DOCSEARCHbyAlgolia
Submit Docs

CyberSecref Security Reference

website·Indexed 30 days ago

https://cybersecref.me

A repository of quick references, cheatsheets, and practical scripts for security, containers, and automation. It includes guides on tools like Semgrep, Nmap, Frida, MobSF, Trivy, and Dive, as well as security auditing for Kubernetes (Service Accounts, Pod Security) and Docker.

Tokens
14.9K
Snippets
93
Records
115
Agent score
48%

What's inside CyberSecref

  2. Create custom security detections with GitHub CodeQL

    GitHub CodeQL allows for the creation of custom security queries to detect vulnerabilities. Official free training is available via Microsoft Learn and GitHub Skills, covering the introduction to CodeQL and the process of writing QL queries.

  3. Explore Docker image layers using Dive

    Dive is a tool used to explore, analyze, and inspect the layers of a Docker image to understand what is being added in each layer and to identify opportunities for image size optimization.

  4. Explore Docker image layers using Dive

    Dive is a tool used to explore, analyze, and investigate Docker image layers to understand how the image is constructed and identify opportunities for size reduction.

  5. Set up Semgrep as a pre-commit hook

    Install Semgrep locally to catch security issues before they are committed to the repository.
    # .pre-commit-config.yaml
repos:
  - repo: https://github.com/semgrep/semgrep
    rev: v1.67.0
    hooks:
      - id: semgrep
        args: ["--config=auto", "--error", "--severity=ERROR"]

    Installation and usage

    pip install pre-commit pre-commit install

    Run manually on all files

    pre-commit run semgrep --all-files

  6. Explore a Docker image with dive

    Dive allows you to explore each layer of a Docker image to see which files were added, modified, or removed, helping you detect wasted space. You can either analyze an existing image or build and explore one in a single step.
    # Explore an existing image
dive nginx:latest

# Build and explore in one step
dive build -t myapp:latest .

  7. Access Google's Guide on Code Review Practices

    Google provides a comprehensive open guide on how to conduct code reviews, focusing on industry standards and managing trade-offs during the review process. This resource is recommended for teams looking to establish high-quality engineering standards for peer review.
    https://google.github.io/eng-practices/review/

  8. Reference the OWASP Code Review Guide for checklists and failure types

    The OWASP Code Review Guide is a free essential reference providing a structured approach to security reviews, including comprehensive checklists and detailed descriptions of common failure types.

  11. Explore Docker image layers using Dive

    Use the tool dive to explore and analyze the layers of a Docker image. This allows you to inspect the contents of each layer and understand how the image was built.