Passbolt | Open source password manager for teams
"The password manager your team was waiting for. Free, open source, self-hosted, extensible, OpenPGP based."
Falco — Cloud-Native Runtime Security
"Falco, the open source cloud-native runtime security project, is the defacto Kubernetes threat detection engine. Falco detects unexpected application behavior and alerts on threats at runtime."
Harbor
"Harbor is an open source container image registry that secures images with role-based access control, scans images for vulnerabilities, and signs images as trusted. A CNCF Incubating project, Harbor delivers compliance, performance, and interoperability to help you consistently and securely manage images across cloud native compute platforms like Kubernetes and Docker."
Cilium
"A microservices-based application is split into small independent services that communicate with each other via APIs using lightweight protocols like HTTP, gRPC, Kafka and more. However, existing Linux network security mechanisms (e.g., iptables) only operate at the network and transport layers (i.e., IP addresses and ports) and lack visibility into the microservices layer.
Cilium brings API-aware network security filtering to Linux container frameworks like Docker and Kubernetes. Using a new Linux kernel technology called BPF, Cilium provides a simple and efficient way to define and enforce both network-layer and application-layer security policies based on container/pod identity."
Home | OpenSCAP portal
"The OpenSCAP ecosystem provides multiple tools to assist administrators and auditors with assessment, measurement, and enforcement of security baselines. We maintain great flexibility and interoperability, reducing the costs of performing security audits."
Lynis - Security auditing tool for Linux, macOS, and Unix-based systems - CISOfy
"Lynis is a battle-tested security tool for systems running Linux, macOS, or Unix-based operating system. It performs an extensive health scan of your systems to support system hardening and compliance testing. The project is open source software with the GPL license and available since 2007."
Kubernetes Security
"From outside the cluster, kube-hunter probes a domain or address range for open Kubernetes-related ports, and tests for any configuration issues that leave your cluster exposed to attackers. You’ll get a full report that highlights these security concerns. The source code is available on GitHub and we welcome contributions to extend the set of tests. "
FiloSottile/mkcert: A simple zero-config tool to make locally-trusted development certificates with any names you'd like.
" A simple zero-config tool to make locally-trusted development certificates with any names you'd like. "
FiloSottile/mkcert: A simple zero-config tool to make locally-trusted development certificates with any names you'd like.
" A simple zero-config tool to make locally-trusted development certificates with any names you'd like. "
SQL Injection Wiki
Shieldfy : Web application protection & security monitoring for web developers
"We provide you with details about every threat , including every step hacker did since he landed on your web application what type of browser & os he uses and where is he came from. Also what he did on your website to find a weakness and hist attempts to exploit this weakness.
That insights help you to find weakness and vulnerabilities faster."
The ZMap Project
"The ZMap Project is a collection of open source tools that enable researchers to perform large-scale studies of the hosts and services that compose the public Internet."
yandex/gixy: Nginx configuration static analyzer
"Nginx configuration static analyzer"
UpGuard – Cyber Resilience Platform
Visibility into the state of your IT infrastructure enables you to understand risk potential, prevent breaches, and speed up software delivery.
Wapiti : a Free and Open-Source web-application vulnerability scanner in Python for Windows, Linux, BSD, OSX
"Wapiti allows you to audit the security of your web applications.
It performs "black-box" scans, i.e. it does not study the source code of the application but will scans the webpages of the deployed webapp, looking for scripts and forms where it can inject data.
Once it gets this list, Wapiti acts like a fuzzer, injecting payloads to see if a script is vulnerable.
"
Suricata | Open Source IDS / IPS / NSM engine
"Suricata is a high performance Network IDS, IPS and Network Security Monitoring engine. Open Source and owned by a community run non-profit foundation, the Open Information Security Foundation (OISF). Suricata is developed by the OISF and its supporting vendors."
skipfish - web application security scanner - Google Project Hosting
"Skipfish is an active web application security reconnaissance tool. It prepares an interactive sitemap for the targeted site by carrying out a recursive crawl and dictionary-based probes. The resulting map is then annotated with the output from a number of active (but hopefully non-disruptive) security checks. The final report generated by the tool is meant to serve as a foundation for professional web application security assessments.
