Security Audit
Explore 73 curated tools and resources
Search by name, description, or purpose... (⌘+K)
PINNED
Promoted • 6 toolsCommercial
Data Protection
Commercial
Network Security
Commercial
Consulting
Commercial
Application Security
Commercial
Cloud Security
Commercial
Application Security
Want your tool featured here?
Get maximum visibility with pinned placement
LATEST ADDITIONS
A comprehensive cybersecurity consulting service offering security assessments, risk analysis, and implementation of tailored information security management systems for organizations.
A comprehensive cybersecurity consulting service offering security assessments, risk analysis, and implementation of tailored information security management systems for organizations.
A Python script that scans file systems to identify hardcoded credentials, API keys, and other sensitive secrets using configurable regex patterns.
A Python script that scans file systems to identify hardcoded credentials, API keys, and other sensitive secrets using configurable regex patterns.
A compliance management platform that simplifies CMMC Level 1 certification for defense contractors through guided workflows, policy templates, and evidence management tools.
A compliance management platform that simplifies CMMC Level 1 certification for defense contractors through guided workflows, policy templates, and evidence management tools.
Network Intelligence is a cybersecurity services provider offering comprehensive security solutions through their ADVISE framework, including detection and response, compliance, data privacy, and secure digital transformation services across multiple industries.
Network Intelligence is a cybersecurity services provider offering comprehensive security solutions through their ADVISE framework, including detection and response, compliance, data privacy, and secure digital transformation services across multiple industries.
A centralized vulnerability lifecycle management platform that tracks security issues from discovery to closure with real-time status updates.
A centralized vulnerability lifecycle management platform that tracks security issues from discovery to closure with real-time status updates.
A powerful tool that enables organizations to discover, manage, and secure privileged access, helping to reduce the risks associated with privileged accounts and activities.
A powerful tool that enables organizations to discover, manage, and secure privileged access, helping to reduce the risks associated with privileged accounts and activities.
Monitor GitHub for sensitive data
A simple snippet to increment ../ on the URL.
A Burp extension for scanning JavaScript files for endpoint links
A Burp extension for scanning JavaScript files for endpoint links
A command-line program for finding secrets and sensitive information in textual data and Git history.
A command-line program for finding secrets and sensitive information in textual data and Git history.
Monitors GitHub for leaked secrets
A simple Swagger-ui scanner that detects old versions vulnerable to various XSS attacks
A simple Swagger-ui scanner that detects old versions vulnerable to various XSS attacks
A tool to identify publicly accessible S3 objects
Pre-commit hook for validating outgoing changeset
A PowerShell script that assesses security configurations of Siemens SIMATIC PCS 7 industrial control systems by collecting and analyzing data from various Windows and PCS7-specific sources.
A PowerShell script that assesses security configurations of Siemens SIMATIC PCS 7 industrial control systems by collecting and analyzing data from various Windows and PCS7-specific sources.
Dorothy is a tool to test monitoring and detection capabilities for Okta environments, with modules mapped to MITRE ATT&CK® tactics.
Dorothy is a tool to test monitoring and detection capabilities for Okta environments, with modules mapped to MITRE ATT&CK® tactics.
A tool for scanning and identifying potential security risks in GitHub organizations, users, and repositories.
A tool for scanning and identifying potential security risks in GitHub organizations, users, and repositories.
A sensitive data detection tool for scanning source code repositories
A compliant audit log tool that provides a searchable, exportable record of read/write events.
A compliant audit log tool that provides a searchable, exportable record of read/write events.
An open-source security tool for AWS, Azure, Google Cloud, and Kubernetes security assessments and audits.
Identify AWS IAM permissions by brute-forcing API calls.
Web server scanner for identifying security vulnerabilities.
An extensible, heuristic-based vulnerability scanning tool for installed npm packages.
An extensible, heuristic-based vulnerability scanning tool for installed npm packages.
A dynamic GUI for advanced log analysis, allowing users to execute SQL queries on structured log data.
