Confidant alternatives

Looking for an alternative tool to replace Confidant? During the review of Confidant we looked at other open source tools. Based on their category, tags, and text, these are the ones that have the best match.

Top 3

  1. TeamVault (team-based password manager)
  2. Aletheia (manage secrets in Google Cloud Platform)
  3. BlackBox (store secrets in Git/Mercurial/Subversion)

These tools are ranked as the best alternatives to Confidant.

Alternatives (by score)

64

TeamVault

Introduction

Storing passwords within a team security can be a challenging task. TeamVault is a password manager with the goal to be easy to use, flexible, and adhering to several security principles. These include a solid base for the data encryption, support for folders, and role-based access control (RBAC).

Project details

TeamVault is written in Python.

Strengths and weaknesses

  • + The source code of this software is available
  • - No releases on GitHub available

Typical usage

  • Password management
  • Secrets management

TeamVault review

64

Aletheia

Introduction

Aletheia is a project to manage secrets in Google Cloud with CloudKMS and Cloud Storage. It can be used to store sensitive data like authentication details.

Project details

Aletheia is written in Python.

Strengths and weaknesses

  • + The source code of this software is available
  • - Minimal or no documentation available
  • - No releases on GitHub available

Typical usage

  • Data security
  • Secure storage

Aletheia review

68

BlackBox

Introduction

Typically you do not want to store any secrets in a software repository or version control system repository. However when there is still a need to give people access to sensitive parts, then BlackBox helps to do this in a more secure way.

Project details

BlackBox is written in shell script.

Strengths and weaknesses

  • + More than 50 contributors
  • + More than 4000 GitHub stars
  • + The source code of this software is available

    Typical usage

    • Password management
    • Secure storage

    BlackBox review

    100

    KeeWeb

    Introduction

    Password managers help to store sensitive data. This may include passwords, secret questions with their answers, or other private information.

    Project details

    KeeWeb is written in JavaScript.

    Strengths and weaknesses

    • + More than 25 contributors
    • + More than 6000 GitHub stars
    • + Many releases available
    • + The source code of this software is available
    • - Full name of author is unknown

    Typical usage

    • Password management

    KeeWeb review

    74

    pick

    Introduction

    Tools like pick are used to store passwords and secrets safely.

    Project details

    pick is written in Golang.

    Strengths and weaknesses

    • + Very low number of dependencies
    • + The source code of this software is available

      Typical usage

      • Data security
      • Secure storage

      pick review

      97

      Vault

      Introduction

      Vault is a secret management tool created by HashiCorp. It allows storing secrets, such as key/value pairs, AWS IAM/STS credentials, SQL/NoSQL databases, X.509 certificates, SSH credentials, and other sensitive details. These secrets are typically used by software components and scripts. The benefit of using a secret management tool is that they no longer need to be stored in configuration files. Main features include leasing, key revocation, key rolling, and auditing.

      Project details

      Vault is written in Golang.

      Strengths and weaknesses

      • + More than 500 contributors
      • + More than 9000 stars
      • + The source code of this software is available

        Typical usage

        • Password management
        • Secrets management
        • Secure storage

        Vault review

        100

        Buttercup for desktop

        Introduction

        The typical users have at least a multitude of ten when it comes to passwords. Ensuring that every website has a unique password and remembering, is almost impossible. Passwords managers like Buttercup help with the generation and secure storage of these secrets. It is freely available and open source, making it a good alternative for commercial options.

        Project details

        Buttercup for desktop is written in Node.js.

        Strengths and weaknesses

        • + More than 10 contributors
        • + More than 1000 GitHub stars
        • + The source code of this software is available

          Typical usage

          • Password management

          Buttercup for desktop review

          64

          AWSBucketDump

          Introduction

          AWSBucketDump is a security tool to find interesting files in AWS S3 buckets that are part of Amazon cloud services. These storage containers may have interesting files, which a tool like AWSBucketDump can discover.

          Project details

          AWSBucketDump is written in Python.

