betterscan-ce
osv.dev
betterscan-ce | osv.dev | |
---|---|---|
34 | 19 | |
686 | 1,407 | |
- | 2.1% | |
7.3 | 9.7 | |
24 days ago | 2 days ago | |
Python | Python | |
GNU General Public License v3.0 or later | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
betterscan-ce
-
Cloud and Code Security - betterscan.io
More on the website: www.betterscan.io
-
Do you SLSA or SBOM in your SDLC?
Maybe you will find https://github.com/marcinguy/betterscan-ce useful (scans SBOMs and Dependencies, apart from Code and IaC).
-
SBOM and dependencies check tool and vulnerabilities database from Google
P.S I also added it to my Security Automation/Orchestration project, it was missing there: https://github.com/marcinguy/betterscan-ce Hope it helps somebody.
-
Nosey Parker: a new scanner to find misplaced secrets in textual data and Git history
Congrats on release. Feel free to check out https://github.com/marcinguy/betterscan-ce It is not that fast, but detects 166+ secret types (modified trufflehog3) and also bugs and vulnerabilities in Code and Cloud setups.
-
OpenSSL 3.0.7 Published
If you want to scan binary to see if this uses vulnerable version, use this YARA rule: https://github.com/marcinguy/betterscan-ce/blob/master/analy...
Courtesy of Akamai.
If you don't know YARA tool, you can run this command in the folder where your binary is (it will install everything needed):
sh <(curl https://dl.betterscan.io/cli.sh)
Hope that helps somebody
-
Text4shell CVE-2022-42889 scan
More: https://github.com/marcinguy/betterscan-ce
- Asking for feedback about my business website
- PMD Apex Code Scanner with integration with CLI output (HTML, JSON, Terminal) or Platform
- Open Source (with Professional paid version) Apex Scanning Tool for Salesforce for Security, Quality and Best practices using PMD with many other checks (incl. secrets)
- Checkov + Kubescape + Code checks unified in one interface/UI or output
osv.dev
-
Magika: AI powered fast and efficient file type identification
Is it safe to assume that hashing (1) every file on disk, or (2) any given file on disk at random, will yield random bits with uniform probability; and (3) why Argon2 instead of e.g. only two rounds of SHA256?
https://github.com/google/osv.dev/blob/master/README.md#usin... :
> We provide a Go based tool that will scan your dependencies, and check them against the OSV database for known vulnerabilities via the OSV API. ... With package metadata, not (a file hash, package) database that could be generated from OSV and the actual package files instead of their manifest of already-calculated checksums.
Might as well be heating a pool on the roof with all of this waste heat from hashing binaries build from code of unknown static and dynamic quality.
Add'l useful formats:
> Currently it is able to scan various lockfiles, debian docker containers, SPDX and CycloneDB SBOMs, and git repositories
-
Dependabot vs RenovateBot
Also it supports an alternative sources of CVEs with https://osv.dev
-
Pyscan: A command-line tool to detect security issues in your python dependencies.
https://osv.dev its open source and even has a free API with almost all the popular languages. One of the inspirations for my project.
-
Announcing Pyscan: A dependency vulnerability scanner for python projects.
pyscan uses OSV as its database for now. There are plans to add a few more.
-
We should start to add “ai.txt” as we do for “robots.txt”
JSON-LD or RDFa (RDF in HTML attributes) in at least the /index.html the HTML footer should be sufficient to indicate that there is structured linked data metadata for crawlers that then don't need an HTTP request to a .well-known URL /.well-known/ai_security_reproducibility_carbon.txt.jsonld.json
OSV is a new format for reporting security vulnerabilities like CVEs and an HTTP API for looking up CVEs from software component name and version. https://github.com/google/osv.dev#third-party-tools-and-inte... :
> We provide a Go based tool that will scan your dependencies, and check them against the OSV database for known vulnerabilities via the OSV API.
> Currently it is able to scan various lockfiles, -- (repo2docker REES config files) -- debian docker containers, SPDX and CycloneDB SBOMs, and git repositories.
-
Ask HN: Most interesting tech you built for just yourself?
Something I've recently worked on is building an SQLite database of all the dependencies my organisation uses, which makes it possible to write our own queries and reports. The tool is all Open Source (https://dmd.tanna.dev) and has a CLI as well as the SQLite data.
Ive used it to look for software that's out of date (via https://endoflife.date), to find vulnerablilities (via https://osv.dev) and get license information (via https://deps.dev)
It's been hugely useful for us understanding use of internal and external dependencies, and I wish I'd built it earlier in my career so I could've had it for other companies I've worked at!
-
Malicious library inits?
Something like osv-scanner (https://osv.dev/), Github's depandabot etc would help to a great extend in detecting malicious dependencies. Not much else be done I guess
- Distributed vulnerability database for Open Source
- SBOM and dependencies check tool and vulnerabilities database from Google
-
Free tool for generating SBOM and CVEs against source or binaries
Have a look at https://security.googleblog.com/2022/12/announcing-osv-scanner-vulnerability.html they have plans for c++ https://github.com/google/osv.dev/issues/783
What are some alternatives?
awesome-guidelines - A curated list of high quality coding style conventions and standards.
osv-scanner - Vulnerability scanner written in Go which uses the data provided by https://osv.dev
certspotter - Certificate Transparency Log Monitor
noseyparker - Nosey Parker is a command-line program that finds secrets and sensitive information in textual data and Git history.
Awesome-Fuzzing - A curated list of fuzzing resources ( Books, courses - free and paid, videos, tools, tutorials and vulnerable applications to practice on ) for learning Fuzzing and initial phases of Exploit Development like root cause analysis.
ThreatPlaybook - A unified DevSecOps Framework that allows you to go from iterative, collaborative Threat Modeling to Application Security Test Orchestration
certificate-transparency-go - Auditing for TLS certificates (Go code)
CVE-2022-3602
tincan-tls - A cleanroom implementation of TLS 1.3
trufflehog - Find and verify secrets
Botan - Cryptography Toolkit