DOCSEARCHbyAlgolia
Submit Docs

Awesome Security

repository·master·Indexed 12 days ago

https://github.com/sbilly/awesome-security

A curated, community-driven collection of security-related resources, including software, libraries, and documentation. Organized by domains such as Network, Endpoint, Threat Intelligence, Social Engineering, Web, and Red Team Infrastructure, it features tools for vulnerability scanning, IDS/IPS, SIEM, DFIR, and mobile security.

Tokens
5.5K
Snippets
3
Records
35
Agent score
47%

What's inside Awesome Security

  1. Overview of Awesome Security resources

    master
    Awesome Security is a categorized, community-driven collection of software, libraries, documents, books, and resources related to the security domain. It is organized into several high-level domains including Network, Endpoint, Threat Intelligence, Social Engineering, Web, and Red Team Infrastructure.

  2. Explore Threat Intelligence sources

    master

    The awesome-security repository provides a curated list of Threat Intelligence resources for identifying malicious actors, command-and-control servers, and indicators of compromise (IOCs). These resources can be used to build blocklists, feed IDS/IPS systems, or automate incident response.

    Key categories of intelligence available include:

    • Malware & C2 Tracking: Services like abuse.ch (ZeuS, SpyEye, Feodo trackers) and DNS-BH provide domain and IP blocklists for known malware propagation.
    • Phishing Intelligence: PhishTank and PhishStats offer data on phishing campaigns, with PhishTank providing an open API for integration.
    • Spam & Reputation: Spamhaus provides real-time anti-spam protection (SBL/XBL/PBL/DBL/DROP/ROKSO).
    • Vulnerability & IOC Feeds: FireEye OpenIOCs and OpenVAS NVT Feed provide structured indicators and vulnerability tests.
    • Threat Sharing Platforms: MISP (Open Source Threat Intelligence Platform) and CIFv2 allow for gathering, sharing, and correlating security indicators.
    • Automated Collection: IntelMQ is designed for CERTs to collect and process security feeds (pastebins, tweets, etc.) via message queues.

  5. Secure your terminal environment

    master

    Enhance terminal security with these utilities:

    • shellfirm: Adds an extra approval step/prompt challenge when risky command patterns are detected to prevent accidental execution of dangerous commands.
    • shellclear: Scans your shell history to find and clean sensitive commands (e.g., commands containing passwords or keys).

  7. Analyze security data with Big Data tools

    master

    For large-scale security data analysis, several tools are available:

    • data_hacking: Uses IPython, Pandas, and Scikit Learn for security data science.
    • hadoop-pcap: A Hadoop library specifically for reading packet capture (PCAP) files.
    • OpenSOC / Apache Metron: Centralized tools for security monitoring and analysis using big data technologies.
    • Apache Spot: Leverages insights from flow and packet analysis.
    • binarypig: Performs scalable binary data extraction and malware analytics over Hadoop using Pig, Django, and Elasticsearch.
    • Matano: A serverless security lake on AWS using Apache Iceberg for petabyte-scale ingestion and real-time Python detections.
    • VAST: A security data pipeline engine designed for high-volume telemetry ingestion and large-scale threat hunting.

  8. Install Penetration Testing and Security Docker Images

    master

    Use Docker to quickly deploy environments for penetration testing, vulnerability research, or training:

    # Official Kali Linux
docker pull kalilinux/kali-linux-docker

# OWASP ZAP
docker pull owasp/zap2docker-stable

# WPScan
docker pull wpscanteam/wpscan

# Metasploit
docker pull remnux/metasploit

# Damn Vulnerable Web Application (DVWA)
docker pull citizenstig/dvwa

# Vulnerable WordPress
docker pull wpscanteam/vulnerablewordpress

# Shellshock (CVE-2014-6271)
docker pull hmlio/vaas-cve-2014-6271

# Heartbleed (CVE-2014-0160)
docker pull hmlio/vaas-cve-2014-0160

# Security Ninjas
docker pull opendns/security-ninjas

# Docker Bench for Security
docker pull diogomonica/docker-bench-security

# OWASP Security Shepherd
docker pull ismisepaul/securityshepherd

# OWASP WebGoat
docker pull danmx/docker-owasp-webgoat

# OWASP Mutillidae II
docker pull citizenstig/nowasp

# OWASP Juice Shop
docker pull bkimminich/juice-shop

# OWASP WrongSecrets
docker pull jeroenwillemsen/wrongsecrets

# Cyware Threat Response
docker run -dit --name trd -p 8081:80 cylabs/cy-threat-response

# CICD-Goat (using docker-compose)
docker-compose build && docker-compose up
    docker pull kalilinux/kali-linux-docker

  9. Implement Security in DevOps pipelines

    master

    Integrate the following tools into your CI/CD and DevOps workflows:

    • Vulnerability Scanning: Use Trivy for container and artifact scanning in CI, or cve-ape for non-intrusive CVE scanning of package lists.
    • OS Hardening: Use the ansible-os-hardening Ansible role to secure operating systems.
    • Supply Chain Security: Use Preflight to verify scripts and executables to mitigate supply chain attacks.
    • Secrets Management: Use Teller to manage secrets across multiple vaults and keystores from a single interface.
    • Policy as Code: Use Selefra for multi-cloud and SaaS policy analytics.

  10. Choose a security-oriented Operating System

    master

    Depending on your use case, consider these specialized operating systems:

    • Qubes OS: Security-oriented OS for single-user desktop computing using compartmentalization.
    • Whonix: Designed specifically for anonymity.
    • Tails OS: A portable OS focused on protecting against surveillance and censorship.

    For general guidance, refer to Rawsec for a complete list of security OSs or Distrowatch for reviews.

  11. Detect account takeover with FingerprintJS

    master
    Use FingerprintJS (for web/hybrid mobile) or FingerprintJS Android to identify users even after they purge local storage. This is used to detect account takeovers, account sharing, and repeated malicious activity.