Displaying 1 to 20 from 30 results

syzkaller - syzkaller is an unsupervised, coverage-guided Linux system call fuzzer

  •    Go

syzkaller is an unsupervised coverage-guided Linux kernel fuzzer.The project mailing list is syzkaller@googlegroups.com. You can subscribe to it with a google account or by sending an email to syzkaller+subscribe@googlegroups.com.

brakeman - A static analysis security vulnerability scanner for Ruby on Rails applications

  •    Ruby

Brakeman is an open source static analysis tool which checks Ruby on Rails applications for security vulnerabilities. Check out Brakeman Pro if you are looking for a commercially-supported version with a GUI and advanced features.

SecurityAdvisories - :closed_lock_with_key: Security advisories as a simple composer exclusion list, regularly updated


This package ensures that your application doesn't have installed dependencies with known security vulnerabilities. This package does not provide any API or usable classes: its only purpose is to prevent installation of software with known and documented security issues. Simply add "roave/security-advisories": "dev-master" to your composer.json "require-dev" section and you will not be able to harm yourself with software with known security vulnerabilities.

vuls - Vulnerability scanner for Linux/FreeBSD, agentless, written in Go

  •    Go

For a system administrator, having to perform security vulnerability analysis and software update on a daily basis can be a burden. To avoid downtime in production environment, it is common for system administrator to choose not to use the automatic update option provided by package manager and to perform update manually. This leads to the following problems. Vuls is a tool created to solve the problems listed above. It has the following characteristics.

uber-cli - 🚗Uber, at your fingertips

  •    Javascript

Clearly, I'm a lazy person (just look at what this tool does - it helps me figure out if I should order a car to pick me up and drive me to where I want to go). That being said, as a lazy person it pains me everytime open my phone, open the Uber app, type my destination, and see the estimated price, only for my inner, responsible, cost-cutting, fiduciary-self to end up taking the bus all the way home.

DeepFence - Identify vulnerabilities in running containers, images, hosts and repositories

  •    Go

Deepfence ThreatMapper helps you to monitor and secure your running applications, in Cloud, Kubernetes, Docker, and Fargate Serverless. ThreatMapper scans your platforms and identifies pods, containers, applications, and infrastructure. Use ThreatMapper to discover the topology of your applications and attack surface. It obtains manifests of dependencies from running pods and containers, serverless apps, applications, and operating system. ThreatMapper matches these against vulnerability feeds to identify vulnerable components.

InsecureProgramming - mirror of gera's insecure programming examples | http://community

  •    C

This is a mirror of Gera's Insecure Programming examples. Oldies but great for begineers getting into the basics of exploitation techniques and vulnerabilities.

Jeroboam - Check all your apps on macOS for vulnerable Sparkle updaters

  •    Ruby

IMMINENT DANGER: the heuristics indicate that it can't be assured, that using the updater won't compromise the system. In the best case, the app publisher provides updated binaries with a patched version of Sparkle, which isn't vulnerable or avoids using unencrypted HTTP connections for retrieving the AppCast, as strongly encouraged by Sparkle's documentation. Alternative countermeasures may range from disabling auto-updates and not using the updater anymore, over restricting the app's network functionalities to putting the app under quarantine. UNKNOWN: the app was compiled against an older SDK, so that ATS is not active or there are exclusions from ATS, while the feed URL for the AppCast is not declared in the Info.plist, so it has to be programmatically provided, which can't be determined by statical analysis. Nevertheless the tool inspects all string literals in the executable to find all HTTP URLs, which might include the feed URL. This strategy has limits and can't catch URLs, which weren't fully hardcoded as strings or obfuscated in another way. The found URLs are printed for further investigation through the user to allow a better risk estimation. If an insecure URL serving an AppCast can be found, it is likely that the app is vulnerable, otherwise it can't be excluded.

Puma6Fail - Denial of service vulnerability in Puma 6 modems

  •    Rust

Proof of concept code is already public elsewhere. DoS occurs in either direction - UDP from LAN to WAN or WAN to LAN.

handshake-cracker - Handshake cracker

  •    Shell

Includes a tool to efficiently perform capturing of handshakes. It intelligently manages all the words of the dictionaries to be tested, as well as keeps a history of everything that has already been tested, so that the same attempts are not repeated.

Ransomware-Json-Dataset - Compiles a json dataset using public sources that contains properties to aid in the detection and mitigation of over 400 variants of ransomware

  •    Python

Compiles a json dataset containing properties to aid in the detection and mitigation of over 400 variants of ransomware using public sources. The latest version of the Ransomware Summary spreadsheet will then be downloaded and processed into a local json output which will be found in the core folder of your local repository along with a copy of the latest version of the spreadsheet. To change the source and destinations for local files edit the constants found in the header of the 'update_json.py' file.

go-rip-git - RipGit - Scanner/Scraper of git source deployed

  •    Go

Zero dependencies and does not require the target to have open directory listing.

watchdog - Watchdog - A Comprehensive Security Scanning and a Vulnerability Management Tool.

  •    Python

Watchog is an integration of open source security tools aimed to provide a holistic security view for a given domain/IP. The way Watchdog is built, it can be used by product security teams, red teams and also by bug bounty hunters to get a 360° view of any Internet property it scans. Given a list of domains/IP's it has the capability to perform a network scan, feed the output to open source web app scanners like Google's skip-fish and wapiti, perform tech stack analysis and determine if the stack has any known CVE’s. WatchDog has the ability to scan all endpoints and perform technology version analysis on the services it detects and map this information with it’s rich CVE database maintained and updated locally.

cod-exploit - ☠️ cod mw2 exploit - PoC for CVE-2018-10718

  •    C++

The code has been published as the vulnerability used has been patched on all cod games as of 4/26/2018. For more information, read the post at https://momo5502.com/blog/?p=34 or see CVE-2018-10718. This software has been created purely for the purposes of academic research. It is not intended to be used to attack other systems. Project maintainers are not responsible or liable for misuse of the software. Use responsibly.

ShitHub - ShitHub is a collaborative platform, created to check your own and/or foreign code for security vulnerabilitys and design issues

  •    PHP

ShitHub is a collaborative platform, created to check your own and/or foreign code for security vulnerabilitys and design issues. A: Well, there are many other Code review systems, but we don't knew any system which isn't limited to team inside review and Open Source.

We have large collection of open source products. Follow the tags from Tag Cloud >>

Open source products are scattered around the web. Please provide information about the open source projects you own / you use. Add Projects.