Key features:
High speed: pure C code, highly optimized HTTP handling, minimal CPU footprint - easily achieving 2000 requests per second with responsive targets. Ease of use: heuristics to support a variety of quirky web frameworks and mixed-technology sites, with automatic learning capabilities, on-the-fly wordlist creation, and form autocompletion. Cutting-edge security logic: high quality, low false positive, differential security checks, capable of spotting a range of subtle flaws, including blind injection vectors. The tool is believed to support Linux, FreeBSD, MacOS X, and Windows (Cygwin) environments."
GAUNTLT - Go Ahead, Be Mean To Your Code - Security and Rugged Testing
"Gauntlt provides hooks to a variety of security tools and puts them within reach of security, dev and ops teams to collaborate to build rugged software. It is built to facilitate testing and communication between groups and create actionable tests that can be hooked into your deploy and testing processes."
Check your PHP project for known security issues - SensioLabs Security Advisories Checker
You manage your PHP project dependencies with Composer, right? But are you sure that your project does not depend on a package with known security issues? The SensioLabs security advisories checker is a simple tool, available as a web service or as an online application, that uses the information from your composer.lock file to check for known security vulnerabilities. This checker is a frontend for the security advisories database.
Naked Password - jQuery Plugin to Encourage Stronger Passwords
The whole idea of naked password is to encourage your users to enter stronger passwords. Our beautiful model Sally tastefully removes items of clothing as the password grows stronger.
CentralWire - CentralWire: a centralized management console for tripwire
If you use tripwire, you may have to review and accept changes on a daily basis. Logging into multiple servers to accept the changes is troublesome. Enter CentralWire: a web-based centralized console to review and accept changes detected by tripwire.
openssh-lpk - Project Hosting on Google Code
The OpenSSH LDAP Public Key patch provides an easy way of centralizing strong user authentication by using an LDAP server for retrieving public keys instead of ~/.ssh/authorized_keys.
HTML Sanitisation: The Devil's In The Details (And The Vulnerabilities) - Maugrim The Reaper's Blog
Do yourself a favour, use HTMLPurifier.
Threat Risk Modeling - OWASP
When you start a web application design, it is essential to apply threat risk modeling; otherwise you will squander resources, time, and money on useless controls that fail to focus on the real risks.The method used to assess risk is not nearly as important as actually performing a structured threat risk modeling. Microsoft notes that the single most important factor in their security improvement program was the corporate adoption of threat risk modeling.OWASP recommends Microsoft’s threat modeling process because it works well for addressing the unique challenges facing web application security and is simple to learn and adopt by designers, developers, code reviewers, and the quality assurance team.The following sections provide some overview information (or see Section 6.9, Further Reading, for additional resources).
Graudit - Just Another Hacker
Graudit is a simple script and signature sets that allows you to find potential security flaws in source code using the GNU utility grep. It's comparable to other static analysis applications like RATS, SWAAT and flaw-finder while keeping the technical requirements to a minimum and being very flexible.
Ralph Schindler - Dynamic Assertions for Zend_Acl in ZF
Zend_Acl can now be used to make concise, dynamic and expressive ACL systems. The assertion system that is in place in Zend_Acl can be leveraged in ways never seen before out of the box. While the User/BlogPost example is on the simple side, you can use this article to start thinking about the different ways such a system can be leveraged in your own projects where dynamic assertions would simplify controller or model code that is already in place.
ratproxy - Google Code
A semi-automated, largely passive web application security audit tool, optimized for an accurate and sensitive detection, and automatic annotation, of potential problems and security-relevant design patterns based on the observation of existing, user-initiated traffic in complex web 2.0 environments.
owasp-esapi-php - Google Code
The purpose of the ESAPI is to provide a simple interface that provides all the security functions a developer is likely to need in a clear, consistent, and easy to use way. The ESAPI architecture is very simple, just a collection of classes that encapsulate the key security operations most applications need.