A dynamic GUI for advanced log analysis, allowing users to execute SQL queries on structured log data.
A tool to scan for CORS misconfigurations in web applications
Conmachi is a Golang tool for scanning container environments for security issues.
Conmachi is a Golang tool for scanning container environments for security issues.
Bastille-Linux is a system hardening program that proactively configures the system for increased security and educates users about security settings.
Bastille-Linux is a system hardening program that proactively configures the system for increased security and educates users about security settings.
AWS Scout2 is a security tool for AWS administrators to assess their environment's security posture.
AWS Scout2 is a security tool for AWS administrators to assess their environment's security posture.
Guidelines for contributing to a cybersecurity tools and resources list
Guidelines for contributing to a cybersecurity tools and resources list
Automate your reconnaissance process with AttackSurfaceMapper, a tool for mapping and analyzing network attack surfaces.
Automate your reconnaissance process with AttackSurfaceMapper, a tool for mapping and analyzing network attack surfaces.
Mitigate security concerns of Dependency Confusion supply chain security risks.
Multi-account cloud security tool for AWS with real-time reporting and auto-remediation capabilities.
Multi-account cloud security tool for AWS with real-time reporting and auto-remediation capabilities.
An all-in-one email outreach platform for finding and connecting with professionals, with features for lead discovery, email verification, and cold email campaigns.
An all-in-one email outreach platform for finding and connecting with professionals, with features for lead discovery, email verification, and cold email campaigns.
A Python script to check system compliance against CIS Benchmarks with customizable options.
A Python script to check system compliance against CIS Benchmarks with customizable options.
A tool for identifying potential security vulnerabilities in web applications
A tool for identifying potential security vulnerabilities in web applications
Patch-level verification tool for bundler to check for vulnerable gems and insecure sources.
Patch-level verification tool for bundler to check for vulnerable gems and insecure sources.
Repokid uses Access Advisor to remove unused service permissions from IAM roles in AWS.
Repokid uses Access Advisor to remove unused service permissions from IAM roles in AWS.
Open-Source framework for detecting and preventing dependency confusion leakage with a holistic approach and wide technology support.
Open-Source framework for detecting and preventing dependency confusion leakage with a holistic approach and wide technology support.
Second-order subdomain takeover scanner
A tool that safely installs packages with npm/yarn by auditing them as part of your install process.
A tool that safely installs packages with npm/yarn by auditing them as part of your install process.
Tool to inform about potential risks in project dependencies list.
Tool to inform about potential risks in project dependencies list.
Analyzes CloudTrail data of a given AWS account and generates a summary of recently active IAM principals, API calls they made, as well as regions, IP addresses and user agents they used.
Analyzes CloudTrail data of a given AWS account and generates a summary of recently active IAM principals, API calls they made, as well as regions, IP addresses and user agents they used.
Script to check for artifacts with the same name between repositories to prevent Dependency Confusion Attacks.
Script to check for artifacts with the same name between repositories to prevent Dependency Confusion Attacks.
CFRipper is a Library and CLI security analyzer for AWS CloudFormation templates.
CFRipper is a Library and CLI security analyzer for AWS CloudFormation templates.
Fast and simple way to check any HTTP Headers
Docker security audit tool with custom audit profiles and JSON report generation based on CIS Docker 1.6 Benchmark.
Docker security audit tool with custom audit profiles and JSON report generation based on CIS Docker 1.6 Benchmark.
Crt.sh is a website that allows users to search for SSL/TLS certificates of a targeted domain, providing transparency into certificate logs.
Crt.sh is a website that allows users to search for SSL/TLS certificates of a targeted domain, providing transparency into certificate logs.
Websecurify provides efficient ways to protect organizations with sophisticated technology and expert consultancy.
Websecurify provides efficient ways to protect organizations with sophisticated technology and expert consultancy.
A specialized packet sniffer for displaying and logging HTTP traffic, designed to capture, parse, and log traffic for later analysis.
