Tools

r0binak/cve-2023-5043

Proof-of-concept exploit for CVE-2023-5043, demonstrating arbitrary command execution via Ingress NGINX annotation injection in Kubernetes, with a…

controlplaneio/kubesec

Security risk analysis for Kubernetes resources

kyverno/kyverno

Enforce security and compliance on Kubernetes clusters via admission controls, resource mutation, background scans, and container image signature…

stackrox/kube-linter

KubeLinter is a static analysis tool that checks Kubernetes YAML files and Helm charts to ensure the applications represented in them adhere to best…

complianceascode/content

Generates SCAP, Ansible, Bash, and CEL security content for compliance evaluation and automated hardening across Linux hosts, containers, and…

open-policy-agent/conftest

Write tests against structured configuration data using the Open Policy Agent Rego query language

open-policy-agent/opa

Declarative policy engine that enables authorization and policy enforcement across services, Kubernetes, Terraform, Docker, and APIs using the Rego…

neelkotnis/azure-security-auditor

CLI tool to audit Azure security posture, RBAC, NSGs, storage, identity, and encryption

elttam/semgrep-rules

Static analysis security rules for vulnerability detection and audit-focused code review across Java, Go, Python, C#, Kotlin, PHP, Kubernetes, and…

wavestone-cdt/defcon-cicd-pipelines-workshop

Hands-on CI/CD pipeline security workshop with Terraform lab, AWS exploitation, Kubernetes escape, and artifact backdooring exercises for offensive…

pop3ret/awsome-pentesting

My cheatsheet notes to pentest AWS infrastructure

george0papasotiriou/cve-2026-21005-docker-registry-v2-schema-1-image-poisoning

Exploits CVE-2026-21005 by poisoning Docker Registry V2 Schema 1 manifests via unauthenticated pushes, enabling tag overwrite and supply-chain…

george0papasotiriou/cve-2026-21008-kubernetes-service-account-token-mounted-in-hostpath

Proof-of-concept exploit for Kubernetes service-account token disclosure via hostPath mounts; includes vulnerable pod YAML and Python token-theft…

dz-y/azure-apim-dev-portal-signup-bypass

Python script to bypass Azure APIM signup when UI is disabled, this is different from the CVE-2025-66390 as it does not require you to setup anything…

zephrfish/ludus-defender-lab

MDE/MDI Defender setup for Ludus

george0papasotiriou/cve-2026-5556-kubernetes-admission-controller-bypass-via-case-sensitivity

Exploit PoC and vulnerable admission webhook for CVE-2026-5556, demonstrating Kubernetes admission controller bypass via case-sensitive pod name…

nagwww/s3-leaks

Curated timeline of AWS S3 bucket misconfigurations, exposed data, and leaked IAM credentials, with incident links for cloud security defenders and…

akhld/spark-exploit

Arbitary Code Execution in Unsecured Apache Spark Cluster