Confidant alternatives

Looking for an alternative tool to replace Confidant? During the review of Confidant we looked at other open source tools. Based on their category, tags, and text, these are the ones that have the best match.

Top 3

TeamVault (team-based password manager)
Aletheia (manage secrets in Google Cloud Platform)
KeeWeb (password manager compatible with KeePass)

These tools are ranked as the best alternatives to Confidant.

Alternatives (by score)

TeamVault

Introduction

Storing passwords within a team security can be a challenging task. TeamVault is a password manager with the goal to be easy to use, flexible, and adhering to several security principles. These include a solid base for the data encryption, support for folders, and role-based access control (RBAC).

Project details

TeamVault is written in Python.

Strengths and weaknesses

+ The source code of this software is available

- No releases on GitHub available

Typical usage

Password management
Secrets management

TeamVault review

Aletheia

Introduction

Aletheia is a project to manage secrets in Google Cloud with CloudKMS and Cloud Storage. It can be used to store sensitive data like authentication details.

Project details

Aletheia is written in Python.

Strengths and weaknesses

+ The source code of this software is available

- Minimal or no documentation available
- No releases on GitHub available

Typical usage

Data security
Secure storage

Aletheia review

KeeWeb

Introduction

Password managers help to store sensitive data. This may include passwords, secret questions with their answers, or other private information.

Project details

KeeWeb is written in JavaScript.

Strengths and weaknesses

+ More than 25 contributors
+ More than 6000 GitHub stars
+ Many releases available
+ The source code of this software is available

- Full name of author is unknown

Typical usage

Password management

KeeWeb review

Vault

Introduction

Vault is a secret management tool created by HashiCorp. It allows storing secrets, such as key/value pairs, AWS IAM/STS credentials, SQL/NoSQL databases, X.509 certificates, SSH credentials, and other sensitive details. These secrets are typically used by software components and scripts. The benefit of using a secret management tool is that they no longer need to be stored in configuration files. Main features include leasing, key revocation, key rolling, and auditing.

Project details

Vault is written in Golang.

Strengths and weaknesses

+ More than 500 contributors
+ More than 9000 stars
+ The source code of this software is available

Typical usage

Password management
Secrets management
Secure storage

Vault review

pick

Introduction

Tools like pick are used to store passwords and secrets safely.

Project details

pick is written in Golang.

Strengths and weaknesses

+ Very low number of dependencies
+ The source code of this software is available

Typical usage

Data security
Secure storage

pick review

100

Buttercup for desktop

Introduction

The typical users have at least a multitude of ten when it comes to passwords. Ensuring that every website has a unique password and remembering, is almost impossible. Passwords managers like Buttercup help with the generation and secure storage of these secrets. It is freely available and open source, making it a good alternative for commercial options.

Project details

Buttercup for desktop is written in Node.js.

Strengths and weaknesses

+ More than 10 contributors
+ More than 1000 GitHub stars
+ The source code of this software is available

Typical usage

Password management

Buttercup for desktop review

AWSBucketDump

Introduction

AWSBucketDump is a security tool to find interesting files in AWS S3 buckets that are part of Amazon cloud services. These storage containers may have interesting files, which a tool like AWSBucketDump can discover.

Project details

AWSBucketDump is written in Python.

Strengths and weaknesses

+ More than 500 GitHub stars
+ The source code of this software is available

- No releases on GitHub available

Typical usage

Configuration audit
Discovery of sensitive information
Security assessment

AWSBucketDump review

BuQuikker

Introduction

BuQuikker is a security tool to scan the Amazon S3 storage service. Its goal is to find open and unprotected S3 buckets.

Project details

BuQuikker is written in Python.

Strengths and weaknesses

+ The source code of this software is available

Typical usage

Data leak detection
Security assessment

BuQuikker review

Bucket Finder

Introduction

The Bucket Finder tool can be a helpful tool during penetration testing and security assessments. It helps with the discovery of S3 buckets on the Amazon AWS cloud.

Project details

Bucket Finder is written in Ruby.

Strengths and weaknesses

+ The source code of this software is available

- No updates for a while

Typical usage

Data leak detection
Penetration testing
Security assessment

Bucket Finder review

Bucket Stream

Introduction

Bucket Stream can be used to discover AWS S3 buckets. This tool may be helpful during reconnaissance and security assessments. As it does not include active scanning on the target itself, it is a passive way of finding information. This is a huge benefit, as you don't have to guess or brute-force the names.

Project details

Bucket Stream is written in Python.

Strengths and weaknesses

+ Tool is easy to use
+ The source code of this software is available

- No releases on GitHub available

Typical usage

Discovery of sensitive information
Information leak detection
Penetration testing
Reconnaissance

Bucket Stream review

CloudSploit scans

Introduction

CloudSploit scans is an open source software project to test security risks related to an AWS account. It runs tests against your Amazon account and aims to discover any potential misconfigured setting or other risks.