A specialized packet sniffer for displaying and logging HTTP traffic, designed to capture, parse, and log traffic for later analysis.
A tool for auditing and reporting Unix host security with the ability to perform a lockdown.
A tool for auditing and reporting Unix host security with the ability to perform a lockdown.
Comprehensive host-survey tool for security checks in C#.
Detect off-instance key usage in AWS by analyzing CloudTrail files locally.
Detect off-instance key usage in AWS by analyzing CloudTrail files locally.
A tool to analyze and audit AWS environments for security issues and misconfigurations.
A tool to analyze and audit AWS environments for security issues and misconfigurations.
A Docker analysis tool for identifying potential security vulnerabilities and weaknesses in Docker environments
A Docker analysis tool for identifying potential security vulnerabilities and weaknesses in Docker environments
A comprehensive resource for securing Active Directory, including attack methods and effective defenses.
A comprehensive resource for securing Active Directory, including attack methods and effective defenses.
A tool to capture all the git secrets by leveraging multiple open source git searching tools.
A tool to capture all the git secrets by leveraging multiple open source git searching tools.
Powerful PowerShell script for identifying missing software patches for local privilege escalation vulnerabilities.
Powerful PowerShell script for identifying missing software patches for local privilege escalation vulnerabilities.
A tool for identifying potential security vulnerabilities in dependency configurations by checking for lingering free namespaces for private package names.
A tool for identifying potential security vulnerabilities in dependency configurations by checking for lingering free namespaces for private package names.
Open source security auditing tool to search and dump system configuration.
Open source security auditing tool to search and dump system configuration.
Altoro Mutual offers online banking, real estate financing, business credit cards, retirement solutions, and prioritizes privacy and security.
Altoro Mutual offers online banking, real estate financing, business credit cards, retirement solutions, and prioritizes privacy and security.
Identifies misconfigured CloudFront domains vulnerable to hijacking
Identifies misconfigured CloudFront domains vulnerable to hijacking
DueDLLigence is an open-source tool for identifying and analyzing DLL hijacking vulnerabilities in Windows applications, providing automated analysis and remediation guidance.
DueDLLigence is an open-source tool for identifying and analyzing DLL hijacking vulnerabilities in Windows applications, providing automated analysis and remediation guidance.
Open-source tool for analyzing AWS temporary tokens to detect malicious activity.
Open-source tool for analyzing AWS temporary tokens to detect malicious activity.
Nessus efficiently scans for system vulnerabilities, misconfigurations, and compliance issues.
Nessus efficiently scans for system vulnerabilities, misconfigurations, and compliance issues.
Track user activity and API usage on AWS and in hybrid and multicloud environments.
Track user activity and API usage on AWS and in hybrid and multicloud environments.
A plugin for viewing, detecting weak configurations, and generating Content Security Policy headers.
A plugin for viewing, detecting weak configurations, and generating Content Security Policy headers.
A script and library for identifying risks in AWS IAM configuration
A script and library for identifying risks in AWS IAM configuration
A free online tool that scans and fixes common security issues in WordPress websites.
A free online tool that scans and fixes common security issues in WordPress websites.
A BloodHoundAD Report Engine for Security Teams to identify Active Directory security vulnerabilities and harden common configuration vulnerabilities and oversights.
A BloodHoundAD Report Engine for Security Teams to identify Active Directory security vulnerabilities and harden common configuration vulnerabilities and oversights.
Simple script to check a domain's email protections and identify vulnerabilities.
Simple script to check a domain's email protections and identify vulnerabilities.
Open source tool for generating YARA rules about installed software from a running OS.
Open source tool for generating YARA rules about installed software from a running OS.
Static code analysis tool for infrastructure as code (IaC) and software composition analysis (SCA) with over 1000 built-in policies for AWS, Azure, and Google Cloud.
Static code analysis tool for infrastructure as code (IaC) and software composition analysis (SCA) with over 1000 built-in policies for AWS, Azure, and Google Cloud.