misconfiguration 开源项目推荐（90 个）

aquasecurity /trivy

在容器、Kubernetes、代码仓库、云环境等中发现漏洞、配置错误、密钥泄露和 SBOM

aquasecurity /tfsec

Tfsec is now part of Trivy

TH3xACE /SUDO_KILLER

A tool designed to exploit a privilege escalation vulnerability in the sudo program on Unix-like systems. It takes advantage of a specific misconfiguration or flaw in sudo to gain elevated privileges on the system, essentially allowing a regular user to execute commands as the root user.

aquasecurity /trivy-operator

Kubernetes-native security toolkit

nickvourd /Windows-Local-Privilege-Escalation-Cookbook

Windows Local Privilege Escalation Cookbook

firefart /stunner

Stunner is a tool to test and exploit STUN, TURN and TURN over TCP servers.

aquasecurity /chain-bench

An open-source tool for auditing your software supply chain stack for security compliance based on a new CIS Software Supply Chain benchmark.

fatihtokus /scan2html

A Trivy plugin that scans and outputs the results (vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more) to an interactive html file.

b3rito /yotter

yotter - bash script that performs recon and then uses dirb to discover directories that might lead to information leakage

OWASP /openshield

Open source CSPM for Azure - scan for misconfigurations and quantum-unsafe cryptography, map findings to CIS/NIST/ISO27001/SOC2, and fix them with one command

Vinum-Security /yandex-cloud-security

⛅️🔐 Security Requirements for Yandex.Cloud configuration: IAM, network access, key management, Kubernetes, audit logs.

badchars /cloud-audit-mcp

Cloud security audit tools for AI agents — AWS, Azure, GCP misconfiguration detection via MCP. 38 tools, 60+ checks. The agent finds vulns, not you.

pol4ir /MovementHound

PowerShell tool for active minimal-rights lateral movement enumeration, extending BloodHound Legacy

padok-team /yatas-aws

Plugin for YATAS that audits AWS accounts for misconfiguration and security issues

secshubhamsharma /FireSploit

FireSploit is a powerful tool for ethical hackers, developers, and security researchers. It helps find and fix misconfigured Firebase databases that are exposing sensitive data to the public. By scanning for open read/write access, it helps you secure your applications and prevent data breaches.

codershiyar /WinPrivilegeEscalation

This repository provides easy-to-follow methods for gaining admin rights (privilege escalation) on Windows 10, 11, and newer systems. Learn how to identify and exploit misconfigurations, weak permissions, and common security flaws to escalate user privileges. Perfect for ethical hackers, penetration testers, and security researchers looking to test

JashwanthMU /TerraSecure

Prevent cloud misconfigurations and find vulnerabilities during build time in infrastructure as code, powered with XGBoost ML Algorithm.

plexavo /Plexavo

Open-source, read-only AWS misconfiguration scanner. Python, boto3, runs locally.

Su1ph3r /vercelsior

Open-source security scanner and configuration auditor for Vercel. 130+ checks across 20 categories. Finds leaked tokens, WAF gaps, NEXT_PUBLIC_ secret leaks, subdomain takeover risks, Next.js CVEs, and more. Single binary, zero dependencies.

Kloudle /aws-iam-large-account-security

Security insights for AWS IAM in large-scale accounts (20K+ users), bypassing CSPM limitations.