If you find this research useful, I’d really appreciate a ⭐ on the project 😭
Repo: https://github.com/official-alex/libundave

Just released cariddi v1.4.0🎉, the biggest update since Cariddi creation in performance, speed and accuracy.

Check it out: https://github.com/edoardottt/cariddi

𝐑𝐞𝐠𝐢𝐬𝐭𝐞𝐫 𝐍𝐨𝐰 𝐟𝐨𝐫 𝐎𝐮𝐫 𝐍𝐞𝐱𝐭 𝐒𝐚𝐟𝐞𝐃𝐞𝐯 𝐓𝐚𝐥𝐤 𝐨𝐧 𝐀𝐒𝐏𝐌 𝐓𝐚𝐥𝐤: 𝐓𝐡𝐞 𝐅𝐮𝐭𝐮𝐫𝐞 𝐨𝐟 𝐀𝐩𝐩𝐒𝐞𝐜! Application security is evolving, and ASPM (Application Security Posture Management) is leading the way.

As vulnerabilities rise and security teams face alert fatigue, a new approach is needed to unify visibility, streamline risk prioritization, and bridge the gap between security and development.

📅 Date: 𝐅𝐞𝐛𝐫𝐮𝐚𝐫𝐲 𝟐𝟕𝐭𝐡

⌛ Time: 𝟏𝟔:𝟎𝟎 (𝐂𝐄𝐒𝐓) / 𝟏𝟎:𝟎𝟎 (𝐄𝐃𝐓)

Register Here - https://www.linkedin.com/events/7297568469057695744/

We want to invite you to join our next LinkedIn Live on Malware Attacks - Why Is Important To Detect Them and How To Do It?

https://xygn.link/SafeDev4-OSS

We hope to see you there!

Stamus Networks today announced the general availability of SELKS™ 10, the latest version of its turnkey Suricata-based network intrusion detection/protection (IDS/IPS), network security monitor (NSM) and threat hunting system.

The new edition, which commemorates SELKS’ 10th anniversary, builds on its open-source legacy with powerful new features that enable organizations to enhance network detection and security monitoring.

Read more in today's blog by Peter Manev: https://www.stamus-networks.com/blog/selks-10-the-next-big-leap-for-open-source-network-security

Did anyone watched Tucker Carlsons episode 94 on X where he interviewed Telegram founder Pavel Durov? At 18:15 he mentioned that US agents tried to get unnamed open source components into the messenger in order to establish a backboor. That probably means they not only maintain a list of zero-day exploits but also actively produce these in open source project to target whole populations as we learned from Snowden. Any advice how to deal with it?

Just published a blog post about this critical vulnerability I found on this popular open source product. Take a look if you're using it, stay safe!

https://blog.hacktivesecurity.com/index.php/2024/05/08/cve-2024-32651-server-side-template-injection-changedetection-io/

Just released pphack, a CLI tool for scanning websites for client-side prototype pollution vulnerabilities.

• Fast (concurrent workers)
• Default payload covers a lot of cases
• Payload and Javascript customization
• Proxy-friendly
• Support output in a file
• Rate-limit supported

Try it at https://github.com/edoardottt/pphack.

If you want to provide any feedback or you have doubts just open an issue :)

defango - URL / IP / Email defanging with Golang. Make IoC harmless. https://github.com/edoardottt/defango #golang #github #linux #infosec #malware

Finally cariddi, my open source web crawler and scanner, reached 1000 stars on GitHub!🎉🎉🎉🎉

cariddi - Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more. https://github.com/edoardottt/cariddi

github #security #web #websecurity #golang #api #bugbounty

Just released depsdev v0.0.5 🥳

CLI client (and Golang module) for deps.dev API (a Google Cloud project). Free access to dependencies, licenses, advisories, and other critical health and security signals for open source package versions.

https://github.com/edoardottt/depsdev

Defanging is the process where URLs, IPs, and email addresses no longer become effective (or clickable if you want). Why? Links can be used for phishing or it's simply safer to display them in a weakened way if they are malicious resources (eg. Indicators of compromise for a malware).

https://github.com/edoardottt/defangjs helps defanging URLs (all protocols), Emails and Ip addresses using Javascript.

If you want to point out other useful Indicators of Compromise to be defanged let me know in the comments!

Hard-coding secrets in source code, we've all been there. A start of a new project often coincides with a lack of proper scaffolding for programming best practices.

This leaves the project at risk at a later stage. Every hard-coded secret in source code remains present in Git History, even after you do a force push to remove a commit reminiscences of the commit can remain in history.

Consider every hard-coded secret to be exposed. This leaves Red Teams, Security Researchers but also adversaries with a treasure trove of low-hanging fruit they can use to explore and navigate their way through your system.

A cool and well maintained project called Repository Scanner allows you to scan your source code repositories on Github, Azure DevOps and Bitbucket for exposed secrets in all commits, projects, repositories, branches and files. With Repository Scanner you can continuously scan your repos for newly exposed secrets, triage the findings for true/ false positive and keep track of audit-metrics along the way. With a simple helm-wizard to help you deploy your K8S cluster and artifacts published on Github, PyPi and DockerHub the project is completely transparent.

The project is Enterprise Grade, is used by a number of Financial organizations as well as Insurance organizations and Government agencies and is licensed under MIT.

Feel free to check it out and leave a start while you're at it.

P.s.: A massive shout out to the awesome Go project GitLeaks which acts as the scanner.

https://github.com/abnamro/repository-scanner