vexctl is a command-line tool for creating, applying, and attesting VEX (Vulnerability Exploitability eXchange) data. It is built as a single binary using Cobra for CLI, with subcommands for creating VEX documents, merging them, filtering SARIF scanner results, generating attestations, and validating documents against the OpenVEX specification. The tool integrates with Sigstore for keyless signing and supports multiple VEX formats (OpenVEX native, CSAF, CycloneDX). It can attach VEX attestations to container images via OCI referrers API or legacy tag layout. The architecture follows a clean separation of concerns: CLI handlers in `internal/cmd/` delegate to a core library in `pkg/ctl/`, which uses an interface (`Implementation`) for testability. The `pkg/attestation/` package handles in-toto attestations and Sigstore signing independently. The codebase demonstrates strong engineering practices with dependency injection, options struct patterns, and comprehensive test data. While primarily an application, it also processes vulnerability data (SARIF, VEX documents) and includes validation logic that could be reused in other security tooling.
This repository is a comprehensive, curated collection of cybersecurity references, scripts, tools, code, labs, and training resources, primarily authored by Omar Santos. It serves as supplemental material for his books, video courses, and live training, covering a vast range of domains including offensive security, defensive security, application security, cloud/container security, hardware/embedded security, AI/ML security, and certification preparation (Cisco, CompTIA, ISC2, etc.). The repo is hybrid in nature: while it contains hundreds of runnable scripts and tools (e.g., network scanners, exploit examples, API security testers, AI-powered log analyzers), its dominant character is that of an educational knowledge base and reference library rather than a deployable application. The content is organized into clear domain directories, with extensive READMEs acting as curated indexes of tools, papers, talks, and labs. The AI security section is particularly well-developed, including course materials on agentic AI, prompt engineering, and the Foundry Security Spec. The repository is actively maintained, with recent commits and automated CI workflows, though the breadth of content introduces risks of link rot and technology churn in fast-moving areas like AI frameworks and certification blueprints.
DefectDojo is an open-source application security posture management (ASPM) and vulnerability management platform. It ingests scan results from over 100 security tools (SAST, DAST, SCA, container, cloud, secrets, infrastructure) via a consistent parser interface, normalizes findings, deduplicates them, and tracks remediation workflows across engagements and products. The system is a Django monolith with a REST API (Django REST Framework), Celery async workers for imports, SLA enforcement, and JIRA/GitHub sync, PostgreSQL for persistence, and Valkey/Redis as the message broker. Key entry points include the Django admin UI, DRF API viewsets, and Celery task dispatchers. External dependencies are PostgreSQL, Redis/Valkey, and optional integrations with JIRA, Slack, Microsoft Teams, and SSO providers (LDAP, OAuth2, SAML). The repository includes a Pro edition layer with additional features (custom RBAC, audit logging, priority SLA) that coexist with the open-source core via feature flags and conditional imports. The codebase demonstrates strong engineering with a well-defined parser factory pattern, prefetch mixins for API efficiency, SSRF-safe HTTP clients, and a request-level caching system, though it carries some technical debt from an ongoing V3 location model migration and numerous deprecated endpoints slated for removal.
The gvm-tools repository provides a Python library and command-line utilities for interacting with Greenbone Vulnerability Management (GVM) systems via the Greenbone Management Protocol (GMP). It consists of a core library (gvmtools) that handles GMP communication, authentication, and data formatting, along with three main CLI tools: gvm-cli for raw command execution, gvm-script for running Python scripts in a GMP context, and gvm-pyshell for an interactive shell. The repository includes approximately 80 example scripts in the scripts/ directory demonstrating common GVM operations such as target management, task control, report generation, and asset discovery. The architecture is library-first, with the CLI tools and scripts built on top of the gvmtools package, which abstracts the underlying GMP/XML complexity. External dependencies include the python-gvm library for protocol handling, with additional dependencies for specific scripts (e.g., terminaltables for output formatting, cpe for CPE processing).
The Go vulnerability management tool is a command-line application designed to analyze Go code and binaries for known vulnerabilities. It uses a vulnerability database curated by the Go security team to identify vulnerabilities in dependencies. The tool provides features such as JSON and SARIF output formats for reporting vulnerabilities.
reNgine is a Django-based automated security reconnaissance and attack-surface management platform. It orchestrates 20+ external security tools (Subfinder, Amass, Naabu, Nuclei, FFUF, GoSpider, Dalfox, WAFW00f, EyeWitness, theHarvester, h8mail) via Celery task chains to perform subdomain discovery, port scanning, HTTP crawling, directory fuzzing, OSINT gathering, technology fingerprinting, WAF detection, and vulnerability scanning. Results are parsed from tool outputs (nmap XML, nuclei JSON, dalfox JSON, ffuf JSON), persisted in PostgreSQL, and exposed through a Django REST Framework API plus a jQuery/Bootstrap frontend with server-side DataTables, dashboards, and WeasyPrint PDF reports. The system supports multi-project tenancy, role-based access control (sys_admin, penetration_tester, auditor), scheduled scans via Celery Beat, and deep HackerOne bug-bounty integration for program import, bookmarking, and vulnerability report submission. It also integrates LLMs (OpenAI and local Ollama) for vulnerability description enrichment and attack-surface suggestions. Architecturally it is a monolithic Django application with four feature apps (dashboard, scanEngine, startScan, targetApp, recon_note) and a Docker deployment composed of web, celery, celery-beat, redis, postgres, nginx, and ollama services. The orchestration core, web/reNgine/tasks.py (~3000 lines), composes Celery groups/chords/chains, executes shell commands against external tools, parses their structured output, and persists scan results. The frontend is server-rendered Django templates with heavy inline JavaScript and a supplementary DRF API layer in web/api/views.py. Although it collects and aggregates large volumes of scan-derived data, this is fundamentally an operational security application, not a data-research project. The codebase is actively patched (recent CVE fixes for command injection and XSS) and feature-rich, but carries notable technical debt: an end-of-life Django 3.2 base, old vendored JS plugins (DataTables 1.10.16, Lightbox from 2018), hardcoded container filesystem paths, a monolithic task module mixing orchestration/parsing/persistence, and dead or commented code. The strongest reusable pieces are the RengineTask Celery base class (standardized task logging, caching, and notifications), the dual-provider LLM abstraction with OpenAI/Ollama backends, and a custom server-side datatable filtering language applying operators (=, >, <, !, &, |) across subdomain, endpoint, and vulnerability views. It is best characterized as effective, pragmatic, security-tool engineering rather than clean, academically elegant architecture.
PatchaPalooza is a CLI tool for fetching, storing, and analyzing Microsoft Patch Tuesday security update data from the MSRC CVRF API. It downloads monthly bulletins as JSON files into a local cache (msrc_data/) and provides commands to query CVEs, filter by CVSS score, and display statistics with colored output. The repository also bundles a large historical dataset of MSRC bulletins (1999–2026) including both Windows and Azure Linux (Mariner) advisories. The tool is a single monolithic Python script with no tests, no modularization, and minimal error handling. The README explicitly states it is no longer actively maintained and has been superseded by a web application. While functional for basic vulnerability lookup, the code is tightly coupled to the MSRC API schema and lacks reusable components. The bundled data is valuable for security research, but the tool itself is not production-grade.