w32

personal-security-checklist

🔒 A compiled checklist of 300+ tips for protecting digital security and privacy in 2024

katana

A next-generation crawling and spidering framework.

prowler

Prowler is an Open Source Security tool for AWS, Azure, GCP and Kubernetes to do security assessments, audits, incident response, compliance, continuous monitoring, hardening and forensics readiness. Includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS and more

fq

jq for binary formats - tool, language and decoders for working with binary and text formats

semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

falco

Cloud Native Runtime Security

tfsec

Tfsec is now part of Trivy

flux2

Open and extensible continuous delivery solution for Kubernetes. Powered by GitOps Toolkit.

RedEye

RedEye is a visual analytic tool supporting Red & Blue Team operations

nexfil

OSINT tool for finding profiles by username

log4shell

Operational information regarding the log4shell vulnerabilities in the Log4j logging library.

talisman

Using a pre-commit hook, Talisman validates the outgoing changeset for things that look suspicious — such as tokens, passwords, and private keys.

log4jscanner

A log4j vulnerability filesystem scanner and Go package for analyzing JAR files.

ScubaGear

Automation to assess the state of your M365 tenant against CISA's baselines

Damn-Vulnerable-GraphQL-Application

Damn Vulnerable GraphQL Application is an intentionally vulnerable GraphQL service implementation designed for learning about and practising GraphQL Security.

Goby

Attack surface mapping

CrossLinked

LinkedIn enumeration tool to extract valid employee names from an organization through search engine scraping

log4j-affected-db

A community sourced list of log4j-affected software

legitify

Detect and remediate misconfigurations and security risks across all your GitHub and GitLab assets

DSP

A Microservices-based framework for the study of Network Security and Penetration Test techniques

UltimateWDACBypassList

A centralized resource for previously documented WDAC bypass techniques

iam-vulnerable

Use Terraform to create your own vulnerable by design AWS IAM privilege escalation playground.

NginxDay

Nginx 18.1 04/09/22 zero-day repo

graphql-cop

Security Auditor Utility for GraphQL APIs

kube_security_lab

log4j-sniffer

A tool that scans archives to check for vulnerable log4j versions

RussiaDNSLeak

Summary and archives of leaked Russian TLD DNS data

snowcat

a tool to audit the istio service mesh

terraform-goof

A demo repo showcasing Snyk's IAC offering for terraform

qconnector