thehardwarestore.ai

FOSSLight Hub is an open-source compliance and security platform that manages open source software (OSS) inventories, licenses, vulnerabilities, and compliance workflows. It provides a web interface for OSS identification, license management, vulnerability tracking, self-check audits, SBOM generation (SPDX, CycloneDX), and supply chain management. The system is architected as a Spring Boot backend with MyBatis persistence, JWT-based authentication, and REST APIs (v2 and lite). It features a dual frontend: a legacy server-rendered UI using jqGrid and Thymeleaf, and a modern Next.js 'lite' client built with React, Tailwind CSS, and Recoil. Key entry points include API controllers (e.g., LiteOssController, ApiOssV2Controller), service layer components, and scheduled tasks for NVD/OSV vulnerability synchronization. External dependencies include MariaDB, a mail server, external license APIs (GitHub, ClearlyDefined), NVD/OSV vulnerability feeds, and the FOSSLight Scanner. The platform is actively developed with continuous releases and a growing feature set, though it carries some technical debt from legacy frontend libraries and enterprise-specific hardcoding.

CDK (Container Docker/Kubernetes Exploitation Toolkit) is a Go-based CLI penetration testing tool designed for container and Kubernetes environments. It evaluates security posture by running extensive checks against container runtime configurations, K8s API permissions, cloud metadata, and kernel exploit possibilities. It then executes a plethora of exploits covering container escape (cgroups, mount, eBPF, runc/containerd CVEs), K8s credential access (secrets, configmaps, tokens), persistence (backdoor daemonsets, cronjobs, shadow API server), privilege escalation (service account token theft, CVE-2026-31431), and remote control (reverse shells, kubelet exec). The binary bundles stripped-down versions of common tools (kubectl, netcat, vi, etc.) for post-exploitation use. The architecture follows a plugin pattern where exploits register themselves via init(), and evaluation uses a category-based check system. The codebase shows signs of organic growth with some legacy cruft (deprecated auto-escape task, commented-out code, future-dated CVEs) and moderate technical debt (global mutable state, panics, outdated Go idioms), but remains functional and actively maintained for penetration testers and security researchers.