GitHub - Security Ticks

Network of ghost GitHub accounts successfully distributes malware

automa, Check Point, Don't miss, GitHub, Hot stuff, Malware, News, phishing / SecurityTicks

Network of ghost GitHub accounts successfully distributes malware 2024-07-24 at 17:31 By Zeljka Zorz Check Point researchers have unearthed an extensive network of GitHub accounts that they believe provides malware and phishing link Distribution-as-a-Service. Set up and operated by a threat group the researchers dubbed as Stargazer Goblin, the “Stargazers Ghost Network” is estimated encompass […]

React to this headline:

Network of ghost GitHub accounts successfully distributes malware Read More »

Infisical: Open-source secret management platform

Don't miss, GitHub, Hot stuff, News, open source, software / SecurityTicks

Infisical: Open-source secret management platform 2024-07-24 at 07:01 By Help Net Security Infisical is an open-source secret management platform developers use to centralize application configurations and secrets, such as API keys and database credentials, while also managing their internal PKI. In addition to managing secrets with Infisical, you can scan your files, directories, and Git

React to this headline:

Infisical: Open-source secret management platform Read More »

Shuffle Automation: Open-source security automation platform

automation, Don't miss, GitHub, Hot stuff, News, open source, security operations, software / SecurityTicks

Shuffle Automation: Open-source security automation platform 2024-07-22 at 07:01 By Mirko Zorz Shuffle is an open-source automation platform designed by and for security professionals. While security operations are inherently complex, Shuffle simplifies the process. It’s designed to integrate with Managed Security Service Providers (MSSPs) and other service providers. Key features Feature-rich workflow editor. App creator

React to this headline:

Shuffle Automation: Open-source security automation platform Read More »

Grype: Open-source vulnerability scanner for container images, filesystems

cybersecurity, Don't miss, GitHub, Hot stuff, News, open source, penetration testing, scanning, software / SecurityTicks

Grype: Open-source vulnerability scanner for container images, filesystems 2024-07-18 at 06:31 By Help Net Security Grype is an open-source vulnerability scanner designed for container images and filesystems that seamlessly integrates with Syft, a powerful Software Bill of Materials (SBOM) tool. Find vulnerabilities for major operating system packages Alpine Amazon Linux BusyBox CentOS CBL-Mariner Debian Distroless

React to this headline:

Grype: Open-source vulnerability scanner for container images, filesystems Read More »

SubSnipe: Open-source tool for finding subdomains vulnerable to takeover

cybersecurity, Don't miss, GitHub, Hot stuff, News, open source, penetration testing, software / SecurityTicks

SubSnipe: Open-source tool for finding subdomains vulnerable to takeover 2024-07-17 at 07:01 By Mirko Zorz SubSnipe is an open-source, multi-threaded tool to help find subdomains vulnerable to takeover. It’s simpler, produces better output, and has more fingerprints than other subdomain takeover tools. “SubSnipe does some additional verification after the fingerprinting to find candidates more likely

React to this headline:

SubSnipe: Open-source tool for finding subdomains vulnerable to takeover Read More »

Most GitHub Actions workflows are insecure in some way

cyber risk, cybersecurity, GitHub, Legit Security, News, report, survey / SecurityTicks

Most GitHub Actions workflows are insecure in some way 2024-07-17 at 06:01 By Help Net Security Most GitHub Actions are susceptible to exploitation; they are overly privileged or have risky dependencies, according to Legit Security. GitHub Actions security flaws pose major risks The report found the GitHub Actions marketplace’s security posture to be especially concerning,

React to this headline:

Most GitHub Actions workflows are insecure in some way Read More »

Ex-GitHub Engineers Raise $20M to Enhance Pen-Testing with AI-Powered XBOW

Artificial Intelligence, automation, Funding/M&A, GitHub, penetration testing, XBOW / SecurityTicks

