GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → ztosec → Hunter

ztosec / Hunter

Licence: apache-2.0
Hunter作为中通DevSecOps闭环方案中的一环，扮演着很重要的角色，开源之后希望能帮助到更多企业。

Programming Languages

python
139335 projects - #7 most used programming language

Labels

securitydevsecops

Projects that are alternatives of or similar to Hunter

netmaker
Netmaker makes networks with WireGuard. Netmaker automates fast, secure, and distributed virtual networks.
Stars: ✭ 4,147 (+1365.37%)
Mutual labels:  devsecops
dependency-track-maven-plugin
Maven plugin that integrates with a Dependency Track server to submit dependency manifests and optionally fail execution when vulnerable dependencies are found.
Stars: ✭ 28 (-90.11%)
Mutual labels:  devsecops
django-security-check
Helps you continuously monitor and fix common security vulnerabilities in your Django application.
Stars: ✭ 69 (-75.62%)
Mutual labels:  devsecops
secureCodeBox-v2
This Repository contains the stable beta preview of the next major secureCodeBox (SCB) release v2.0.0.
Stars: ✭ 23 (-91.87%)
Mutual labels:  devsecops
snyk-security-scanner-plugin
Test and monitor your projects for vulnerabilities with Jenkins. This plugin is officially maintained by Snyk.
Stars: ✭ 33 (-88.34%)
Mutual labels:  devsecops
GDPRDPIAT
A GDPR Data Protection Impact Assessment (DPIA) tool to assist organisations to evaluate data protection risks with respect to the EU's General Data Protection Regulation. 🇪🇺
Stars: ✭ 28 (-90.11%)
Mutual labels:  devsecops
sonarqube-action
Integrate SonarQube scanner to GitHub Actions
Stars: ✭ 90 (-68.2%)
Mutual labels:  devsecops
Faraday
Faraday introduces a new concept - IPE (Integrated Penetration-Test Environment) a multiuser Penetration test IDE. Designed for distributing, indexing, and analyzing the data generated during a security audit.
Stars: ✭ 3,198 (+1030.04%)
Mutual labels:  devsecops
spring-boot-microservice-best-practices
Best practices and integrations available for Spring Boot based Microservice in a single repository.
Stars: ✭ 139 (-50.88%)
Mutual labels:  devsecops
big-bang
Big Bang is a declarative, continuous delivery tool for core DoD hardened and approved packages into a Kubernetes cluster.
Stars: ✭ 55 (-80.57%)
Mutual labels:  devsecops
devops-infra-demo
Growing repository of Infrastructure as Code demos (initially created for DevOps Wall Street)
Stars: ✭ 31 (-89.05%)
Mutual labels:  devsecops
makes
A DevSecOps framework powered by Nix.
Stars: ✭ 158 (-44.17%)
Mutual labels:  devsecops
qodana-action
⚙️ Scan your Java, Kotlin, PHP, Python, JavaScript, TypeScript projects at GitHub with Qodana
Stars: ✭ 112 (-60.42%)
Mutual labels:  devsecops
advanced-security-compliance
GitHub Advance Security Compliance Action
Stars: ✭ 106 (-62.54%)
Mutual labels:  devsecops
Openrasp Iast
IAST 灰盒扫描工具
Stars: ✭ 253 (-10.6%)
Mutual labels:  devsecops
reconmap
Vulnerability assessment and penetration testing automation and reporting platform for teams.
Stars: ✭ 242 (-14.49%)
Mutual labels:  devsecops
aws-pipeline
Build a CI/CD for Microservices and Serverless Functions in AWS ☁️
Stars: ✭ 32 (-88.69%)
Mutual labels:  devsecops
Securecodebox
secureCodeBox (SCB) - continuous secure delivery out of the box
Stars: ✭ 279 (-1.41%)
Mutual labels:  devsecops
Application Security Engineer Interview Questions
Some of the questions which i was asked when i was giving interviews for Application/Product Security roles. I am sure this is not an exhaustive list but i felt these questions were important to be asked and some were challenging to answer
Stars: ✭ 267 (-5.65%)
Mutual labels:  devsecops
mobsf-ci
All that is required to run MobSF in the ci
Stars: ✭ 37 (-86.93%)
Mutual labels:  devsecops
View All Similar Projects ➔

.. hunter文档 documentation master file, created by sphinx-quickstart on Wed Aug 29 00:12:25 2018. You can adapt this file completely to your liking, but it should at least contain the root toctree directive.