Project details

CloudSploit scans is written in Node.js.

Strengths and weaknesses

+ More than 10 contributors
+ More than 500 GitHub stars
+ The source code of this software is available

- No releases on GitHub available

Typical usage

IT audit
Configuration audit
Security assessment

CloudSploit scans review

Prowler

Introduction

Prowler is a security tool to check systems on AWS against the related CIS benchmark. This benchmark provides a set of best practices for AWS. The primary usage for this tool is system hardening and compliance checking.

Project details

Prowler is written in shell script.

Strengths and weaknesses

+ More than 25 contributors
+ More than 500 GitHub stars
+ The source code of this software is available

Typical usage

Compliance testing
Security assessment
System hardening

Prowler review

S3Scanner

Introduction

The aptly named S3Scanner is to be used to detect AWS S3 buckets. Discovered buckets are displayed, together with the related objects in the bucket.

Project details

S3Scanner is written in Python.

Strengths and weaknesses

+ The source code of this software is available

Typical usage

Information gathering
Information leak detection
Penetration testing
Storage security testing

S3Scanner review

Security Monkey

Introduction

Security Monkey provides a single user interface to browse and search through all of your services and accounts.

Project details

Security Monkey is written in Python.

Strengths and weaknesses

+ More than 50 contributors
+ More than 1000 GitHub stars
+ The source code of this software is available
+ Supported by a large company

Typical usage

Security monitoring

Security Monkey review

Teh S3 Bucketeers

Introduction

Tools like Teh S3 Bucketeers are valuable for doing reconnaissance and information gathering. They may be used during penetration tests and security assessments. The primary goal of these tools is to find S3 buckets that may lead to sensitive data stored on Amazon's storage service.

Project details

Teh S3 Bucketeers is written in shell script.

Strengths and weaknesses

+ The source code is easy to read and understand
+ Used language is shell script
+ The source code of this software is available

- No releases on GitHub available

Typical usage

Penetration testing
Security assessment
Storage security testing

Teh S3 Bucketeers review

inSp3ctor

Introduction

Like other S3 bucket scanners, inSp3ctor helps to find valid storage buckets on Amazon's AWS platform. This can be useful for security assignments like penetration testing or see what information is available about a company. Another option is using it to see if any private data is leaking.

Project details

inSp3ctor is written in Python.

Strengths and weaknesses

+ The source code is easy to read and understand
+ Very low number of dependencies
+ The source code of this software is available

- No releases on GitHub available

Typical usage

Penetration testing
Security assessment
Storage security testing

inSp3ctor review

s3-fuzzer

Introduction

This fuzzing tool helps with discovering sensitive data in Amazon S3 buckets. S3 buckets are storage containers and may reveal data to unauthorized individuals. This tools helps with the discovery process.

Project details

s3-fuzzer is written in Golang.

Strengths and weaknesses

+ The source code of this software is available

Typical usage

Configuration audit
Discovery of sensitive information
Security assessment

s3-fuzzer review

git-crypt

Introduction

This tools allows you to store your secrets (such as keys or passwords) in the same repository as your code.

Project details

git-crypt is written in C++.

Strengths and weaknesses

+ More than 10 contributors
+ More than 3000 GitHub stars
+ The source code of this software is available

Typical usage

Data encryption

git-crypt review

git-secrets

Introduction

You would most likely use git-secrets in development teams or as an individual developer. The primary goal is to prevent accidentally submitting authentication details or otherwise sensitive information to your software repositories.

Project details

git-secrets is written in shell script.

Strengths and weaknesses

+ The source code of this software is available

Typical usage

Data leak prevention
Information leak prevention

git-secrets review

John the Ripper

Introduction

John the Ripper is a mature password cracker to find weak or known passwords. It works on Linux and other flavors of Unix and Microsoft Windows.

Project details

KeePassX

Introduction

The database is encrypted with AES (alias Rijndael) or Twofish encryption algorithm using a 256-bit key. KeePassX uses a database format that is compatible with KeePass Password Safe.

Project details

KeePassX is written in C++.

Strengths and weaknesses

+ The source code of this software is available
+ Well-known tool

- Full name of author is unknown

Typical usage

Secure storage

KeePassX review

KeePassXC

Introduction

KeePassXC is a cross-platform platform to store sensitive data like passwords, keys, and other secrets. It has a graphical user interface and is written in C++.

Project details

KeePassXC is written in C++.

Strengths and weaknesses

+ More than 50 contributors
+ Runs on multiple platforms
+ More than 1000 GitHub stars
+ The source code of this software is available

Typical usage

Password management
Secure storage

KeePassXC review

LaZagne

Introduction

The LaZagne tool can be a good addition to the toolkit of pentesters or forensic specialists to recover sensitive details from systems. For a pentester, this typically means that limited access has been gained. By trying to find passwords from local applications, the step to other applications or privilege level might be possible. For example, a password that is shared among multiple services, or even finding an administrator password.