lsoumille

PayloadsAllTheThings

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

nuclei

Fast and customizable vulnerability scanner based on simple YAML based DSL.

zaproxy

The ZAP core project

semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

sigma

Main Sigma Rule Repository

AutoRecon

AutoRecon is a multi-threaded network reconnaissance tool which performs automated enumeration of services.

mosint

An automated e-mail OSINT tool

h8mail

Email OSINT & Password breach hunting tool, locally or using premium services. Supports chasing down related email

Nettacker

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management

31-days-of-API-Security-Tips

This challenge is Inon Shkedy's 31 days API Security Tips.

Kansa

A Powershell incident response framework

trivy-operator

Kubernetes-native security toolkit

secDevLabs

A laboratory for learning secure web and mobile development in a practical manner.

DevSecOpsGuideline

The OWASP DevSecOps Guideline can help us to embedding security as a part of the development pipeline.

terraform-azurerm-caf-enterprise-scale

Azure landing zones Terraform module

FalconFriday

Hunting queries and detections

opensquat

The openSquat is an open-source tool for detecting domain look-alikes by searching for newly registered domains that might be impersonating legit domains and brands.

PatrowlManager

PatrOwl - Open Source, Smart and Scalable Security Operations Orchestration Platform

Ransomchats

capital

A built-to-be-vulnerable API application based on the OWASP top 10 API vulnerabilities. Use c{api}tal to learn, train and exploit API Security vulnerabilities within your own API Security CTF.

wordlists

Various wordlists FR & EN - Cracking French passwords

mercator

Mapping the information system / Cartographie du système d'information

TierZeroTable

Table of AD and Azure assets and whether they belong to Tier Zero

hedgehog-tools

security-analytics

Security Analytics enables users for detecting security threats on their security event log data. It will also allow them to modify/tailor the pre-packaged solution.

openwec

An implementation of a Windows Event Collector server running on GNU/Linux.

py-agua-iot

py-agua-iot provides controlling heating devices connected via the IOT Agua platform of Micronova

DumbTesting

fail2ban-apache

Apache fail2ban actions