招聘提示:

中通安全致力于支撑中通快递集团生态链全线业务（快递、快运、电商、传媒、金融、航空等）的安全发展。我们期待更多优秀小伙伴的加入，安全开发、安全合规、产品经理、架构师、数据安全等岗位持续招聘中，感兴趣的可将简历投递至：[email protected]，更多招聘详情可点击：https://mp.weixin.qq.com/s/YDwfmzHFNPiC4LrYovHeaQ

Welcome to hunter's documentation!

安装说明 <doc/source/安装说明.rst>_

使用教程 <doc/source/使用教程.rst>_

API接口 <doc/source/API接口.rst>_

二次开发 <doc/source/二次开发.rst>_

使用案例 <doc/source/使用案例.rst>_

总体介绍

背景介绍

甲方安全建设中有一个很重要的环节，即业务迭代上线前的安全检测。大部分 公司的产品研发部门都会配备一个或多个质量测试工程师负责把关软件质量。 然而术业有专攻，质量测试工程师能够得心应手地应对软件功能方面的缺陷， 却由于自身安全领域专业知识的缺失导致很难识别安全风险。针对这一问题常 采用的做法就是由甲方安全人员定期对业务线进行安全检查，但这种做法有很 强的滞后性，一个业务从上线到被发现安全问题可能跨越了很长的周期。最理 想的效果是在业务上线之前能够将安全风险“扼杀”，于是很多公司在业务上 线会安排人工进行安全测试，但这种做法不够节省人力。上述提到的两个做法 都有一定的弊端，一种更好的方案是在发布流程中加入自动化安全扫描，DevSecOps整体流程如下:

.. image:: /doc/images/DevSecOps整体闭环方案.jpg :width: 800

DevSecOps整体闭环

Hunter作为中通DevSecOps中一环，发挥着及其重要的作用。

产品导读

欢迎来到hunter文档，hunter是一款被动式漏洞扫描器，何谓被动式漏洞扫描器？

首先需要先了解下主动式漏洞扫描器，传统主动式漏洞扫描器的主要流程:

1.网络爬虫爬取网站接口。

2.对爬取到的接口进行漏洞检测。

网络爬虫主动爬取网站接口并进行漏洞检测的方式被称之为主动式漏洞检测方式。

但是主动爬虫会遗漏掉很多网站接口，为了解决这个问题，一种在用户和web应用

进行交互时获取用户网络请求并进行漏洞检测方式由此产生，这种漏洞检测方式被

称为被动式漏洞检测方式。

产品流程和架构图

.. image:: /doc/images/架构图.png :width: 800

产品架构图

.. image:: /doc/images/流程图.png :width: 800

流程图

源码结构

目前开源的源码主要分为如下七个模块::

├── HunterClient(客户端-浏览器插件)
├── HunterAdminApi(管理后台后端)
├── HunterAdminGui(管理后台前端)
├── HunterSense(回显log日志平台)
├── HunterCelery(poc检测引擎)
├── SqlmapCelery(sql注入检测引擎)
├── XsseyeCelery(xss检测引擎)

产品预览

.. image:: /doc/images/preview/project-preview1.png :width: 800

浏览器插件客户端

.. image:: /doc/images/preview/project-preview2.png :width: 800

客户端配置

.. image:: /doc/images/preview/project-preview3.png :width: 800

一次任务扫描结果

.. image:: /doc/images/preview/project-preview4.png :width: 800

hunter个人用户统计报表

.. image:: /doc/images/preview/project-preview5.png :width: 800

插件分布式管理

.. image:: /doc/images/preview/project-preview6.png :width: 800

客户端下载

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].