This article provides a comprehensive analysis of the Shai Hulud 2.0 supply chain attack, detailing the compromised code libraries and the extent of the breaches. It also lists tools and methods for detecting and mitigating the impact of these attacks, emphasizing the importance of version pinning and runtime monitoring.

This article introduces a curated list of hacking tools suitable for hackers, pentesters, and security researchers. Users can easily clone the repository and update it with simple commands. Contributions to the list are welcome.

This GitHub repository features over 150 tools and resources tailored for red teaming operations. It includes specific tools for various stages of an attack lifecycle, from reconnaissance to exfiltration, while also offering tips for effective tactics. The materials are intended for educational purposes only.

Runlayer provides a platform that connects AI tools to enterprise systems while ensuring security and observability. It scans for vulnerabilities, controls access, and allows teams to share trusted resources easily. This helps prevent data leaks and manage AI usage effectively.

Nova Proximity is a tool that scans Model Context Protocol servers and Agent Skills for security vulnerabilities. It detects issues like prompt injection and provides detailed analysis and remediation guidance based on NOVA rules. Users can discover tools, prompts, and assess server capabilities easily.

This article details the features of the Security Detections MCP server, which allows LLMs to query various security detection rules. It highlights enhancements like improved error handling, dynamic pattern extraction, and the introduction of 11 pre-built prompts for common security tasks.

JS Analyzer is a Burp Suite extension that helps identify API endpoints, secrets, and sensitive URLs in JavaScript files. It filters out irrelevant data for more accurate results and allows for real-time analysis and export of findings.

This article provides a detailed guide for penetration testing in DevOps and CI/CD environments. It outlines various commands and techniques to identify vulnerabilities and services within internal networks, targeting tools and frameworks relevant to security practitioners.

The article discusses the importance of identifying and managing shadow AI within organizations, highlighting the risks it poses to security and compliance. It offers a free tool for conducting a shadow AI inventory, enabling businesses to gain visibility into unauthorized AI tools in use. The aim is to help companies mitigate potential vulnerabilities associated with these technologies.

A C tool called EnumEDR is designed to enumerate endpoint detection and response (EDR) systems by checking active processes and drivers on a system. It currently identifies several EDRs, including Microsoft Defender and Elastic EDR, and allows for easy addition of new EDRs through a defined structure. The tool provides command-line options to list processes, drivers, or specifically EDRs in use.

Secator is a task and workflow runner designed for security assessments, integrating numerous well-known security tools to enhance the productivity of pentesters and security researchers. It offers a unified command structure, installation options through multiple methods, and customizable features for various tasks, including scanning and crawling. Users can install external tools as needed and leverage additional addons for extended functionality.

MCP (Model Context Protocol) facilitates connections between AI agents and tools but lacks inherent security, exposing users to risks like command injection, tool poisoning, and silent redefinitions. Recommendations for developers and users emphasize the necessity of input validation, tool integrity, and cautious server connections to mitigate these vulnerabilities. Until MCP incorporates security as a priority, tools like ScanMCP.com may offer essential oversight.

The article highlights 10 lesser-known Burp extensions that provide valuable features for security testing, despite not being among the most popular in the BApp Store. Each extension offers unique functionalities, such as session token management, SAML message manipulation, and vulnerability detection, aimed at enhancing the user's testing capabilities. Readers are encouraged to share their own favorite Burp extensions in the comments.

grpc-scan is a tool developed to automate the enumeration of gRPC services when documentation is lacking and server reflection is disabled. By leveraging gRPC's error messages and patterns in service and method naming, it helps security teams identify potential services and methods within a black-box environment. The tool addresses issues like service sprawl and method proliferation that can lead to security vulnerabilities in gRPC implementations.

A comprehensive repository offering a variety of resources like manuals, tools, and cheat sheets aimed primarily at system and network administrators, DevOps, pentesters, and security researchers. It encourages contributions from users while maintaining a focus on high-quality content. The project is organized into main chapters covering various topics relevant to technology and cybersecurity.