#1Configuration auditing, compliance scanning, hardening benchmarks, and drift detection tools.
Kitploit recommended
vulnz/sastFree offline SAST engine for CI/CD: AST and cross-file taint analysis, secret detection with live validation, SCA/CVE, IaC misconfiguration, and…
aquasecurity/kube-hunterHunt for security weaknesses in Kubernetes clusters
bunkerity/bunkerweb🛡️ Open-source and cloud-native Web Application Firewall (WAF)
checkmarx/kicsStatic analysis scanner for infrastructure-as-code that detects security vulnerabilities, compliance violations, and misconfigurations across…
open-policy-agent/opaDeclarative policy engine that enables authorization and policy enforcement across services, Kubernetes, Terraform, Docker, and APIs using the Rego…
hahwul/s3reverseThe format of various s3 buckets is convert in one format. for bugbounty and security testing.
g4bri-3l3/hostbadgerWindows host hardening auditor and remediation tool in PowerShell: CIS, DISA STIG, Essential Eight checks, reversible fixes, optional AI analysis
complianceascode/contentGenerates SCAP, Ansible, Bash, and CEL security content for compliance evaluation and automated hardening across Linux hosts, containers, and…
open-policy-agent/conftestWrite tests against structured configuration data using the Open Policy Agent Rego query language
jsitech/jshielderHardening Script for Linux Servers/ Secure LAMP-LEMP Deployer/ CIS Benchmark
silentchainai/silentchainAI-powered vulnerability scanner extension for Burp Suite with multi-provider support (Ollama, OpenAI, Claude, Gemini)
owasp/openshieldOpen source CSPM for Azure - scan for misconfigurations and quantum-unsafe cryptography, map findings to CIS/NIST/ISO27001/SOC2, and fix them with…
ekitji/siemCurated SIEM queries and techniques for offensive discovery of Windows privilege escalation, misconfigured ACLs, services, scheduled tasks, and…
jp1337/easywallWeb interface for the nftables firewall on Linux, written in Go. The apply undoes itself after 120 seconds unless you confirm it — you cannot lock…
hackwarts12/escepcionPassive AD CS auditor detecting ESC1–ESC16 and Shadow Credentials via read-only LDAP/ACL/registry checks, with prioritized remediation and SIEM-ready…
sorami-consulting-au/ai-kubernetes-helm-chart-securityEvidence and data for the Sorami technical report on security defaults of 15 AI serving, vector database and MCP Helm charts on Kubernetes.
sagehack/cloud-busterA Cloudflare resolver that works
zizmorcore/zizmorStatic analysis tool for CI/CD systems that detects and fixes security issues in GitHub Actions, Dependabot, and pre-commit configurations, including…
