Top 23 Go security-tool Projects

security-tools

• Add a project

• trivy

  88 23,115 9.8 Go

  Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

  

  Project mention: 🛡️ Effective Vulnerability Monitoring in Kubernetes | dev.to | 2024-08-26

• SaaSHub

  www.saashub.com featured

  SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

  

• gitleaks

  39 17,529 8.5 Go

  Protect and discover secrets using Gitleaks 🔑

  

  Project mention: Gitleaks – Protect and Discover Secrets | news.ycombinator.com | 2024-09-08

• trufflehog

  29 15,848 9.9 Go

  Find, verify, and analyze leaked credentials

  

  Project mention: Accident Forgiveness | news.ycombinator.com | 2024-08-24

  https://github.com/trufflesecurity/trufflehog is a similar tool but checks for far more secrets, so I think it'd be a better choice.

• SafeLine

  141 12,072 9.6 Go

  serve as a reverse proxy to protect your web services from attacks and exploits.

  

  Project mention: 6 Powerful Free Security Tools That Will Surprise You | dev.to | 2024-10-09

  Tool Link: https://waf.chaitin.com/

• vuls

  3 10,930 9.2 Go

  Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices

  

• sliver

  20 8,315 9.5 Go

  Adversary Emulation Framework

  

• gosec

  21 7,772 9.1 Go

  Go security checker

  

  Project mention: About the gosec G115 drama, or how I faced back integer conversion overflow in Go | dev.to | 2024-09-09

  Because of this, gosec a linter focused on improving the security in Go, provided a linter to detect the issue: the linter G115

• certificates

  41 6,663 9.6 Go

  🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.

  

  Project mention: Special-Use Domain 'Home.arpa.' | news.ycombinator.com | 2024-06-04

  I've been doing this for a while with SmallStep CA: https://github.com/smallstep/certificates

  It's a bit of a pain to load a cert onto every device (easier with stuff like Ansible if you have a bunch of linux devices), but manageable. And it lets me do proper trusted TLS for a lot of stuff that would otherwise be self-signed.

  One thing I recommend is to add X509v3 Name Constraints extensions to your root CA if you go down this path. It prevents the CA from being abused to MITM you for other URLS (at least for browsers/clients that respect names constraints)

  ```

• traitor

  17 6,631 0.0 Go

  :arrow_up: :skull_and_crossbones: :fire: Automatic Linux privesc via exploitation of low-hanging fruit e.g. gtfobins, pwnkit, dirty pipe, +w docker.sock

• osv-scanner

  10 6,154 9.7 Go

  Vulnerability scanner written in Go which uses the data provided by https://osv.dev

  

• scan4all

  1 5,463 6.8 Go

  Official repository vuls Scan: 15000+PoCs; 23 kinds of application password crack; 7000+Web fingerprints; 146 protocols and 90000+ rules Port scanning; Fuzz, HW, awesome BugBounty( ͡° ͜ʖ ͡°)...

  

• syzkaller

  7 5,331 9.8 Go

  syzkaller is an unsupervised coverage-guided kernel fuzzer

  

  Project mention: Automated Unit Test Improvement Using Large Language Models at Meta | news.ycombinator.com | 2024-02-17

  https://arxiv.org/abs/2402.09171 :

  > This paper describes Meta's TestGen-LLM tool, which uses LLMs to automatically improve existing human-written tests. TestGen-LLM verifies that its generated test classes successfully clear a set of filters that assure measurable improvement over the original test suite, thereby eliminating problems due to LLM hallucination. [...] We believe this is the first report on industrial scale deployment of LLM-generated code backed by such assurances of code improvement.

  Coverage-guided unit test improvement might [with LLMs] be efficient too.

  https://github.com/topics/coverage-guided-fuzzing :

  - e.g. Google/syzkaller is a coverage-guided syscall fuzzer: https://github.com/google/syzkaller

  - Gitlab CI supports coverage-guided fuzzing: https://docs.gitlab.com/ee/user/application_security/coverag...

  - oss-fuzz, osv

  Additional ways to improve tests:

  Hypothesis and pynguin generate tests from type annotations.

  There are various tools to generate type annotations for Python code;

  > pytype (Google) [1], PyAnnotate (Dropbox) [2], and MonkeyType (Instagram) [3] all do dynamic / runtime PEP-484 type annotation type inference [4] to generate type annotations. https://news.ycombinator.com/item?id=39139198

  icontract-hypothesis generates tests from icontract DbC Design by Contract type, value, and invariance constraints specified as precondition and postcondition @decorators:

• osmedeus

  2 5,283 6.1 Go

  A Workflow Engine for Offensive Security

• spicedb

  38 4,995 9.7 Go

  Open Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data

  

• Modlishka

  11 4,805 6.0 Go

  Modlishka. Reverse Proxy.

• terrascan

  23 4,708 6.3 Go

  Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.

  

  Project mention: Cloud Security and Resilience: DevSecOps Tools and Practices | dev.to | 2024-05-01

  2. Terrascan: https://github.com/tenable/terrascan Terrascan detects security vulnerabilities and compliance violations across your IaC. Supports multiple cloud providers, ensuring that your infrastructure complies with security best practices.

• Cameradar

  3 4,058 3.6 Go

  Cameradar hacks its way into RTSP videosurveillance cameras

• cli

  8 3,651 9.4 Go

  🧰 A zero trust swiss army knife for working with X509, OAuth, JWT, OATH OTP, etc. (by smallstep)

  

  Project mention: Google will disable all but OAuth for IMAP, SMTP and POP starting Sept. 30 | news.ycombinator.com | 2024-01-18

  https://github.com/smallstep/cli implements some OAuth flows from the CLI, it may be helpful for you.

• SecretScanner

  7 3,115 7.6 Go

  :unlock: :unlock: Find secrets and passwords in container images and file systems :unlock: :unlock:

  

• dockle

  2 2,761 4.2 Go

  Container Image Linter for Security, Helping build the Best-Practice Docker Image, Easy to start

  

• Stowaway

  33 2,732 7.7 Go

  👻Stowaway -- Multi-hop Proxy Tool for pentesters

  Project mention: Stowaway -- Multi-hop Proxy Tool for pentesters | /r/hacking | 2023-11-13

• ContainerSSH

  12 2,675 5.1 Go

  ContainerSSH: Launch containers on demand

  

• Picocrypt

  78 2,427 8.0 Go

  A very small, very simple, yet very secure encryption tool.

Go security-tools related posts

• Do not use secrets in environment variables and

  6 projects | news.ycombinator.com | 7 Oct 2024

• About the gosec G115 drama, or how I faced back integer conversion overflow in Go

  1 project | dev.to | 9 Sep 2024

• Gitleaks – Protect and Discover Secrets

  1 project | news.ycombinator.com | 8 Sep 2024

• Day 25: Container Security with Trivy - My 90 Days of DevOps Journey

  1 project | dev.to | 14 Aug 2024

• Enhancing Kubernetes Security with Trivy : Day 15 of 50 days DevOps Tools Series

  1 project | dev.to | 24 Jul 2024

• Gitleaks: Find forgotten codes in your repositories

  2 projects | dev.to | 13 Jul 2024

• Special-Use Domain 'Home.arpa.'

  1 project | news.ycombinator.com | 4 Jun 2024
• A note from our sponsor - SaaSHub
  www.saashub.com | 9 Oct 2024

  SaaSHub helps you find the best software and product alternatives Learn more →

Index

Sponsored

SaaSHub - Software Alternatives and Reviews

SaaSHub helps you find the best software and product alternatives

www.saashub.com

Do not miss the trending Go projects with our weekly report!