diff --git a/_pages/index.rst b/_pages/index.rst index b8c3d21..55e0521 100644 --- a/_pages/index.rst +++ b/_pages/index.rst @@ -45,6 +45,7 @@ Static Analysis --------------- - `Brakeman `_ - A static analysis security vulnerability scanner for Ruby on Rails applications. +- `ClawSec `_ - AI agent skill security audit platform that analyzes MCP servers and AI tool integrations for vulnerabilities. - `Detekt `_ - A static code analysis tool for the Kotlin programming language. - `Dr. Taint `_ - A very WIP DynamoRIO module built on the Dr. Memory Framework to implement taint analysis on ARM. - `Gitleaks `_ - A SAST tool for detecting and preventing hardcoded secrets like passwords, api keys, and tokens in git repos. Gitleaks is an easy-to-use, all-in-one solution for detecting secrets, past or present, in your code. @@ -502,10 +503,10 @@ Exploiting - `AttackSurfaceAnalyzer `_ - Attack Surface Analyzer can help you analyze your operating system's security configuration for changes during software installation. - `Bashfuscator `_ - A fully configurable and extendable Bash obfuscation framework. This tool is intended to help both red team and blue team. - `BeEF `_ - The Browser Exploitation Framework Project. -- `Bowcaster Exploit Development Framework `_ - This framework, implemented in Python, is intended to aid those developing -exploits by providing useful set of tools and modules, such as payloads, -encoders, connect-back servers, etc. Currently the framework is focused on the -MIPS CPU architecture, but the design is intended to be modular enough to +- `Bowcaster Exploit Development Framework `_ - This framework, implemented in Python, is intended to aid those developing +exploits by providing useful set of tools and modules, such as payloads, +encoders, connect-back servers, etc. Currently the framework is focused on the +MIPS CPU architecture, but the design is intended to be modular enough to support arbitrary architectures. - `BugId `_ - Detect, analyze and uniquely identify crashes in Windows applications. - `CALDERA `_ - A cyber security framework designed to easily automate adversary emulation, assist manual red-teams, and automate incident response. @@ -873,7 +874,7 @@ Reporting - `DefectDojo `_ - An open-source application vulnerability correlation and security orchestration tool. - `Dradis `_ - Colllaboration and reporting for IT Security teams. - `Faraday `_ - Collaborative Penetration Test and Vulnerability Management Platform. -- `PwnDoc `_ - A pentest reporting application making it simple and easy to write your findings and generate a customizable Docx report. +- `PwnDoc `_ - A pentest reporting application making it simple and easy to write your findings and generate a customizable Docx report. The main goal is to have more time to Pwn and less time to Doc by mutualizing data like vulnerabilities between users. - `VECTR `_ - A tool that facilitates tracking of your red and blue team testing activities to measure detection and prevention capabilities across different attack scenarios. - `WriteHat `_ - A reporting tool which removes Microsoft Word (and many hours of suffering) from the reporting process. Markdown --> HTML --> PDF. Created by penetration testers, for penetration testers - but can be used to generate any kind of report. @@ -1157,7 +1158,7 @@ Cloud Security - `Security Monkey `_ - Security Monkey monitors AWS, GCP, OpenStack, and GitHub orgs for assets and their changes over time. - `SyntheticSun `_ - A defense-in-depth security automation and monitoring framework which utilizes threat intelligence, machine learning, managed AWS security services and, serverless technologies to continuously prevent, detect and respond to threats. - `ThreatMapper `_ - Hunts for threats in your production platforms, and ranks these threats based on their risk-of-exploit. It uncovers vulnerable software components, exposed secrets and deviations from good security practice. -- `Varna `_ - Quick & Cheap AWS CloudTrail Monitoring with Event Query Language (EQL) +- `Varna `_ - Quick & Cheap AWS CloudTrail Monitoring with Event Query Language (EQL) Resources - `s3cr3t `_ - Serve files securely from an S3 bucket with expiring links and other restrictions.