Security Monkey alternatives

Looking for an alternative tool to replace Security Monkey? During the review of Security Monkey we looked at other open source tools. Based on their category, tags, and text, these are the ones that have the best match.

Top 3

  1. AWSBucketDump (Amazon S3 bucket scanner)
  2. Bucket Finder (AWS S3 bucket finder)
  3. BuQuikker (find open AWS S3 buckets)

These tools are ranked as the best alternatives to Security Monkey.

Alternatives (by score)

64

AWSBucketDump

Introduction

AWSBucketDump is a security tool to find interesting files in AWS S3 buckets that are part of Amazon cloud services. These storage containers may have interesting files, which a tool like AWSBucketDump can discover.

Project details

AWSBucketDump is written in Python.

Strengths and weaknesses

  • + More than 500 GitHub stars
  • + The source code of this software is available
  • - No releases on GitHub available

Typical usage

  • Configuration audit
  • Discovery of sensitive information
  • Security assessment

AWSBucketDump review

74

Bucket Finder

Introduction

The Bucket Finder tool can be a helpful tool during penetration testing and security assessments. It helps with the discovery of S3 buckets on the Amazon AWS cloud.

Project details

Bucket Finder is written in Ruby.

Strengths and weaknesses

  • + The source code of this software is available
  • - No updates for a while

Typical usage

  • Data leak detection
  • Penetration testing
  • Security assessment

Bucket Finder review

64

BuQuikker

Introduction

BuQuikker is a security tool to scan the Amazon S3 storage service. Its goal is to find open and unprotected S3 buckets.

Project details

BuQuikker is written in Python.

Strengths and weaknesses

  • + The source code of this software is available

    Typical usage

    • Data leak detection
    • Security assessment

    BuQuikker review

    78

    CloudSploit scans

    Introduction

    CloudSploit scans is an open source software project to test security risks related to an AWS account. It runs tests against your Amazon account and aims to discover any potential misconfigured setting or other risks.

    Project details

    CloudSploit scans is written in Node.js.

    Strengths and weaknesses

    • + More than 10 contributors
    • + More than 500 GitHub stars
    • + The source code of this software is available
    • - No releases on GitHub available

    Typical usage

    • Configuration audit
    • IT audit
    • Security assessment

    CloudSploit scans review

    56

    inSp3ctor

    Introduction

    Like other S3 bucket scanners, inSp3ctor helps to find valid storage buckets on Amazon's AWS platform. This can be useful for security assignments like penetration testing or see what information is available about a company. Another option is using it to see if any private data is leaking.

    Project details

    inSp3ctor is written in Python.

    Strengths and weaknesses

    • + The source code is easy to read and understand
    • + Very low number of dependencies
    • + The source code of this software is available
    • - No releases on GitHub available

    Typical usage

    • Penetration testing
    • Security assessment
    • Storage security testing

    inSp3ctor review

    76

    Prowler

    Introduction

    Prowler is a security tool to check systems on AWS against the related CIS benchmark. This benchmark provides a set of best practices for AWS. The primary usage for this tool is system hardening and compliance checking.

    Project details

    Prowler is written in shell script.

    Strengths and weaknesses

    • + More than 25 contributors
    • + More than 500 GitHub stars
    • + The source code of this software is available

      Typical usage

      • Compliance testing
      • Security assessment
      • System hardening

      Prowler review

      60

      s3-fuzzer

      Introduction

      This fuzzing tool helps with discovering sensitive data in Amazon S3 buckets. S3 buckets are storage containers and may reveal data to unauthorized individuals. This tools helps with the discovery process.

      Project details

      s3-fuzzer is written in Golang.

      Strengths and weaknesses

      • + The source code of this software is available

        Typical usage

        • Configuration audit
        • Discovery of sensitive information
        • Security assessment

        s3-fuzzer review

        60

        S3Scanner

        Introduction

        The aptly named S3Scanner is to be used to detect AWS S3 buckets. Discovered buckets are displayed, together with the related objects in the bucket.

        Project details

        S3Scanner is written in Python.

        Strengths and weaknesses

        • + The source code of this software is available

          Typical usage

          • Information gathering
          • Information leak detection
          • Penetration testing
          • Storage security testing

          S3Scanner review

          64

          Teh S3 Bucketeers

          Introduction

          Tools like Teh S3 Bucketeers are valuable for doing reconnaissance and information gathering. They may be used during penetration tests and security assessments. The primary goal of these tools is to find S3 buckets that may lead to sensitive data stored on Amazon's storage service.

          Project details

          Teh S3 Bucketeers is written in shell script.

          Strengths and weaknesses

          • + The source code is easy to read and understand
          • + Used language is shell script
          • + The source code of this software is available
          • - No releases on GitHub available

          Typical usage

          • Penetration testing
          • Security assessment
          • Storage security testing

          Teh S3 Bucketeers review

          64

          Zeus

          Introduction

          Zeus is a tool to perform a quick security scan of an AWS environment. It helps to find missing security controls, so additional system hardening measures can be applied to systems.

          Project details

          Zeus is written in shell script.

          Strengths and weaknesses

          • + Used language is shell script
          • + The source code of this software is available
          • - No releases on GitHub available

          Typical usage

          • Configuration audit
          • Security assessment
          • Self-assessment
          • System hardening

          Zeus review

          84

          DejaVu

          Introduction

          DejaVu is an open source deception framework which can be used to deploy and administer decoys or canaries across a network infrastructure. Defenders can use deception as a technique to learn quickly about possible attackers on the network and take actions.

          Project details

          Strengths and weaknesses

          • + The source code of this software is available
          • - No releases on GitHub available

          Typical usage

          • Security monitoring
          • Threat discovery

          DejaVu review

          70

          pastemon

          Introduction

          Tool like pastemon can detect specific texts on the Pastebin website, like corporate information or sensitive information. It can be used as an early warning system or detect compromises in your environment.

          Project details

          pastemon is written in Perl.

          Strengths and weaknesses

          • + The source code of this software is available
          • - Unknown project license

          Typical usage

          • Security monitoring

          pastemon review

          93

          Cyphon

          Introduction

          Cyphon is built with the Django framework, using Django Rest Framework (DRF) for its API.

          Project details

          Cyphon is written in Python.

          Strengths and weaknesses

          • + The source code of this software is available

            Typical usage

            • Event management

            Cyphon review

            64

            Bucket Stream

            Introduction

            Bucket Stream can be used to discover AWS S3 buckets. This tool may be helpful during reconnaissance and security assessments. As it does not include active scanning on the target itself, it is a passive way of finding information. This is a huge benefit, as you don't have to guess or brute-force the names.

            Project details

            Bucket Stream is written in Python.

            Strengths and weaknesses

            • + Tool is easy to use
            • + The source code of this software is available
            • - No releases on GitHub available

            Typical usage

            • Discovery of sensitive information
            • Information leak detection
            • Penetration testing
            • Reconnaissance

            Bucket Stream review

            96

            Confidant

            Introduction

            Most applications with a connection to a database or other software component, need some form of authentication. Often the related credentials are stored in a configuration file. A secret manager like Confidant will provide an alternative, by storing the details in a database. Only applications that need to access the secrets are allowed to obtain them. Often system administrators are denied access to them.

            Project details

            Confidant is written in Python.

            Strengths and weaknesses

            • + More than 1000 GitHub stars
            • + The source code of this software is available
            • + Supported by a large company

              Typical usage

              • Secrets management
              • Secure storage

              Confidant review

              Some relevant tool missing as an alternative to Security Monkey? Please contact us with your suggestion.