#1Configuration auditing, compliance scanning, hardening benchmarks, and drift detection tools.
Kitploit recommended
prowler-cloud/prowlerProwler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.…
projectdiscovery/nucleiFast YAML-based vulnerability scanner with template-driven detection engine for automated security testing across web apps, APIs, networks, DNS, and…
kyverno/kyvernoEnforce security and compliance on Kubernetes clusters via admission controls, resource mutation, background scans, and container image signature…
kubescape/kubescapeOpen-source Kubernetes security platform scanning clusters, manifests, and images for misconfigurations, vulnerabilities, and compliance against NSA,…
aquasecurity/trivyFind vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
snyk/cliSnyk CLI scans and monitors your projects for security vulnerabilities.
cisofy/lynisAgentless security auditing tool for Linux, macOS, and UNIX systems. Performs in-depth scans for vulnerabilities, configuration issues, and…
nightwatchcybersecurity/truegazeStatic analysis tool for Android/iOS apps focusing on security issues outside the source code
proviesec/google-dorksUseful Google Dorks for WebSecurity and Bug Bounty
firefart/stunnerTest and exploit STUN/TURN servers for misconfigurations, enabling internal network pivoting via SOCKS proxy, memory leak attacks, and internal port…
alessandroz/berootPrivilege Escalation Project - Windows / Linux / Mac
bridgecrewio/checkovStatic analysis tool for infrastructure as code that detects cloud misconfigurations, vulnerabilities, and secrets across Terraform, Kubernetes,…
cloud-custodian/cloud-custodianRules engine for cloud security, cost optimization, and governance, DSL in yaml for policies to query, filter, and take actions on resources
trailofbits/semgrep-rulesCollection of Semgrep rules for static code analysis, detecting security vulnerabilities, and enforcing secure coding practices across multiple…
marcin-wolak/simplermidiscovererSimple JMX RMI scanning tool
ye-ze-yu/epireal-benchRed-teaming benchmark and black-box attack framework for evaluating visual misinformation risks in commercial image generators, with 10k false-claim…
gopasteverything/gpewebdefenderLightweight web-attack monitor. One Go binary + SQLite. Not OSSEC, not a WAF.
mondoohq/cnspecAn open source, cloud-native security to protect everything from build to runtime
