![](/assets/headers/header-logo.png)

![](https://img.shields.io/badge/Tools%20%26%20Resources%20Available-26-757575?style=for-the-badge)

### AWS

* [Cloudsplaining](https://github.com/salesforce/cloudsplaining) - Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized report. ![last-commit](https://img.shields.io/github/last-commit/salesforce/cloudsplaining?style=flat)
* [Greyhat Warfare](https://buckets.grayhatwarfare.com/) - Search scanned archived AWS buckets.
* [pacu](https://github.com/RhinoSecurityLabs/pacu) - The AWS exploitation framework, designed for testing the security of Amazon Web Services environments. ![last-commit](https://img.shields.io/github/last-commit/RhinoSecurityLabs/pacu?style=flat)
* [Prowler](https://github.com/toniblyx/prowler) - Prowler is a security tool to perform AWS security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness. ![last-commit](https://img.shields.io/github/last-commit/toniblyx/prowler?style=flat)
* [ScoutSuite](https://github.com/nccgroup/ScoutSuite) - Multi-Cloud Security Auditing Tool. ![last-commit](https://img.shields.io/github/last-commit/nccgroup/ScoutSuite?style=flat)
* [WeirdAAL](https://github.com/carnal0wnage/weirdAAL) - WeirdAAL (AWS Attack Library) ![last-commit](https://img.shields.io/github/last-commit/carnal0wnage/weirdAAL?style=flat)

### Azure

* [Azurcar](https://github.com/nccgroup/azucar) - Security auditing tool for Azure environments ![last-commit](https://img.shields.io/github/last-commit/nccgroup/azucar?style=flat)
* [Greyhat Warfare](https://buckets.grayhatwarfare.com/) - Search scanned archived AWS buckets.
* [ScoutSuite](https://github.com/nccgroup/ScoutSuite) - Multi-Cloud Security Auditing Tool ) ![last-commit](https://img.shields.io/github/last-commit/nccgroup/ScoutSuite?style=flat)

### Buckets

* [OpenBuckets](https://openbuckets.io/) - Search public or misconfigured AWS, Azure, Digital Ocean, GCP, IBM, Linode, and Alibaba buckets.

### Containers
* [Checkov](https://github.com/bridgecrewio/checkov) - Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages. ![last-commit](https://img.shields.io/github/last-commit/bridgecrewio/checkov?style=flat)
* [Clair](https://github.com/quay/clair) - Vulnerability Static Analysis for Containers. ![last-commit](https://img.shields.io/github/last-commit/quay/clair?style=flat)
* [Dacker Daemon Attack Surface](https://docs.docker.com/engine/security/#docker-daemon-attack-surface) - There are four major areas to consider when reviewing Docker security
* [Dockle](https://github.com/goodwithtech/dockle) - Container Image Linter for Security, Helping build the Best-Practice Docker Image, Easy to star. ![last-commit](https://img.shields.io/github/last-commit/goodwithtech/dockle?style=flat)
* [Grype](https://github.com/anchore/grype) - A vulnerability scanner for container images and filesystems. ![last-commit](https://img.shields.io/github/last-commit/anchore/grype?style=flat)
* [IceKube](https://github.com/WithSecureLabs/IceKube) - A tool to help find attack paths within a Kubernetes cluster from a low privileged point, to a preferred location, typically cluster-admin. ![last-commit](https://img.shields.io/github/last-commit/WithSecureLabs/IceKube?style=flat)
* [Scancode Toolkit](https://github.com/aboutcode-org/scancode-toolkit) - ScanCode detects licenses, copyrights, and dependencies to discover and inventory open source and third-party packages used in your code. ![last-commit](https://img.shields.io/github/last-commit/aboutcode-org/scancode-toolkit?style=flat)
* [Syft](https://github.com/anchore/syft) - CLI tool and library for generating a Software Bill of Materials from container images and filesystems. ![last-commit](https://img.shields.io/github/last-commit/anchore/syft?style=flat)
* [Trivy](https://github.com/aquasecurity/trivy) - Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more. ![last-commit](https://img.shields.io/github/last-commit/aquasecurity/trivy?style=flat)

### Git

* [gitleaks](https://github.com/zricethezav/gitleaks) - Scan git repos \(or files\) for secrets using regex and entropy. ![last-commit](https://img.shields.io/github/last-commit/zricethezav/gitleaks?style=flat)
* [gitrob](https://github.com/michenriksen/gitrob) - Reconnaissance tool for GitHub organizations ![last-commit](https://img.shields.io/github/last-commit/michenriksen/gitrob?style=flat)
* [GitRoller](https://github.com/mansoorr123/GitRoller) - GitRoller: A Git Recon Tools ![last-commit](https://img.shields.io/github/last-commit/mansoorr123/GitRoller?style=flat)
* [go-gitaudit](https://github.com/r-pai/go-gitaudit) - Git audit is a go package which can be used to audit git repository to find issues. ![last-commit](https://img.shields.io/github/last-commit/r-pai/go-gitaudit?style=flat)
* [shhgit](https://github.com/eth0izzle/shhgit) - Find secrets in your code. Secrets detection for your GitHub, GitLab and Bitbucket repositories. ![last-commit](https://img.shields.io/github/last-commit/eth0izzle/shhgit?style=flat)
* [truffleHog](https://github.com/trufflesecurity/truffleHog) - Searches through git repositories for high entropy strings and secrets, digging deep into commit history. ![last-commit](https://img.shields.io/github/last-commit/trufflesecurity/truffleHog?style=flat)
* [Yar](https://github.com/nielsing/yar) - Yar is a tool for plunderin' organizations, users and/or repositories. ![last-commit](https://img.shields.io/github/last-commit/nielsing/yar?style=flat)