Latest Updates

zizmor

DevSecOps & Pipeline Security

A static analysis tool for GitHub Actions that identifies common security issues in CI/CD setups.

WebVM

Infrastructure Security & Hardening

Virtual Machine for the Web

Vuls

Vulnerability Management

Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices

Velociraptor

Incident Response & Forensics

A powerful tool for endpoint visibility and incident response, leveraging the Velociraptor Query Language (VQL) for customizable data collection.

Trivy

Vulnerability Management

A security scanning solution for cloud and containerized environments.

Timesketch

Incident Response & Forensics

Collaborative forensic timeline analysis

ThreatMapper

Threat Detection & Response

Open Source Cloud Native Application Protection Platform (CNAPP)

TheHive

Archived

Incident Response & Forensics

A scalable, open-source security incident response platform that integrates case management, task assignment, and collaboration tools.

tfsec

DevSecOps & Pipeline Security

A security scanner for Terraform configurations that identifies potential vulnerabilities through static analysis.

TerraGoat

DevSecOps & Pipeline Security

TerraGoat is a Terraform repository designed to demonstrate common configuration errors in cloud environments.

Terraform Provider for Remote Code Execution

Configuration & Change Management

This terraform provider can be used to get remote code execution by injecting a dummy resource in a writeable state file. It highlights the risks associated with Terraform state files.

Syft

Supply Chain Security

A CLI tool and Go library for generating Software Bill of Materials (SBOMs) from container images and filesystems.

Stratus Red Team

Threat Detection & Response

Granular, Actionable Adversary Emulation for the Cloud

SOPS

Secrets Management

Simple and flexible tool for managing secrets

Sn1per

Penetration Testing Tools

Attack Surface Management Platform

Snyk CLI

Vulnerability Management

Snyk CLI scans and monitors your projects for security vulnerabilities.

Scout Suite

Security Assessment & Audit

Multi-Cloud Security Auditing Tool

S3Scanner

Penetration Testing Tools

Scan for misconfigured S3 buckets across S3-compatible APIs!

sadcloud

Security Training & Simulation

A tool for standing up (and tearing down!) purposefully insecure cloud infrastructure

Prowler

Security Assessment & Audit

Prowler is an Open Cloud Security tool for AWS, Azure, GCP and Kubernetes.