          Strengths and weaknesses

          • + More than 500 GitHub stars
          • + The source code of this software is available
          • - No releases on GitHub available

          Typical usage

          • Configuration audit
          • Discovery of sensitive information
          • Security assessment

          AWSBucketDump review

          74

          Bucket Finder

          Introduction

          The Bucket Finder tool can be a helpful tool during penetration testing and security assessments. It helps with the discovery of S3 buckets on the Amazon AWS cloud.

          Project details

          Bucket Finder is written in Ruby.

          Strengths and weaknesses

          • + The source code of this software is available
          • - No updates for a while

          Typical usage

          • Data leak detection
          • Penetration testing
          • Security assessment

          Bucket Finder review

          64

          Bucket Stream

          Introduction

          Bucket Stream can be used to discover AWS S3 buckets. This tool may be helpful during reconnaissance and security assessments. As it does not include active scanning on the target itself, it is a passive way of finding information. This is a huge benefit, as you don't have to guess or brute-force the names.

          Project details

          Bucket Stream is written in Python.

          Strengths and weaknesses

          • + Tool is easy to use
          • + The source code of this software is available
          • - No releases on GitHub available

          Typical usage

          • Discovery of sensitive information
          • Information leak detection
          • Penetration testing
          • Reconnaissance

          Bucket Stream review

          64

          BuQuikker

          Introduction

          BuQuikker is a security tool to scan the Amazon S3 storage service. Its goal is to find open and unprotected S3 buckets.

          Project details

          BuQuikker is written in Python.

          Strengths and weaknesses

          • + The source code of this software is available

            Typical usage

            • Data leak detection
            • Security assessment

            BuQuikker review

            78

            CloudSploit scans

            Introduction

            CloudSploit scans is an open source software project to test security risks related to an AWS account. It runs tests against your Amazon account and aims to discover any potential misconfigured setting or other risks.

            Project details

            CloudSploit scans is written in Node.js.

            Strengths and weaknesses

            • + More than 10 contributors
            • + More than 500 GitHub stars
            • + The source code of this software is available
            • - No releases on GitHub available

            Typical usage

            • Configuration audit
            • IT audit
            • Security assessment

            CloudSploit scans review

            56

            inSp3ctor

            Introduction

            Like other S3 bucket scanners, inSp3ctor helps to find valid storage buckets on Amazon's AWS platform. This can be useful for security assignments like penetration testing or see what information is available about a company. Another option is using it to see if any private data is leaking.

            Project details

            inSp3ctor is written in Python.

            Strengths and weaknesses

            • + The source code is easy to read and understand
            • + Very low number of dependencies
            • + The source code of this software is available
            • - No releases on GitHub available

            Typical usage

            • Penetration testing
            • Security assessment
            • Storage security testing

            inSp3ctor review

            60

            Prowler

            Introduction

            Prowler is a security tool to check systems on AWS against the related CIS benchmark. This benchmark provides a set of best practices for AWS. The primary usage for this tool is system hardening and compliance checking.

            Project details

            Prowler is written in shell script.

            Strengths and weaknesses

            • + More than 25 contributors
            • + More than 500 GitHub stars
            • + The source code of this software is available

              Typical usage

              • Compliance testing
              • Security assessment
              • System hardening

              Prowler review

              60

              s3-fuzzer

              Introduction

              This fuzzing tool helps with discovering sensitive data in Amazon S3 buckets. S3 buckets are storage containers and may reveal data to unauthorized individuals. This tools helps with the discovery process.

              Project details

              s3-fuzzer is written in Golang.

              Strengths and weaknesses

              • + The source code of this software is available

                Typical usage

                • Configuration audit
                • Discovery of sensitive information
                • Security assessment

                s3-fuzzer review

                60

                S3Scanner

                Introduction

                The aptly named S3Scanner is to be used to detect AWS S3 buckets. Discovered buckets are displayed, together with the related objects in the bucket.

                Project details

                S3Scanner is written in Python.

                Strengths and weaknesses

                • + The source code of this software is available

                  Typical usage

                  • Information gathering
                  • Information leak detection
                  • Penetration testing
                  • Storage security testing

                  S3Scanner review

                  60

                  Security Monkey

                  Introduction

                  Security Monkey provides a single user interface to browse and search through all of your services and accounts.

