错误配置

lynis

cisofy/lynis

16.1k1个月前

content

complianceascode/content

2.8k15小时13分前

prowler

prowler-cloud/prowler

14.3k17小时8分前

trivy

aquasecurity/trivy

37.4k1天前

checkov

bridgecrewio/checkov

8.9k6天前

kics

checkmarx/kics

2.7k6天前

cloud-custodian

cloud-custodian/cloud-custodian

6.0k1天前

kubescape

kubescape/kubescape

11.6k5小时55分前

#10

kube-bench

aquasecurity/kube-bench

8.1k22天前

#11

kube-linter

stackrox/kube-linter

3.5k6天前

hvt

affolter-engineering/hvt

一个 Rust 命令行工具，针对目标 URL 探测 HTTP 方法（包括 WebDAV 和 DeltaV 动词），以揭示动词篡改、访问控制绕过以及非预期的方法暴露。

reconnaissancevulnerability-scannersweb-vulnerability-scanners+5

21天前

Locksmith2

jakehildreth/locksmith2

一个面向 AD 管理员、防御性安全专业人员和“肮脏”红队成员的 AD CS 工具包

defensive-toolsprivilege-escalationvulnerability-scanners+8

11120天前

php2shell-checker

toxy4ny/php2shell-checker

用于 Debian 12/13 的只读 PHP2Shell 软件包检查器（CVE-2026-109618、CVE-2026-109619）。

defensive-toolsvulnerability-scannersvulnerability-analysis+4

4天前

CVE-2026-36213-poc

nt2dev/cve-2026-36213-poc

CVE-2026-36213：MEmu Android 模拟器 9.2.7.0 本地权限提升

privilege-escalationvulnerability-analysisexploitation+2

1个月前

HostBadger

g4bri-3l3/hostbadger

Windows host hardening auditor and remediation tool in PowerShell: CIS, DISA STIG, Essential Eight checks, reversible fixes, optional AI analysis

defensive-toolsprivilege-escalationvulnerability-scanners+6

201天前

IDWolf

g4bri-3l3/idwolf

Read-only Active Directory & Microsoft Entra ID hygiene auditor in pure PowerShell. Collect once, analyze offline: deterministic findings, attack…

defensive-toolsprivilege-escalationvulnerability-analysis+6

212天前

openmeetings-backup-config-path

abraxas/openmeetings-backup-config-path

Apache OpenMeetings 9.1.0 - 高危 - 远程 - 文件写入残留 - ADMIN_BACKUP 导入在 Type.PATH 上跳过 Path.of

vulnerability-analysisweb-application-exploitationpenetration-testing+2

10天前

pfsense-config-readonly-restore

abraxas/pfsense-config-readonly-restore

pfSense CE 2.9.0-DEVELOPMENT - 高危 - 远程 - 权限残留 - 只读 config_install

privilege-escalationvulnerability-analysisexploitation+6

12天前

spark-rest-auth-bypass

abraxas/spark-rest-auth-bypass

Apache Spark 4.2.0 - 高危 - 远程 - 权限残留 - standalone REST 忽略 spark.authenticate

privilege-escalationvulnerability-analysisexploitation+7

113天前

gh-legitify

legit-labs/gh-legitify

用于运行“legitify”的GitHub CLI扩展

static-analysisvulnerability-analysisconfiguration-auditing+4

23年前

sonic-gnmi-noauth

abraxas/sonic-gnmi-noauth

记录并复现 SONiC gNMI 中的 fail-open 认证漏洞：空的 UserAuth 映射允许未经认证的 gNMI Set 和 gNOI 写入，并附带一个 loopback 实验环境。

embedded-systems-securityvulnerability-analysisexploitation+6

20天前

kafka-connect-filestream-win

abraxas/kafka-connect-filestream-win

Kafka Connect 4.3.1 - High - Windows FileStream classpath leftover - unauth file read/write

vulnerability-analysisexploitationweb-application-exploitation+5

120天前

signal-server-dropwizard-admin

abraxas/signal-server-dropwizard-admin

Signal-Server v20261007.0.0 - 高危 - 远程 - 权限残留 - 未授权 Dropwizard 管理端 :8081

defensive-toolsreconnaissancevulnerability-analysis+5

715天前

sast

vulnz/sast

Free offline SAST engine for CI/CD: AST and cross-file taint analysis, secret detection with live validation, SCA/CVE, IaC misconfiguration, and…

defensive-toolsstatic-analysisvulnerability-scanners+9

21天前

EpiReal-Bench

ye-ze-yu/epireal-bench

面向商业图像生成器的红队测试基准与黑盒攻击框架，用于评估视觉虚假信息风险，包含1万条虚假声明提示词及评分脚本。

machine-learningpapers-researchmisconfiguration+4

419天前

servicenow

bsysop/servicenow

扫描 ServiceNow 实例中 widget-simple-list 插件配置错误，这些错误会通过 API 暴露数据，支持单个 URL、URL 列表、快速检查和代理选项。

reconnaissancevulnerability-scannersdata-exfiltration+4

682年前

GPEWebDefender

gopasteverything/gpewebdefender

轻量级 Web 攻击监控工具。单个 Go 二进制文件 + SQLite。不是 OSSEC，也不是 WAF。

defensive-toolsvulnerability-analysisinformation-gathering+8

52个月前

精选工具