Ex-GitHub Engineers Raise $20M to Enhance Pen-Testing with AI-Powered XBOW 2024-07-16 at 17:32 By Ryan Naraine A team of former GitHub engineers has secured $20 million in venture capital funding from Sequoia to build AI-powered security tools. The post Ex-GitHub Engineers Raise $20M to Enhance Pen-Testing with AI-Powered XBOW appeared first on SecurityWeek. This article

React to this headline:

Ex-GitHub Engineers Raise $20M to Enhance Pen-Testing with AI-Powered XBOW Read More »

Realm: Open-source adversary emulation framework

cybersecurity, Don't miss, GitHub, Hot stuff, News, open source, red team, software / SecurityTicks

Realm: Open-source adversary emulation framework 2024-07-15 at 07:32 By Mirko Zorz Realm is an open-source adversary emulation framework emphasizing scalability, reliability, and automation. It’s designed to handle engagements of any size. “Realm is unique in its custom interpreter written in Rust. This allows us to write complex TTPs as code. With these actions as code,

React to this headline:

Realm: Open-source adversary emulation framework Read More »

BunkerWeb: Open-source Web Application Firewall (WAF)

GitHub, News, open source, software / SecurityTicks

BunkerWeb: Open-source Web Application Firewall (WAF) 2024-07-10 at 07:01 By Mirko Zorz BunkerWeb is an open-source Web Application Firewall (WAF) distributed under the AGPLv3 free license. The solution’s core code is entirely auditable by a third party and the community. “The genesis of BunkerWeb comes from the following problem: every time someone from my team

React to this headline:

BunkerWeb: Open-source Web Application Firewall (WAF) Read More »

Monocle: Open-source LLM for binary analysis search

Don't miss, GitHub, Hot stuff, LLMs, machine learning, News, open source, software / SecurityTicks

Monocle: Open-source LLM for binary analysis search 2024-07-08 at 06:31 By Help Net Security Monocle is open-source tooling backed by a large language model (LLM) for performing natural language searches against compiled target binaries. Monocle can be provided with a binary and search criteria (authentication code, vulnerable code, password strings, etc.), and it will decompile

React to this headline:

Monocle: Open-source LLM for binary analysis search Read More »

Secator: Open-source pentesting Swiss army knife

Don't miss, GitHub, Hot stuff, News, open source, penetration testing, software / SecurityTicks

Secator: Open-source pentesting Swiss army knife 2024-07-03 at 07:01 By Help Net Security Secator is an open-source task and workflow runner tailored for security assessments. It facilitates the use of numerous security tools and aims to enhance the efficiency of pen testers and security researchers. Secator features Curated list of commands Unified input options Unified

React to this headline:

Secator: Open-source pentesting Swiss army knife Read More »

Portainer: Open-source Docker and Kubernetes management

containers, Docker, GitHub, Kubernetes, News, open source, software / SecurityTicks

Portainer: Open-source Docker and Kubernetes management 2024-07-01 at 07:32 By Mirko Zorz Portainer Community Edition is an open-source, lightweight service delivery platform for containerized applications. It enables the management of Docker, Swarm, Kubernetes, and ACI environments. It provides a smart GUI and a comprehensive API to manage your orchestrator resources, including containers, images, volumes, networks,

React to this headline:

Portainer: Open-source Docker and Kubernetes management Read More »

Gitleaks: Open-source solution for detecting secrets in your code

Data leak, Don't miss, GitHub, Hot stuff, News, open source, software / SecurityTicks

Gitleaks: Open-source solution for detecting secrets in your code 2024-06-27 at 07:37 By Mirko Zorz Gitleaks is an open-source SAST tool designed to detect and prevent hardcoded secrets such as passwords, API keys, and tokens in Git repositories. With more than 15 million Docker downloads, 16,200 GitHub stars, 7 million GitHub downloads, thousands of weekly

React to this headline:

Gitleaks: Open-source solution for detecting secrets in your code Read More »

Developer errors lead to long-term exposure of sensitive data in Git repos

Aqua Security, cybersecurity, data, Don't miss, GitHub, News, open source, report, software, software development / SecurityTicks

