clawguard

🦞 ClawGuard v3 Enterprise AI Agent Security Toolkit - SKILL.md Driven Active Defense Core Concept The core defense of ClawGuard v3 is not in the code, but in SKILL.md! Each module's SKILL.md itself is a complete defense guide: Tells the Agent when to trigger Guides the Agent how to detect Provide...

SOC_287

SOC287 - Lectura Arbitraria de Archivos en Checkpoint Security Gateway CVE-2024-24919 Resumen Este repositorio contiene un recorrido detallado de la vulnerabilidad CVE-2024-24919 que afecta a Check Point Security Gateways. La vulnerabilidad permite la lectura arbitraria de archivos, exponiendo...

gh-safe-repo

gh-safe-repo 创建自动应用安全默认设置的GitHub仓库。用一个命令取代创建后需要五分钟检查的设置清单。 gh-safe-repo create root@kitploit: 分支保护、不可变标签、Dependabot、受限的 Actions 权限、带有推送保护的密钥扫描，以及禁用的 Wiki 和 Projects——所有这些在你编写第一行代码之前就已配置完毕。 gh-safe-repo 正处于重度开发阶段。它对于使用安全默认值创建新仓库的场景表现出色。我正在努力完善 CLI 选项，以更好地符合用户预期。在发展到发布版本并稳定 CI/CD 之前，预计会有破坏性变更。✌️ ---...

crAPI

crAPI 完全荒谬的API crAPI 将帮助你理解十大最关键API安全风险。crAPI是故意存在漏洞的，但你可以安全地运行它来教育/训练自己。 crAPI是现代化的，基于微服务架构构建。当购买你的第一辆汽车时，只需注册一个账户并开始你的旅程。要了解更多关于crAPI的信息，请查看crAPI概述。 快速开始指南 应用程序工作流（正常流程） 在设置crAPI后，建议遵循预期的用户工作流，以了解应用程序在尝试任何安全挑战之前应该如何工作。 -应用程序工作流（正常流程） Docker 和 docker compose 你的主机系统需要安装并运行 Docker 和 docker...

CaA

信息洞察，智探千方！ 第一作者： EvilChen 第二作者： 0chencc（米斯特安全团队） 第三作者：MingXi（米斯特安全团队） README 版本: English | 简体中文 项目介绍 CaA 是一款网络安全（漏洞挖掘）领域下的辅助型项目，主要用于分析、拆解HTTP协议报文，提取HTTP协议报文中的参数、路径、文件、参数值等信息，并统计出现的频次，帮助用户构建出具有实战应用价值的Fuzzing字典。除此之外CaA可以生成各类HTTP请求提供给BurpSuite Intruder用于Fuzzing工作。 CaA 的设计思想来源于Web...

maldev-for-dummies

Malware Development for Dummies In the age of EDR, red team operators cannot get away with using pre-compiled payloads anymore. As such, malware development is becoming a vital skill for any operator. Getting started with maldev may seem daunting, but is actually very easy. This workshop will sho...

prowler

Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security...

prowler

Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security...

zizmor

🌈 zizmor zizmor is a static analysis tool for CI/CD systems. It can find and fix security issues in common CI/CD setups, including GitHub Actions, Dependabot, and pre-commit. Some of the things zizmor finds:...

bitcoder-v2-research

Investigación de BitCoder-v2 Organización: Bytepro AI Estado: Investigación activa — repositorio privado Objetivo: arXiv Q3 2026 + ARC Prize Paper Track nov 2026 Objetivo de la investigación Documentar empíricamente que el techo de prompt único observado en el razonamiento matemático SAIR,...

sigma-ai

AgentShield Sigma 规则 本仓库是什么？ 本仓库包含检测规则，用于识别 AI 智能体何时受到攻击或被操纵。可以将其视为一个“威胁特征”库——每条规则描述一种模式，当与智能体的日志数据匹配时，表明可能发生了可疑事件。 AgentShield 是一个面向 AI 智能体的开源安全层。它实时监控智能体行为，并利用这些 Sigma 规则在对抗性攻击造成危害之前检测出提示注入、数据窃取、工具投毒和权限提升等攻击。 什么是 Sigma 规则？ Sigma 是网络安全行业用于编写检测规则的开放标准。如果把防病毒特征码理解为“这个文件是恶意的”，那么 Sigma...

CVE-2021-2394

CVE-2021-2394...

Recon-Scan

Recon-Scan ReconScan is a open-source passive recon scanner with a FastAPI backend, async worker pipeline, and a single-page frontend. You can check the deployed site at https://recon-scan.vercel.app/ The point is fast signal: run a scan, get module-by-module findings, and get an AI summary that...

packj

Packj flags malicious/risky open-source packages Packj pronounced package is a tool to help to mitigate software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and...

CVE-2019-14287

CVE-2019-14287...

recox

Recox v2.0 RecoX is an incredibly versatile and powerful tool that is specifically designed to aid in the identification and classification of vulnerabilities within web applications. The script is able to detect vulnerabilities that are not typically included in the OWASP top ten vulnerabilities...

CVEs

CVEs This repository contains publicly disclosed vulnerabilities reported during my security research activities. Notes The repository may include: Technical write-ups Vulnerability details References Security analyses Additional research related to published disclosures Research Interests...

Security-Detections-MCP

Security Detections MCP An MCP Model Context Protocol server that lets LLMs query a unified database of Sigma , Splunk ESCU , Elastic , KQL , Sublime , and CrowdStrike CQL security detection rules. New here? Start with theSetup Guide -- covers macOS, Windows WSL & native, and Linux step by step...

waf-bypass

WAF Bypass Tool WAF Bypass Tool is an open source tool to analyze the security of any WAF for False Positives and False Negatives using predefined and customizable payloads. Check your WAF before an attacker does. WAF Bypass Tool is developed by Nemesida WAF team with the participation of...

assetfinder

assetfinder Find domains and subdomains potentially related to a given domain. Install If you have Go installed and configured i.e. with $GOPATH/bin in your $PATH: root@kitploit: go get -u github.com/tomnomnom/assetfinder Otherwise download a release for your platform. To make it easier to execut...