Agent-less vulnerability scanner for Linux, FreeBSD, Container Image, Running Container, WordPress, Programming language libraries, Network devices
-
Updated
Jul 3, 2020 - Go
Agent-less vulnerability scanner for Linux, FreeBSD, Container Image, Running Container, WordPress, Programming language libraries, Network devices
Is your feature request related to a problem? Please describe.
Monkey Island should listen to port 80 and 443 (if not taken) and redirect clients to the correct Island port.
Describe alternatives you've considered
We don't want to move the Island to port 443 because that loses us a ATT&CK technique for uncommon port, but many users accidentally browse to default http/https.
Multiples wiki issues.
first-steps doesn't exist anymore.Automated Adversary Emulation
I would like to see documentation for using Astra with most popular authentication/token methods. So much work but just one page of documentation. Please update this so it gets more widely used and more feedback on the product this way. Thanks
I'm just starting out in using DefectDojo, and am a bit confused on what the Tool Type and Tool Configuration sections inside Configuration. I know that documentation is something DefectDojo prides itself on, and I greatly appreciate the breadth of it... but I can't seem to find this documented anywhere.
I have never written SCAP content before, and am looking at how to get started. I would like to write SCAP content to test compliance on Photon OS against DISA SRGs. I have been all over the wiki pages, but I am still not sure how to get started. The main page makes it look super easy for writing OVAL and XCCDF files using YAML, but I am not sure where to build those
gitGraber: monitor GitHub to search and find sensitive data in real time for different online services such as: Google, Amazon, Paypal, Github, Mailgun, Facebook, Twitter, Heroku, Stripe...
Any good docs on the code structure on how to add new providers there ? Code is slightly convoluted and it's quite hard to see what changes are required to add one - ideally, they'd be plugin-like structure bundled in one dir, aren't they yet ?
The SOC Analysts all-in-one CLI tool to automate and speed up workflow.
Add documentation about how to apply helper functions
Docs in the rules/policies pages on applying helpers, best practices, and patterns
A tool to find subdomains and interesting things hidden inside, external Javascript files of page, folder, and Github.
https://docs.dependencytrack.org/integrations/badges/
You need to hardcode version (or UUID - which changes by version (!)) in the url for the badge - it would be more convenient to have an url for latest version.
Just point at name and get semver latest version (or latest scanned version) - this way the url can be stable in READMEs etc.
Hardening Ubuntu. Systemd edition.
A ruby script that scans for vulnerable & exploitable 3rd-party web applications on a network
Just getting my bearings in the FACT code and perhaps I'm misinterpreting somethin but I'm wondering if common_helper_files is equivalent to helperFiles and also if get_dir_of_file() is equivalent to get_directory_of_current_file() in fileSystem? If so, I gather that the former are to be deprecated? If so, this should be documented.
The plugin template is well documented in its basics but metho
Burp-Automator: A Burp Suite Automation Tool with Slack Integration. It can be used with Jenkins and Selenium to automate Dynamic Application Security Testing (DAST).
Ansible playbook roles for security
Right now a lot of the logging from the tasks does not get propagated back to the user, so we should make sure that all of the tasks are adding logs and errors to the results so that at minimum the data gets put into the worker-log.txt. Ideally we would store this info in datastore so that the clients could query it later (this part is in #115).
Penetration Testing notes, resources and scripts
a tool to analyze filesystem images for security
An open source framework for enterprise level automated analysis.
Web application vulnerability scanner
As of this Pull Request, if Gitleaks takes longer than 5 minutes to finish it will timeout and end the analysis saying it took too long to complete.
In order to still be able to provide developers with the full output of the tool, it would be great to have some instructions in huskyCI's documentation on
Seems that InnoSetup is included by default in AppVeyor to create the Windows installer. We should use it and automatically add it to our release. Some links:
Hi
i am using docker-compose in windows 7
postgres,rabbitmq and django application services build,but nginx service has an error!
nginx:
volumes:
- ./nginx_docker.conf:/etc/nginx/conf.d/default.conf
in this part "nginx_docker.conf" is not a directory and i have error "not a directory" in running "docker-compose up" command.
what is your solution for my problem?
Web Scan Lazy Tools - Python Package
Add a description, image, and links to the security-automation topic page so that developers can more easily learn about it.
To associate your repository with the security-automation topic, visit your repo's landing page and select "manage topics."
Summary
Get URLs that have parameters, whether http or https, leak sensitive information when they capture parameters such as API-Keys, usernames, and passwords. Browser extensions, bookmarks, history, and server log files capture these, even when operating in anonymous mode. Browser providers could share the information and log files need to mask the sensitive information. Refer: https://ww