Security
I use 1Password password manager for saving all my passwords, various other credentials and private notes and it has been a lifesaver thus far. Having a unique password for all my accounts and using 2FA wherever available means I should be quite safe in case any of my accounts gets breached or the password gets leaked.
Notes
Links
- SOPS - Editor of encrypted files that supports YAML, JSON, ENV, INI and BINARY formats and encrypts with AWS KMS, GCP KMS, Azure Key Vault and PGP.
- ClusterFuzz - Scalable fuzzing infrastructure which finds security and stability issues in software.
- Sliver - General purpose cross-platform implant framework that supports C2 over Mutual-TLS, HTTP(S), and DNS.
- Messaging Layer Security (MLS) - Security layer for encrypting messages in groups of size two to many.
- mkcert - Simple zero-config tool to make locally trusted development certificates with any names you'd like.
- is-website-vulnerable - Finds publicly known security vulnerabilities in a website's frontend JavaScript libraries.
- Wifiphisher - Rogue Access Point framework for conducting red team engagements or Wi-Fi security testing. (Code)
- Dispatch - All of the ad-hoc things you're doing to manage incidents today, done for you, and much more.
- disclose.io - Cross-industry, vendor-agnostic standardization project for safe harbor† best practices to enable good-faith security research. (Code) (GitHub)
- Panther - Cloud-native platform for detecting threats with log data, improving cloud security posture, and conducting investigations.
- bettercap - Swiss Army knife for 802.11, BLE and Ethernet networks reconnaissance and MITM attacks.
- testssl.sh - Command line tool which checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as some cryptographic flaws.
- The SSO Wall of Shame - List of vendors that treat single sign-on as a luxury feature, not a core security requirement.
- Password Manager Resources - Place for creators of password managers to collaborate on resources to make password management better for everyone.
- Payloads All The Things - List of useful payloads and bypass for Web Application Security and Pentest/CTF.
- Chamber - CLI for managing secrets. Currently it does so by storing secrets in SSM Parameter Store, an AWS service for storing secrets.
- EarlyBird - Sensitive data detection tool capable of scanning source code repositories for clear text password violations, PII, outdated cryptography methods, key files and more.
- Awesome Hacking - Curated list of hacking tools for hackers, pentesters and security researchers. (Web)
- HashiCorp Boundary (2020) - Simple and secure remote access — to any system anywhere based on trusted identity. (Code) (Announcement) (HN)
- Google Security Research - Hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google.
- OWASP Cheat Sheets - Collection of high value information on specific application security topics. (Code)
- Infection Monkey - Open source security tool for testing a data center's resiliency to perimeter breaches and internal server infection.
- OpenEDR - Free and open source platform allows you to analyze what’s happening across your entire environment at base-security-event level.
- Cloud Custodian - Rules engine for cloud security, cost optimization, and governance, DSL in yaml for policies to query, filter, and take actions on resources. (Web)
- Honest Security - Guide to endpoint security and device management that doesn't erode your values. (Code)
- Starting Up Security - Collection of information security essays and links to help growing teams manage risks.
- Mobile Verification Toolkit (MVT) - Forensic tool to look for signs of infection in smartphone devices. (HN)
- The Insecurity Industry (2021) - The greatest danger to national security has become the companies that claim to protect it. (HN)
- Elkeid - Cloud-Native Host-Based Intrusion Detection solution project to provide next-generation Threat Detection and Behavior Audition with modern architecture.
- go-tuf - Go implementation of The Update Framework (TUF), a framework for securing software update systems.
- OWASP Top 10 2021 - Nonprofit foundation that works to improve the security of software. (Code) (HN)
- PASETO: Platform-Agnostic Security Tokens - Everything you love about JOSE (JWT, JWE, JWS) without any of the many design deficits that plague the JOSE standards.
- Salus (Security Automation as a Lightweight Universal Scanner) - Tool for coordinating the execution of security scanners.
- Allstar - GitHub App installed on organizations or repositories to set and enforce security policies.
- SLSA (Supply-chain Levels for Software Artifacts) - Security framework from source to service, giving anyone working with software a common language for increasing levels of software security and supply chain integrity. (Code)
- Notary - Aims to make the internet more secure by making it easy for people to publish and verify content.
- Trojan Source Attacks - Attack the encoding of source code files to inject vulnerabilities. (HN) (Code)
- CNCF Security Technical Advisory Group - Secure access, policy control, privacy, auditing, explainability and more.
- Nym Privacy Platform - Provides strong network-level privacy against sophisticated end-to-end attackers, and anonymous transactions using blinded, re-randomizable, decentralized credentials. (Web)
- LunaSec - End-to-end security system designed to protect your application by transparently encrypting sensitive data, from browser to database.
Last modified 3d ago