YASAT alternatives

Looking for an alternative tool to replace YASAT? During the review of YASAT we looked at other open source tools. Based on their category, tags, and text, these are the ones that have the best match.

Top 3

  1. Lynis (security scanner and compliance auditing tool)
  2. otseca (system information gathering tool)
  3. Cloud Security Suite (cloud security toolkit)

These tools are ranked as the best alternatives to YASAT.

Alternatives (by score)

100

Lynis

Introduction

Lynis is an open source security auditing tool that is available since 2007 and created by Michael Boelen. Its primary goal is to evaluate the security defenses of systems running Linux or other flavors of Unix. It provides suggestions to install, configure, or correct any security measures.

Project details

Lynis is written in shell script.

Strengths and weaknesses

  • + More than 50 contributors
  • + Commercial support available
  • + More than 4000 GitHub stars
  • + Used language is shell script
  • + Very low number of dependencies
  • + Project is mature (10+ years)
  • + The source code of this software is available

    Typical usage

    • IT audit
    • Penetration testing
    • Security assessment
    • System hardening
    • Vulnerability scanning

    Lynis review

    85

    otseca

    Introduction

    Tools like otseca help with data collection. This could be useful for system administrators to collect data on a regular interval. This data then can be compared with a future data capture. Another possibility is to use it during pentesting. In that case one should have already obtained root access, as the tool requires this as well.

    Project details

    otseca is written in shell script.

    Strengths and weaknesses

    • + The source code is easy to read and understand
    • + Tool is modular and extendable
    • + The source code of this software is available

      Typical usage

      • Configuration audit
      • Penetration testing
      • Security assessment

      otseca review

      64

      Cloud Security Suite (CS Suite)

      Introduction

      Cloud Security Suite (CS Suite) is a security toolkit that allows scanning Amazon, Google, and Azure cloud platforms. It leverages tools like Lynis, Prowler, and Scout2 to collect all information. The promise of the tool is to simplify the installation of the tools, their configuration, and the data collection.

      Project details

      Cloud Security Suite is written in Python.

      Strengths and weaknesses

      • + The source code of this software is available
      • - No releases on GitHub available

      Typical usage

      • Configuration audit
      • IT audit
      • Penetration testing
      • System hardening

      Cloud Security Suite review

      64

      LUNAR

      Introduction

      LUNAR is short for Lockdown UNix Auditing and Reporting and runs on the system itself.

      Project details

      LUNAR is written in shell script.

      Strengths and weaknesses

      • + The source code of this software is available

        Typical usage

        • Security assessment
        • Self-assessment
        • System hardening

        LUNAR review

        60

        sysechk (System Security Checker)

        Introduction

        System Security Checker, or sysechk, is a tool to perform a system audit against a set of best practices. It uses a modular approach to test the system.

        Project details

        sysechk is written in shell script.

        Strengths and weaknesses

        • + Used language is shell script
        • + The source code of this software is available

          Typical usage

          • IT audit
          • System hardening

          sysechk review

          64

          Zeus

          Introduction

          Tools like Zeus are useful to perform a quick security scan of an AWS environment. It helps to find missing security controls and apply system hardening measures to systems.

          Project details

          Zeus is written in shell script.

          Strengths and weaknesses

          • + Used language is shell script
          • + The source code of this software is available
          • - No releases on GitHub available

          Typical usage

          • Security assessment
          • Self-assessment
          • System hardening

          Zeus review

          84

          Prowler

          Introduction

          Prowler is the right tool for you when you want to check against the AWS CIS benchmark. The tool is freely available and maintained.

          Project details

          Prowler is written in shell script.

          Strengths and weaknesses

          • + The source code of this software is available

            Typical usage

            • Security assessment
            • System hardening

            Prowler review

            68

            Nix Auditor

            Introduction

            This fairly new tool is written in shell script to scan Linux systems with the focus on security auditing.

            Project details

            Nix Auditor is written in shell script.

