OpenSCAP alternatives

Looking for an alternative tool to replace OpenSCAP? During the review of OpenSCAP we looked at other open source tools. Based on their category, tags, and text, these are the ones that have the best match.

Top 3

JShielder (Linux hardening tool)
Lynis (security scanner and compliance auditing tool)
Zeus (AWS auditing and hardening tool)

These tools are ranked as the best alternatives to OpenSCAP.

Alternatives (by score)

JShielder

Introduction

JShielder is a security tool for Linux systems to make them more secure by adding system hardening measures.

Project details

JShielder is written in Python, shell script.

Strengths and weaknesses

+ Used language is shell script
+ The source code of this software is available

Typical usage

System hardening

JShielder review

100

Lynis

Introduction

Lynis is an open source security auditing tool that is available since 2007 and created by Michael Boelen. Its primary goal is to evaluate the security defenses of systems running Linux or other flavors of Unix. It provides suggestions to install, configure, or correct any security measures.

Project details

Lynis is written in shell script.

Strengths and weaknesses

+ More than 50 contributors
+ Commercial support available
+ More than 4000 GitHub stars
+ Used language is shell script
+ Very low number of dependencies
+ Project is mature (10+ years)
+ The source code of this software is available

Typical usage

IT audit
Penetration testing
Security assessment
System hardening
Vulnerability scanning

Lynis review

Zeus

Introduction

Zeus is a tool to perform a quick security scan of an AWS environment. It helps to find missing security controls, so additional system hardening measures can be applied to systems.

Project details

Zeus is written in shell script.

Strengths and weaknesses

+ Used language is shell script
+ The source code of this software is available

- No releases on GitHub available

Typical usage

Configuration audit
Security assessment
Self-assessment
System hardening

Zeus review

Nix Auditor

Introduction

This fairly new tool is written in shell script to scan Linux systems with the focus on security auditing.

Project details

Nix Auditor is written in shell script.

Strengths and weaknesses

+ Used language is shell script

- Full name of author is unknown
- Unknown project license

Nix Auditor review

sysechk (System Security Checker)

Introduction

System Security Checker, or sysechk, is a tool to perform a system audit against a set of best practices. It uses a modular approach to test the system.

Project details

sysechk is written in shell script.

Strengths and weaknesses

+ Used language is shell script
+ The source code of this software is available

Typical usage

IT audit
System hardening

sysechk review

YASAT

Introduction

The YASAT tool performs a system scan to detect configuration issues and possible improvements for hardening the system. Typically you would use this on new and existing systems.

Project details

YASAT is written in shell script.

Strengths and weaknesses

+ Used language is shell script

- No updates for a while

Typical usage

Configuration audit
IT audit
Security assessment

YASAT review

Cloud Security Suite (CS Suite)

Introduction

Cloud Security Suite (CS Suite) is a security toolkit that allows scanning Amazon, Google, and Azure cloud platforms. It leverages tools like Lynis, Prowler, and Scout2 to collect all information. The promise of the tool is to simplify the installation of the tools, their configuration, and the data collection.

Project details

Cloud Security Suite is written in Python.

Strengths and weaknesses

+ The source code of this software is available

- No releases on GitHub available

Typical usage

Configuration audit
IT audit
Penetration testing
System hardening

Cloud Security Suite review

orthrus

Introduction

Orthrus is a security framework and auditing tool. It allows monitoring and analyzing security configurations across multiple environments.

Project details

orthrus is written in Golang.

Strengths and weaknesses

+ The source code of this software is available

- Project is in early phase and may be unstable

Typical usage

Security assessment
Self-assessment
System hardening
Vulnerability scanning

orthrus review

otseca

Introduction

Tools like otseca help with data collection. This could be useful for system administrators to collect data on a regular interval. This data then can be compared with a future data capture. Another possibility is to use it during pentesting. In that case one should have already obtained root access, as the tool requires this as well.

Project details

otseca is written in shell script.

Strengths and weaknesses

+ The source code is easy to read and understand
+ Tool is modular and extendable
+ The source code of this software is available

Typical usage

Configuration audit
Penetration testing
Security assessment

otseca review

LUNAR

Introduction

LUNAR is short for Lockdown UNix Auditing and Reporting and runs on the system itself.

Project details

LUNAR is written in shell script.

Strengths and weaknesses

+ The source code of this software is available

Typical usage

Security assessment
Self-assessment
System hardening

LUNAR review

seccheck

Introduction

Seccheck is a security scanner for Linux systems. It is originally written for SuSE Linux by Marc Heuse.

Project details

seccheck is written in shell script.

