Misconfiguration

tenable/terrascan

Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.

netflix/security_monkey

Security Monkey monitors AWS, GCP, OpenStack, and GitHub orgs for assets and their changes over time.

feeicn/cobra

Source Code Security Audit (源代码安全审计)

spiderlabs/owasp-modsecurity-crs

OWASP ModSecurity Core Rule Set (CRS) Project (Official Repository)

praetorian-inc/gokart

A static analysis tool for securing Go code

shopify/kubeaudit

kubeaudit helps you audit your Kubernetes clusters against common security controls

nccgroup/scout2

Security auditing tool for AWS environments

stark0de/nginxpwner

Nginxpwner is a simple tool to look for common Nginx misconfigurations and vulnerabilities.

openclarity/openclarity

OpenClarity is an open source platform built to enhance security and observability of cloud native applications and infrastructure

woj-ciech/leaklooker

Find open databases - Powered by Binaryedge.io

fit2cloud/riskscanner

RiskScanner 是开源的多云安全合规扫描平台，基于 Cloud Custodian 和 Nuclei 引擎，实现对主流公(私)有云资源的安全合规扫描和漏洞扫描。

octarinesec/kube-scan

kube-scan: Octarine k8s cluster risk assessment tool

mandiant/mandiant-azure-ad-investigator

Read-only PowerShell module for detecting UNC2452 and other threat actor artifacts in Azure AD, auditing federated domains, service principals,…

mandiant/azure_workshop

Terraform-deployable vulnerable-by-design Azure lab with realistic attack paths and common misconfigurations for practicing red teaming and security…

hlldz/dazzleup

A tool that detects the privilege escalation vulnerabilities caused by misconfigurations and missing updates in the Windows operating systems.

domain-protect/domain-protect

OWASP Domain Protect - prevent subdomain takeover

opencspm/opencspm

Open Cloud Security Posture Management Engine