Results for “cert-spotter”

Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate issuance targeting your organization.

Guides through a 5-step secure development workflow for smart contracts, including automated scanning with Slither, special feature validation, visual security diagrams, security property documentation, and manual review.

Conduct systematic access reviews and certifications to ensure users have appropriate access rights aligned with their roles, covering review campaign design, reviewer selection, risk-based prioritization, and remediation tracking for compliance with SOX, HIPAA, and PCI DSS.

CI security scanning: secrets, deps, SAST, triage, expiring exceptions

Monitor paste sites like Pastebin and GitHub Gists for leaked credentials, API keys, and sensitive data using automated scraping and keyword matching to detect breaches early.

Audits OAuth 2.0 permissions across identity providers to identify over-privileged third-party integrations, excessive API scopes, and unused token grants, enforcing least-privilege access.

Audits codebases against PCI DSS v4.0, scanning for PAN patterns, CVV storage, and all 12 requirements including network security, encryption, access control, and logging. Estimates SAQ type for payment-handling systems.

TLS/SSL configuration audit. Tests protocol versions (SSLv2/3, TLS 1.0/1.1/1.2/1.3), cipher strength and ordering, certificate chain validation (intermediates, CT logs, OCSP stapling, pinning), known vulnerabilities (POODLE, BEAST, CRIME, Heartbleed, ROBOT, DROWN, Ticketbleed, GOLDENDOODLE), session management (ticket reuse, resumption, fixation), renegotiation attacks, TLS 1.3-specific issues (0-RTT replay, PSK modes, downgrade), HSTS deep analysis (preload, subdomains, bypass), and certificate revocation (CRL, OCSP responder, stapled response freshness). Compliance-mapped to PCI DSS 4.0 (full Section 4), NIST SP 800-52r2, and FedRAMP. Uses testssl.sh, sslscan, sslyze, openssl, nmap NSE scripts, and nuclei SSL templates. Multi-port scanning across 20+ TLS-bearing services.

Detects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins using statistical analysis on Splunk or raw log data.

Review a ticket or PR through focused specialist lenses: scope, architecture, security, tests, AC coverage, and PR metadata.

Detects leaked secrets in Git repositories by scanning full commit history with Gitleaks rules and the GitHub Secret Scanning API, identifying exposed API keys, tokens, and credentials.

Automated security auditing covering SAST, DAST, dependency scanning, secret detection, container hardening, and compliance checks before deployments or when integrating new dependencies.

Evaluates Base ERC-20 tokens by contract address, returning a 0-100 score across five criteria, launch protocol classification, security flags, and a narrative interpretation.

Performs authorized source-code security reviews using SAST tools like Semgrep and CodeQL, with manual verification of findings and fix recommendations.

Use this when reviewing or designing how secrets, API keys, service credentials, signing keys, tokens, and environment-specific credentials are stored, loaded, rotated, and kept out of untrusted runtimes.

Verify signed artifacts and SLSA build provenance with Sigstore cosign and slsa-verifier, enforce keyless OIDC identity, and apply SLSA Build levels to harden the software supply chain.

Simulates SSL stripping attacks using sslstrip, Bettercap, and mitmproxy in authorized environments to test HSTS enforcement, certificate validation, and HTTPS upgrade mechanisms.

Chief Security Officer mode. (gstack)

Run authenticated vulnerability scans using valid credentials to deeply inspect target systems for missing patches, misconfigurations, and security weaknesses.

Audits trending open-source repos for exploitable vulnerabilities using Semgrep, TruffleHog, osv-scanner, and Slither, then routes findings to responsible disclosure channels (PVR for code flaws, public PRs for dependency CVEs).

Simulate and detect software supply chain attacks including typosquatting via Levenshtein distance, dependency confusion testing, package hash verification, and vulnerability scanning with pip-audit.

Take over Active Directory user and computer accounts by writing alternate certificate keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, and Certipy, then authenticate via PKINIT.

Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap in authorized environments to intercept, analyze, and modify network traffic for testing encryption enforcement, certificate validation, and detection capabilities.