BloodHound
specterops/bloodhoundSix Degrees of Domain Admin
defensive-toolsprivilege-escalationreconnaissance+4
Tools for managing user identities, authentication, authorization, and access controls within systems and networks.
specterops/bloodhoundSix Degrees of Domain Admin
vectra-ai-research/maad-afMAAD Attack Framework - An attack tool for simple, fast & effective security testing of M365 & Entra ID (Azure AD).
crowdstrike/crtAudits Azure AD and Exchange Online configurations for hard-to-find permissions, federation trusts, mail forwarding rules, and delegated access to…
volkandindar/agarthaA Burp Suite extension for identifying injection flaws (LFI, RCE, SQLi), authentication/authorization issues, and HTTP 403 access violations. It…
bishopfox/iam-vulnerableUse Terraform to create your own vulnerable by design AWS IAM privilege escalation playground.
lightspin-tech/red-shadowScans AWS IAM configurations for shadow admins by detecting misconfigured deny policies that fail to restrict user actions on groups, enabling…
cyberark/kubiscanA tool to scan Kubernetes cluster for risky permissions
umputun/reproxyLightweight edge HTTP(S) server and reverse proxy with automatic SSL, Docker/Consul discovery, per-route authentication, rate limiting, and…
gitlab-org/ruby/gems/declarative-policyDeclarative authorization library with a DSL for writing policy rules, conditions, and caching. Enables scalable, DRY permission management for Ruby…
eveo7/aa-discord-auditReconciliation audit for Alliance Auth's Discord integration: finds guild members holding AA-managed roles that Auth never granted and strips or…
kit-lang/packages/kit-policyA flexible, composable authorization framework for Kit (inspired by Action Policy)
kit-lang/packages/kit-oauthOAuth 2.0 client library for Kit applications supporting authorization code, PKCE, client credentials, and refresh token flows with built-in provider…
schroeder-sys/pantheon-souveraineteInfrastructure cloud modulaire, redondante et 100% souveraine pour s'affranchir des GAFAM. Guides techniques, architecture Zero-Trust et chiffrement…
cosignet/sdkThin TypeScript + zero-dep Python client and recipes to gate high-risk actions behind a payload-bound passkey approval.
authelia/autheliaThe Single Sign-On Multi-Factor portal for web apps, now OpenID Certified™
elastic/silhouetteKeep it secret, keep it safe
azuread/azure-ad-incident-response-powershell-moduleThe Azure Active Directory Incident Response PowerShell module provides a number of tools, developed by the Azure Active Directory Product Group in…