shhgit
opencti
Our great sponsors
| shhgit | opencti | |
|---|---|---|
| 7 | 9 | |
| 3,787 | 4,617 | |
| - | 5.5% | |
| 0.0 | 10.0 | |
| 8 months ago | 6 days ago | |
| JavaScript | TypeScript | |
| MIT License | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
shhgit
- Tencent WeChat is now a GitHub secret scanning partner
- Why do people use plain text for usernames and passwords on Github? A cautionary tale.
-
Searching across github
Shhgit is a really neat tool for this
- Around 50,000 GitHub credentials leaked as metadata inside commits
-
TruffleHog v3 – Detect and automatically verify over 600 credential types
There are a lot of secret detection tools out there. It probably is going to depend a lot on the specific features you care about. I personally really like shhgit[0] which is MIT licensed and is the tool I've found to most match my workflows.
[0]: https://github.com/eth0izzle/shhgit
-
My MetaMask Private Keys Stolen from GitHub Private Repo in 1 Hour
Assuming that the person you were working with didn't drain your wallet, there are many tools which can be used to actively monitor for commits being done on GitHub with secrets of sort.
The first one that comes to my mind is shhgit (https://github.com/eth0izzle/shhgit)
Anyone can self host it and then add multiple GitHub Dev keys to it. Then this can be used to monitor GitHub commits being done, majority of which can be categorized as "secrets".
- Ask HN: What are the best automated tools for keeping credentials out of GitHub?
opencti
- GitHub - OpenCTI-Platform/opencti: Open Cyber Threat Intelligence Platform
-
Creating a cyber threat intelligence tool
It sounds like you want to jump into game development before learning how to write "Hello, world!". Try using any of the open source tools that already do this and sign up for some "free" threat intel tools and learn the lay of the land. https://www.misp-project.org/ https://github.com/OpenCTI-Platform/opencti https://iplists.firehol.org/ https://www.greynoise.io/
-
Threat analysis visualization?
An image - OpenCTI IOC Visualisation The system - OpenCTI Github
-
Cyber Threat Intelligence
Best thing you can do to start your CTI journey is building an OpenCTI server for yourself. After adding some connectors to your openCTI (AlienVault, malpedia, mitre...), you'll have a strong base to practice and learn CTI.
- OpenCTI - Open platform for cyber threat intelligence
-
Threat Intelligence platform recommendations
If you haven’t yet, check out OpenCTI https://github.com/OpenCTI-Platform/opencti
- OpenCTI-Platform/opencti - Open Cyber Threat Intelligence Platform
- OpenCTI Version 4.5.4 released
- OpenCTI: Release Version 4.5.0 - more filters are available in the TAXII collection API
What are some alternatives?
git-secrets - Prevents you from committing secrets and credentials into git repositories
MISP - MISP (core software) - Open Source Threat Intelligence and Sharing Platform
trufflehog - Find and verify credentials
deepdarkCTI - Collection of Cyber Threat Intelligence sources from the deep and dark web
gitleaks - Protect and discover secrets using Gitleaks 🔑
firewalla - http://firewalla.com
detect-secrets - A developer-friendly secrets detection tool for CI and pre-commit hooks based on Yelp's detect-secrets
Shuffle - Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.
automerge-action - GitHub action to automatically merge pull requests that are ready
CaptfEncoder - Captfencoder is opensource a rapid cross platform network security tool suite, providing network security related code conversion, classical cryptography, cryptography, asymmetric encryption, miscellaneous tools, and aggregating all kinds of online tools.
OSINT-Framework - OSINT Framework
awesome-nodejs-security - Awesome Node.js Security resources