Developer errors lead to long-term exposure of sensitive data in Git repos 2024-06-26 at 15:01 By Help Net Security Credentials, API tokens, and passkeys – collectively referred to as secrets – from organizations around the globe were exposed for years, according to Aqua Security’s latest research. By scanning the most popular 100 organizations on GitHub,

React to this headline:

Developer errors lead to long-term exposure of sensitive data in Git repos Read More »

Zeek: Open-source network traffic analysis, security monitoring

cybersecurity, Don't miss, GitHub, Hot stuff, monitoring, network analysis, network monitoring, News, open source, software / SecurityTicks

Zeek: Open-source network traffic analysis, security monitoring 2024-06-25 at 07:01 By Mirko Zorz Zeek is an open-source network analysis framework. Unlike an active security device such as a firewall, Zeek operates on a versatile ‘sensor’ that can be a hardware, software, virtual, or cloud platform. This flexibility allows Zeek to quietly monitor network traffic, interpret

React to this headline:

Zeek: Open-source network traffic analysis, security monitoring Read More »

Cilium: Open-source eBPF-based networking, security, observability

cybersecurity, Don't miss, GitHub, Hot stuff, networking, News, open source, software / SecurityTicks

Cilium: Open-source eBPF-based networking, security, observability 2024-06-21 at 07:01 By Help Net Security Cilium is an open-source, cloud-native solution that leverages eBPF technology in the Linux kernel to provide, secure, and monitor network connectivity between workloads. What is eBPF? eBPF is a technology originating from the Linux kernel that allows sandboxed programs to run in

React to this headline:

Cilium: Open-source eBPF-based networking, security, observability Read More »

SELKS: Open-source Suricata IDS/IPS, network security monitoring, threat hunting

cybersecurity, Don't miss, GitHub, Hot stuff, News, open source, software, Stamus Networks / SecurityTicks

SELKS: Open-source Suricata IDS/IPS, network security monitoring, threat hunting 2024-06-19 at 07:33 By Mirko Zorz SELKS is a free, open-source, turnkey solution for Suricata-based network intrusion detection and protection (IDS/IPS), network security monitoring (NSM), and threat hunting. The project is developed and maintained by Stamus Networks. SELKS is an effective production-grade solution for many small

React to this headline:

SELKS: Open-source Suricata IDS/IPS, network security monitoring, threat hunting Read More »

Ghidra: Open-source software reverse engineering framework

cybersecurity, Don't miss, GitHub, Government, Hot stuff, News, NSA, open source, software / SecurityTicks

Ghidra: Open-source software reverse engineering framework 2024-06-17 at 07:01 By Help Net Security Ghidra, a cutting-edge open-source software reverse engineering (SRE) framework, is a product of the National Security Agency (NSA) Research Directorate. The framework features high-end software analysis tools, enabling users to analyze compiled code across various platforms, including Windows, macOS, and Linux. Ghidra’s

React to this headline:

Ghidra: Open-source software reverse engineering framework Read More »

GitHub Paid Out Over $4 Million via Bug Bounty Program

bug bounty program, GitHub, Vulnerabilities / SecurityTicks

GitHub Paid Out Over $4 Million via Bug Bounty Program 2024-06-12 at 15:16 By Eduard Kovacs The code hosting platform GitHub has paid out more than $4 million since the launch of its bug bounty program 10 years ago. The post GitHub Paid Out Over $4 Million via Bug Bounty Program appeared first on SecurityWeek.

React to this headline:

GitHub Paid Out Over $4 Million via Bug Bounty Program Read More »

Radare: Open-source reverse engineering framework

cybersecurity, Don't miss, GitHub, Hot stuff, News, open source, software / SecurityTicks

Radare: Open-source reverse engineering framework 2024-06-10 at 07:32 By Mirko Zorz Radare is an open-source UNIX-like reverse engineering framework and command-line toolset. It can be scripted, modified, and used for batch analysis. “I started the project in 2006 when I was working as a forensic analyst, and I wrote a simple command-line hexadecimal editor to

React to this headline:

Radare: Open-source reverse engineering framework Read More »