de seguridad equipos azul y rojo. Cada marca verde revela un control que supuestamente existe hoy; cada marca...

cloud-doctor

cloud-doctor 一条命令即可评估您的整个云账户——错误配置、缺失的可观测性以及安全态势，并按优先级列出前五项需要修复的问题。 将它指向 AWS、Cloudflare、Vercel、Supabase、Render、Fly.io 或 Railway，它就会返回一个评分、哪些地方出了问题以及每个问题的修复方案——内容自包含，可直接交给 Agent 处理。 快速开始 root@kitploit: npx cloud-doctor https://github.com/user-attachments/assets/60b610ab-7aee-4c3a-8d9e-83f045c8cc56...

GO-2026-5381 vulnerabilities

Vulnerabilities for packages: opentelemetry-operator, opentelemetry-collector-contrib, minio-operator, istio, amazon-cloudwatch-agent-operator, mcp-grafana, minio, loki, telegraf, tempo, certificate-transparency, grafana, jaeger, k8sgpt, splunk-otel-collector, aws-otel-collector, datadog-agent,...

Qualys Expands Serverless Security with Vulnerability Scanning for AWS Lambda

Key Takeaways Qualys now delivers automated AWS Lambda vulnerability scanning , extending serverless security beyond posture checks CSPM into workload-level risk visibility. CSPM alone only catches misconfigurations excessive permissions, exposure, logging, encryption — it can't detect vulnerable...

Revive Adserver 6.0.6 Security Auditor

This script is a defensive security auditing utility designed to identify exposed services, review configuration weaknesses, and collect security posture information from a Revive Adserver deployment without performing direct exploitation...

PT-2026-45725

Name of the Vulnerable Software and Affected Versions Apache Kafka affected versions not specified Description An improper authorization issue exists in the 'CONSUMER GROUP DESCRIBE' 69 API. The implementation validates the DESCRIBE operation on the GROUP resource, which contradicts the READ...

Cross-Vendor Sola ISPM Benchmark: Evaluating Agentic AI for Federated Identity Security Reasoning

The rapid proliferation of multi-cloud and SaaS platforms has transformed Identity Security Posture Management ISPM into a fundamentally cross-vendor challenge: critical misconfigurations and privilege escalation paths increasingly span multiple identity providers, infrastructure layers, and...

Lessons from Penetration Tests on Large-Scale Agent Systems

As AI systems gain increasing autonomy and execution capability, the number of discovered security vulnerabilities continues to rise. However, many of these vulnerabilities are not fundamentally novel, but instead reflect recurring classes of weaknesses long observed in prior computing systems...

CSPM vs Exposure Management: Key Differences

Your CSPM tool flags 4,000 misconfigurations every month. Your team remediates 400. Attackers only need one. That gap between what your posture tools report and what actually puts your organization at risk is exactly where exposure management picks up. Book a demo to see how Hive Pro's Uni5 Xposu...

On Microsoft’s Lousy Cloud Security

ProPublica has a scoop: In late 2024, the federal government's cybersecurity evaluators rendered a troubling verdict on one of Microsoft's biggest cloud computing offerings. The tech giant's "lack of proper detailed security documentation" left reviewers with a "lack of confidence in assessing th...

A Guide to Continuous Monitoring for Cyber Threats

A Guide to Continuous Monitoring for Cyber Threats Most security teams still rely on periodic vulnerability scans and annual penetration tests to assess their risk. The problem? Attackers do not work on your schedule. Between those snapshots, new vulnerabilities emerge, configurations drift, and...

Can the Security Platform Finally Deliver for the Mid-Market?

Mid-market organizations are constantly striving to achieve security levels on a par with their enterprise peers. With heightened awareness of supply chain attacks, your customers and business partners are defining the security level you must meet. What if you could be the enabler for your...

A CISO’s Guide to Threat Management Platforms

Attackers don’t see your organization as a list of CVEs. They see a web of interconnected assets, looking for a single weak link that will give them a path to your most valuable data. A traditional vulnerability scanner might miss these dangerous connections, but a threat management platform is...