            Strengths and weaknesses

            • + Used language is shell script
            • - Full name of author is unknown
            • - Unknown project license

            Nix Auditor review

            96

            testssl.sh

            Introduction

            Key features of testssl.sh include:

            • Clear output: you can tell easily whether anything is good or bad
            • Ease of installation: It works for Linux, Darwin, FreeBSD, NetBSD and MSYS2/Cygwin out of the box: no need to install or configure something, no gems, CPAN, pip or the like.
            • Flexibility: You can test any SSL/TLS enabled and STARTTLS service, not only webservers at port 443
            • Toolbox: Several command line options help you to run YOUR test and configure YOUR output
            • Reliability: features are tested thoroughly
            • Verbosity: If a particular check cannot be performed because of a missing capability on your client side, you'll get a warning
            • Privacy: It's only you who sees the result, not a third party
            • Freedom: It's 100% open source. You can look at the code, see what's going on and you can change it.

            Project details

            testssl.sh is written in shell script.

            Strengths and weaknesses

            • + Used language is shell script
            • + The source code of this software is available

              Typical usage

              • Application testing
              • Configuration audit

              testssl.sh review

              89

              OpenSCAP

              Introduction

              The OpenSCAP project provides a wide variety of hardening guides, configuration baselines, and tools to test for vulnerabilities and configuration issues. It uses SCAP as the protocol to store the underlying data.

              Project details

              OpenSCAP is written in C.

              Strengths and weaknesses

              • + More than 25 contributors
              • + The source code of this software is available
              • + Supported by a large company

                Typical usage

                • Security assessment
                • Vulnerability scanning

                OpenSCAP review

                78

                CloudSploit scans

                Introduction

                CloudSploit scans is an open source software project to test security risks related to an AWS account. It runs tests against your Amazon account and aims to discover any potential misconfigured setting or other risks.

                Project details

                CloudSploit scans is written in Node.js.

                Strengths and weaknesses

                • + More than 10 contributors
                • + More than 500 GitHub stars
                • + The source code of this software is available
                • - No releases on GitHub available

                Typical usage

                • Configuration audit
                • IT audit
                • Security assessment

                CloudSploit scans review

                60

                iniscan

                Introduction

                Iniscan scans a given php.ini file and tests it against security best practices. It reports back the results by showing a Pass or Fail for each related test. As it is a command-line utility, it can be used in automated testing.

                Project details

                iniscan is written in PHP.

                Strengths and weaknesses

                • + More than 25 contributors
                • + More than 1000 GitHub stars
                • + The source code of this software is available

                  Typical usage

                  • Configuration audit
                  • Security assessment

                  iniscan review

                  85

                  Kube-Bench

                  Introduction

                  Tools like Kube-Bench help with quickly checking configuration weaknesses or discovering bad defaults.

                  Project details

                  Kube-Bench is written in Golang.

                  Strengths and weaknesses

                  • + The source code of this software is available

                    Kube-Bench review

                    60

                    SSHsec

                    Introduction

                    SSHsec scans a system running the SSH protocol and retrieves its configuration, host keys, and Diffie-Hellman groups.

                    Project details

                    SSHsec is written in Python.

                    Strengths and weaknesses

                    • + The source code of this software is available

                      Typical usage

                      • Information gathering
                      • Penetration testing
                      • Security assessment

                      SSHsec review

                      76

                      VHostScan

                      Introduction

                      Tools like VHostScan are powerful to perform reconnaissance and discover configuration defaults. This can be useful during penetration tests or security testing, to see if a system has been stripped from default pages. If not, this tool might discover them and provide valuable information about the system.

                      Project details

                      VHostScan is written in Python.

                      Strengths and weaknesses

                      • + The source code of this software is available

                        Typical usage

                        • Penetration testing
                        • Reconnaissance

                        VHostScan review

                        56

                        p0f

                        Introduction

                        This tool is a great addition to nmap, especially if that reveals not reliable data or none at all. Due to the passive way of working, it won't be detected nor influences any connection.

                        - Version 3 of p0f is a full rewrite
                        - The idea for p0f dates back to June 10, 2000
                        - Tool can run in foreground or as a daemon process

                        Common uses for p0f include reconnaissance during penetration tests; routine network monitoring; detection of unauthorized network interconnects in corporate environments; providing signals for abuse-prevention tools; and miscellaneous forensics.

                        Project details

                        Strengths and weaknesses

                        • + Project is mature (10+ years)
                        • + The source code of this software is available
                        • + Well-known tool

                          p0f review

                          64

                          CMSmap

                          Introduction

                          CMSmap helps saving time in the process of detecting what CMS is used for a given web application. It performs reconnaissance and can do additional vulnerability scanning.

                          Project details

                          CMSmap is written in Python.

