Tools

padok-team/yatas

:owl::mag_right: A simple tool to audit your AWS/GCP infrastructure for misconfiguration or potential security issues with plugins integration

neelkotnis/azure-security-auditor

CLI tool to audit Azure security posture, RBAC, NSGs, storage, identity, and encryption

ad-security/ad_miner

AD Miner is an Active Directory audit tool that leverages cypher queries to crunch data from the #Bloodhound graph database to uncover security…

elc0mpa/aws-doctor

Powerful open-source CLI to audit security, costs, and best practices in AWS. 🩺 ☁️

appsecco/spaces-finder

A tool to hunt for publicly accessible DigitalOcean Spaces

rosehgal/dockerent

The only open-source tool to analyze vulnerabilities and configuration issues with running docker container(s) and docker networks.

primait/nuvola

Graph-based AWS security analysis tool that dumps cloud configurations, detects misconfigurations, and maps attack paths using a Neo4j digital twin…

yandex/gixy

Nginx configuration static analyzer

jakehildreth/locksmith

A small tool built to find and fix common misconfigurations in Active Directory Certificate Services.

renniepak/cspbypass

CSPBypass.com, a tool designed to help ethical hackers bypass restrictive Content Security Policies (CSP) and exploit XSS (Cross-Site Scripting)…

synacktiv/gpoparser

gpoParser is a tool designed to extract and analyze configurations applied through Group Policy Objects (GPOs) in an Active Directory environment.

hxsecurity/terraformgoat

Multi-cloud vulnerable-by-design deployment tool using Terraform to provision intentionally insecure cloud infrastructure for security training and…

tenable/cnappgoat

CNAPPgoat is an open source project designed to modularly provision vulnerable-by-design components in cloud environments.

nccgroup/aws-inventory

Discover resources created in an AWS account.

stelligent/cfn_nag

Linting tool for CloudFormation templates

nccgroup/conmachi

Container Blackbox Security Auditing Tool: enumerates security configuration from within the target container

nccgroup/scoutsuite

Multi-cloud security auditing tool that leverages cloud provider APIs to gather configuration data, assess security posture, and generate HTML…

reverseclabs/azuredevops-enum

Read-only Azure DevOps enumeration tool that queries the REST API to surface projects, repositories, service connections, builds, pipeline secrets,…