Strengths and weaknesses

+ The source code of this software is available

- Project looks outdated (old code or documentation)

Typical usage

Security assessment
System hardening

seccheck review

100

Anchore

Introduction

Anchore is a tool to help with discovering, analyzing and certifying container images. These images can be stored both on-premises or in the cloud. The tooling is mainly focused on developer so that perform analysis on their container images. Typical actions include running queries, creating reports, or set up policies for a continuous integration and deployment pipeline.

Project details

Anchore is written in Python.

Strengths and weaknesses

+ More than 10 contributors
+ Commercial support available
+ The source code of this software is available

Typical usage

System hardening

Anchore review

100

Archery

Introduction

Archery is a tool that helps to collect data about vulnerabilities within an environment. Instead of focusing on the actual scanning, it allows managing findings in a web-based interface. This includes options like reporting, searching, and dashboards. It can interact with other tools, including the well-known vulnerability scanners.

Project details

Archery is written in Python.

Strengths and weaknesses

+ More than 500 GitHub stars
+ The source code of this software is available

Typical usage

Penetration testing
Vulnerability management
Vulnerability scanning
Vulnerability testing

Archery review

AutoNessus (autonessus)

Introduction

This tool is useful to time scans, for example by having it run outside of business hours, and stop when the day starts.

Note: originally another tool was named AutoNessus. That is now Seccubus.

Project details

AutoNessus is written in Python.

Strengths and weaknesses

+ The source code of this software is available

- No releases on GitHub available

Typical usage

Vulnerability scanning

AutoNessus review

CMSeeK

Introduction

CMSeeK is a security scanner for content management systems (CMS). It can perform a wide range of functions starting from the detection of the CMS, up to vulnerability scanning. The tool claims to support over 100 different CMS tools, with extensive support for the commonly used ones like Drupal, Joomla, and WordPress.

The scans performed by CMSeeK include version detection. It can also do enumeration of users, plugins, and themes. This might be useful to see what users or components are available. The tool includes admin page discovery, file discovery, and directory listing. Anything that might be useful to a penetration test or security assessment, might be displayed.

Project details

CMSeeK is written in Python.

Strengths and weaknesses

+ The source code of this software is available

- Full name of author is unknown

Typical usage

Penetration testing
Software exploitation
Software identification
Vulnerability scanning

CMSeeK review

Dagda

Introduction

The main reasons to use Dagda is the detection of vulnerable or malicious components within your containerized environment.

Project details

Dagda is written in Python.

Strengths and weaknesses

+ The source code of this software is available

Typical usage

Malware detection
Malware scanning
Vulnerability management
Vulnerability scanning

Dagda review

Damn Small FI Scanner (DSFS)

Introduction

None

Project details

Damn Small FI Scanner is written in Python.

Strengths and weaknesses

+ The source code of this software is available

Typical usage

Security assessment
Vulnerability scanning

Damn Small FI Scanner review

Damn Small JS Scanner (DSJS)

Introduction

None

Project details

Damn Small JS Scanner is written in Python.

Strengths and weaknesses

+ The source code of this software is available

Typical usage

Penetration testing
Security assessment

Damn Small JS Scanner review

Jackhammer

Introduction

The tool uses RBAC (Role Based Access Control) with different levels of access. Jackhammer uses several tools to do dynamic and static code analysis (e.g. for Java, Ruby, Python, and Nodejs). It checks also for vulnerabilities in libraries. Due to its modular architecture, it can use several scanners out of the box, with options to add your own.

The Jackhammer project was initially added to GitHub on the 8th of May, 2017.

Project details

Jackhammer is written in Ruby.

Strengths and weaknesses

+ The source code of this software is available

Typical usage

Collaboration
Information sharing

Jackhammer review

JoomScan

Introduction

JoomScan could be used to test your Joomla installation or during security assessments. As it has a primary focus on Joomla, it may provide better results than generic vulnerability scanners.

Project details

JoomScan is written in Perl.

Strengths and weaknesses

+ The source code of this software is available

Typical usage

Vulnerability scanning
Vulnerability testing

JoomScan review

LFI Suite

Introduction

This tool is a useful addition to the pentesting toolbox of security professionals. It can help discover and exploit any local file inclusion weakness in applications. Upon success, a reverse shell can be used to get access to the system.

Project details

LFI Suite is written in Python.

Strengths and weaknesses

+ The source code of this software is available

- Full name of author is unknown

Typical usage

Penetration testing
Web application analysis

LFI Suite review

Nikto

Introduction

Nikto helps with performing security scans against web servers and to search for vulnerabilities in web applications.

Project details

Nikto is written in Perl.

Strengths and weaknesses

+ The source code of this software is available
+ Well-known tool

Typical usage

Penetration testing
Security assessment
Web application analysis

Nikto review

Nmap

Introduction

Nmap is short for "Network Mapper". It is a free and open source utility for network discovery and security auditing. It was release in September of 1997 by Gordon Lyon, commonly known under his pseudonym "Fyodor".