This repository is a comprehensive, curated collection of cybersecurity references, scripts, tools, code, labs, and training resources, primarily authored by Omar Santos. It serves as supplemental material for his books, video courses, and live training, covering a vast range of domains including offensive security, defensive security, application security, cloud/container security, hardware/embedded security, AI/ML security, and certification preparation (Cisco, CompTIA, ISC2, etc.). The repo is hybrid in nature: while it contains hundreds of runnable scripts and tools (e.g., network scanners, exploit examples, API security testers, AI-powered log analyzers), its dominant character is that of an educational knowledge base and reference library rather than a deployable application. The content is organized into clear domain directories, with extensive READMEs acting as curated indexes of tools, papers, talks, and labs. The AI security section is particularly well-developed, including course materials on agentic AI, prompt engineering, and the Foundry Security Spec. The repository is actively maintained, with recent commits and automated CI workflows, though the breadth of content introduces risks of link rot and technology churn in fast-moving areas like AI frameworks and certification blueprints.
CDK (Container Docker/Kubernetes Exploitation Toolkit) is a Go-based CLI penetration testing tool designed for container and Kubernetes environments. It evaluates security posture by running extensive checks against container runtime configurations, K8s API permissions, cloud metadata, and kernel exploit possibilities. It then executes a plethora of exploits covering container escape (cgroups, mount, eBPF, runc/containerd CVEs), K8s credential access (secrets, configmaps, tokens), persistence (backdoor daemonsets, cronjobs, shadow API server), privilege escalation (service account token theft, CVE-2026-31431), and remote control (reverse shells, kubelet exec). The binary bundles stripped-down versions of common tools (kubectl, netcat, vi, etc.) for post-exploitation use. The architecture follows a plugin pattern where exploits register themselves via init(), and evaluation uses a category-based check system. The codebase shows signs of organic growth with some legacy cruft (deprecated auto-escape task, commented-out code, future-dated CVEs) and moderate technical debt (global mutable state, panics, outdated Go idioms), but remains functional and actively maintained for penetration testers and security researchers.