                  Project details

                  Security Monkey is written in Python.

                  Strengths and weaknesses

                  • + More than 50 contributors
                  • + More than 1000 GitHub stars
                  • + The source code of this software is available
                  • + Supported by a large company

                    Typical usage

                    • Security monitoring

                    Security Monkey review

                    64

                    Teh S3 Bucketeers

                    Introduction

                    Tools like Teh S3 Bucketeers are valuable for doing reconnaissance and information gathering. They may be used during penetration tests and security assessments. The primary goal of these tools is to find S3 buckets that may lead to sensitive data stored on Amazon's storage service.

                    Project details

                    Teh S3 Bucketeers is written in shell script.

                    Strengths and weaknesses

                    • + The source code is easy to read and understand
                    • + Used language is shell script
                    • + The source code of this software is available
                    • - No releases on GitHub available

                    Typical usage

                    • Penetration testing
                    • Security assessment
                    • Storage security testing

                    Teh S3 Bucketeers review

                    78

                    hashcat

                    Introduction

                    Hashcat can be used to discover lost passwords, or as part of a security assignment. For example, it could be trying to crack a password from a password file that was obtained during a penetration test.

                    Project details

                    hashcat is written in C.

                    Strengths and weaknesses

                    • + More than 25 contributors
                    • + More than 4000 GitHub stars
                    • + The source code of this software is available
                    • + Well-known tool

                      Typical usage

                      • Password discovery

                      hashcat review

                      56

                      John the Ripper

                      Introduction

                      John the Ripper is a mature password cracker to find weak or known passwords. It works on Linux and other flavors of Unix and Microsoft Windows.

                      Project details

                      63

                      KeePassX

                      Introduction

                      The database is encrypted with AES (alias Rijndael) or Twofish encryption algorithm using a 256-bit key. KeePassX uses a database format that is compatible with KeePass Password Safe.

                      Project details

                      KeePassX is written in C++.

                      Strengths and weaknesses

                      • + The source code of this software is available
                      • + Well-known tool
                      • - Full name of author is unknown

                      Typical usage

                      • Secure storage

                      KeePassX review

                      97

                      KeePassXC

                      Introduction

                      KeePassXC is a cross-platform platform to store sensitive data like passwords, keys, and other secrets. It has a graphical user interface and is written in C++.

                      Project details

                      KeePassXC is written in C++.

                      Strengths and weaknesses

                      • + More than 50 contributors
                      • + Runs on multiple platforms
                      • + More than 1000 GitHub stars
                      • + The source code of this software is available

                        Typical usage

                        • Password management
                        • Secure storage

                        KeePassXC review

                        85

                        LaZagne

                        Introduction

                        The LaZagne tool can be a good addition to the toolkit of pentesters or forensic specialists to recover sensitive details from systems. For a pentester, this typically means that limited access has been gained. By trying to find passwords from local applications, the step to other applications or privilege level might be possible. For example, a password that is shared among multiple services, or even finding an administrator password.

                        Project details

                        LaZagne is written in Python.

                        Strengths and weaknesses

                        • + More than 10 contributors
                        • + More than 3000 GitHub stars
                        • + The source code of this software is available

                          Typical usage

                          • Data extraction
                          • Information gathering
                          • Password discovery
                          • Password recovery

                          LaZagne review

                          81

                          mimipenguin

                          Introduction

                          The tool requires root permissions to work.

                          Project details

                          mimipenguin is written in Python, shell script.

                          Strengths and weaknesses

                          • + The source code of this software is available
                          • - No releases on GitHub available
                          • - Full name of author is unknown

                          Typical usage

                          • Information gathering
                          • Security assessment

                          mimipenguin review

                          64

                          mimipy

                          Introduction

                          The mimipy tool is based on the work of mimipenguin and ported to Python. It can extract passwords from memory or overwrite them to prevent capture.

                          Project details

                          mimipy is written in Python.

                          Strengths and weaknesses

                          • + The source code of this software is available

                            Typical usage

                            • Data extraction
                            • Information gathering
                            • Security assessment

                            mimipy review

                            Some relevant tool missing as an alternative to Confidant? Please contact us with your suggestion.