cloudsploit

CloudSploit by Aqua - Cloud Security Scans Quick Start Generic $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ npm install $ ./index.js -h Docker $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ docker build . -t cloudsploit:0.0.1 $...

CIS GitLab Benchmark Scanner

CIS GitLab Benchmark Scanner - gitlabcis Background On April 17th 2024, GitLab™ published a blog post introducing its Center for Internet Security® CIS GitLab Benchmark. With the goal to improve the security of the product and offer hardening recommendations to GitLab's customers. You can downloa...

exrex

EXREX Irregular methods for regular expressions. Exrex is a command line tool and python module that generates all - or random - matching strings to a given regular expression and more. It's pure python, without external dependencies. There are regular expressions with infinite matching strings...

OpenHunterAI

OpenHunterAI Your local AI red team. Attacker-style reasoning for web, API, and LLM application security. Quick start · Agent skill · Assessment model · Architecture · Docs · Star history OpenHunterAI brings scope, scan activity, findings, and remediation into one local workspace. Start without a...

JoySafety

JoySafety — Large Model Security Framework 📋 Table of Contents Project Introduction ✨ Features 🚀 Quick Start 📖 User Guide 🏆 Best Practices 🏗️ Architecture Design 🛠️ Development 📄 License 📅 Roadmap Star History new release ✅ Prompt injection detection model fully upgraded : Training system...

chromecookiestealer

Chrome Cookie Stealer and injector Attaches to Chrome using its Remote DevTools protocol and steals/injects/clears/deletes cookies. Heavily inspired by WhiteChocolateMacademiaNut. Cookies are dumped as JSON objects using Chrome's own format. The same format is used for cookies to be loaded. For...

trivy-plugin-aqua

trivy-plugin-aqua Trivy plugin for integration with Aqua Security SaaS platform Usage Trivy's options need to be passed after --. Trivy receives a target directory containing IaC files Set Aqua plugin as Trivy's current default plugin by exporting an environment variable export...

h2t

h2t - HTTP Hardening Tool Description h2t is a simple tool to help sysadmins to hardening their websites. Until now h2t checks the website headers and recommends how to make it better. Dependences Python 3 colorama requests Install $ git clone https://github.com/gildasio/h2t $ cd h2t $ pip instal...

masq

Sit where the model sits. See what it can see. MASQ MASQ is a local security CLI for AI agent stacks. It sits in the same seat the model sits in: it reads MCP tool catalogs, completes the MCP handshake, looks through session logs, and probes local model HTTP ports. Then it prints findings and...

tailsnitch

Tailsnitch A security auditor for Tailscale configurations. Tailsnitch scans your tailnet for 57 misconfigurations, overly permissive access controls, and security best practice violations. Quick Start 1. Set your Tailscale API credentials export TSAPIKEY="tskey-api-..." 2. Run audit tailsnitch 3...

crAPI

crAPI c ompletely r idiculous API crAPI will help you to understand the ten most critical API security risks. crAPI is vulnerable by design, but you'll be able to safely run it to educate/train yourself. crAPI is modern, built on top of a microservices architecture. When time has come to buy your...

CVE-2023-4800

CVE ID: CVE-2023-4800 Vulnerability Type: Sensitive Data Exposure Description: The DoLogin Security plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dashboard widget in versions up to, and including, 3.7. This makes it possible for...

xstream-CVE-2020-26217

xstream-CVE-2020-26217...

REST-Attacker

REST-Attacker REST-Attacker is an automated penetration testing framework for APIs following the REST architecture style. The tool's focus is on streamlining the analysis of generic REST API implementations by completely automating the testing process - including test generation, access control...

selinux-notebook

The SELinux Notebook Introduction The SELinux Notebook is an Open Source book on SELinux, originally created by Richard Haines and donated to the SELinux community. The Notebook's goal is to be the most current and comprehensive book on SELinux, covering the Linux Kernel components, the userspace...

gixy

GIXY Overview Gixy is a tool to analyze Nginx configuration. The main goal of Gixy is to prevent security misconfiguration and automate flaw detection. Currently supported Python versions are 2.7, 3.5, 3.6 and 3.7. Disclaimer: Gixy is well tested only on GNU/Linux, other OSs may have some issues...

Mindmaps

Pentesting Azure Mindmap Get the Global Admin access 💥 with this mindmap for Azure penetration tests. Feel free to pull request with your techniques ! ❤️ Developed by Alexis Danizan Released as open source by Synacktiv 🥷 📖 Resources Useful resources used to build this mindmap, many outstanding...

dorothy

Created by David French @threatpunter at Elastic Security Dorothy is a tool to help security teams test their monitoring and detection capabilities for their Okta environment. Dorothy has several modules to simulate actions that an attacker might take while operating in an Okta environment and...

pcc

PHP Secure Configuration Checker Check current PHP configuration for potential security flaws. Simply access this file from your webserver or run on CLI. Author This software was written by Ben Fuhrmannek, SektionEins GmbH, in an effort to automate php.ini checks and spend more time on cheerful...

graphw00f

Credits to Nick Aleks for the logo! graphw00f - GraphQL Server Fingerprinting Table of Contents How does it work? Detections GraphQL Threat Matrix Prerequisites Installation Configuration Example Usage Fingerprinting GraphQL Detecting & Fingerprinting GraphQL Support & Issues Resources How does i...