Octoscan
Octoscan is a static vulnerability scanner designed specifically for GitHub action workflows. It analyzes workflow files to identify potential security risks and misconfigurations. The tool offers various functionalities: 1. Downloading remote workflows from GitHub repositories for analysis. 2. Scanning local or downloaded workflows for vulnerabilities. 3. Implementing multiple security rules to detect issues such as dangerous checkouts, expression injections, and known vulnerabilities. 4. Providing options to customize scans, including enabling/disabling specific rules and filtering triggers. 5. Offering different output formats, including JSON, for easy integration into security pipelines. Octoscan helps security teams and developers identify and mitigate risks in their CI/CD pipelines, focusing on GitHub Actions-specific vulnerabilities and best practices.
FEATURES
ALTERNATIVES
A Burp extension for scanning JavaScript files for endpoint links
ESLint plugin to prevent Trojan Source attacks.
Yaramod is a library for parsing YARA rules into AST and building new YARA rulesets with C++ programming interface.
CFRipper is a Library and CLI security analyzer for AWS CloudFormation templates.
A web application designed to be 'Xtremely Vulnerable' for security enthusiasts to learn application security.
A static code analysis tool for parsing common data formats to detect hardcoded credentials and dangerous functions.
Automatic tool for pentesting XSS attacks against different applications
A learning and training project demonstrating common configuration errors in cloud environments.
PINNED
InfoSecHired
An AI-powered career platform that automates the creation of cybersecurity job application materials and provides company-specific insights for job seekers.
Fabric Platform by BlackStork
Fabric Platform is a cybersecurity reporting solution that automates and standardizes report generation, offering a private-cloud platform, open-source tools, and community-supported templates.
Mandos Brief Newsletter
Stay ahead in cybersecurity. Get the week's top cybersecurity news and insights in 8 minutes or less.
System Two Security
An AI-powered platform that automates threat hunting and analysis by processing cyber threat intelligence and generating customized hunt packages for SOC teams.
Aikido Security
Aikido is an all-in-one security platform that combines multiple security scanning and management functions for cloud-native applications and infrastructure.
Permiso
Permiso is an Identity Threat Detection and Response platform that provides comprehensive visibility and protection for identities across multiple cloud environments.
Wiz
Wiz Cloud Security Platform is a cloud-native security platform that enables security, dev, and devops to work together in a self-service model, detecting and preventing cloud security threats in real-time.
Adversa AI
Adversa AI is a cybersecurity company that provides solutions for securing and hardening machine learning, artificial intelligence, and large language models against adversarial attacks, privacy issues, and safety incidents across various industries.