                          Strengths and weaknesses

                          • + The source code of this software is available

                            Typical usage

                            • Application testing
                            • Information gathering
                            • Vulnerability scanning
                            • Web application analysis

                            CMSmap review

                            60

                            Plecost

                            Introduction

                            Plecost is a security tool to fingerprint WordPress installations and find available vulnerabilities.

                            Project details

                            Plecost is written in Python.

                            Strengths and weaknesses

                            • + Screen output is colored
                            • + The source code of this software is available

                              Typical usage

                              • Web application analysis

                              Plecost review

                              85

                              wafw00f

                              Introduction

                              wafw00f is a security tool to perform fingerprinting on web applications and detect any web application firewall in use.

                              Project details

                              wafw00f is written in Python.

                              Strengths and weaknesses

                              • + The source code of this software is available

                                Typical usage

                                • Application fingerprinting
                                • Information gathering
                                • Penetration testing
                                • Reconnaissance
                                • Security assessment

                                wafw00f review

                                89

                                WhatWeb

                                Introduction

                                WhatWeb can be used stealthy and fast to determine what technologies are used on a particular website or web application. This process called fingerprinting can tell a lot about how it was build and possible weaknesses it might have. The tool can be used in different levels, from stealthy to very aggressive. This last one is useful in penetration tests or during development.

                                Project details

                                WhatWeb is written in Ruby.

                                Strengths and weaknesses

                                • + More than 25 contributors
                                • + More than 1000 GitHub stars
                                • + The source code of this software is available

                                  Typical usage

                                  • Reconnaissance
                                  • Web application analysis

                                  WhatWeb review

                                  56

                                  0trace.py

                                  Introduction

                                  This security tool enables the user to perform hop enumeration (similar to traceroute). Instead of sending actual packets, it uses an established TCP connection.

                                  Project details

                                  0trace.py is written in Python.

                                  Strengths and weaknesses

                                  • + Project is mature (10+ years)
                                  • - Unknown project license

                                  Typical usage

                                  • Bypassing firewall rules
                                  • Bypassing security measures
                                  • Reconnaissance

                                  0trace.py review

                                  74

                                  DataSploit

                                  Introduction

                                  DataSploit is a framework to perform intelligence gathering to discover credentials, domain information, and other information related to the target. It uses various reconnaissance techniques on companies, people, phone numbers, and even cryptocoin technology. It allows aggregating all raw data and return it in multiple formats.

                                  Project details

                                  DataSploit is written in Python.

                                  Strengths and weaknesses

                                  • + More than 10 contributors
                                  • + More than 1000 GitHub stars
                                  • + The source code of this software is available

                                    Typical usage

                                    • Information gathering
                                    • OSINT research
                                    • Security monitoring

                                    DataSploit review

                                    81

                                    detectem

                                    Introduction

                                    Detectem can be a good early vulnerability detection system. By scanning regularly the dependencies of web applications, old versions of tools can be detected and upgraded. This tool is also helpful for penetration tests to find out what kind of software components are used.

                                    Project details

                                    detectem is written in Python.

                                    Strengths and weaknesses

                                    • + The source code of this software is available

                                      Typical usage

                                      • Application security
                                      • Application testing
                                      • Reconnaissance
                                      • Vulnerability scanning

                                      detectem review

                                      64

                                      Domain Analyzer

                                      Introduction

                                      Domain Analyzer is an information gathering tool and comes in handy for reconnaissance. This can be useful for doing penetration testing or evaluating what information is publically available about your own domains. Some pieces of information that can be discovered include DNS servers, IP addresses, mail servers, SPF information, open ports, and more.

                                      Project details

                                      Domain Analyzer is written in Python.

                                      Strengths and weaknesses

                                      • + More than 1000 GitHub stars
                                      • + Very low number of dependencies
                                      • + The source code of this software is available

                                        Typical usage

                                        • Information gathering
                                        • Penetration testing

                                        Domain Analyzer review

                                        85

                                        Gitem

                                        Introduction

                                        Gitem is a reconnaissance tool to extract information about organizations on GitHub. It can be used to find the leaking of sensitive data.

                                        Project details

                                        Gitem is written in Python.

                                        Strengths and weaknesses

                                        • + The source code of this software is available

                                          Typical usage

                                          • Information gathering
                                          • Security assessment
                                          • Security monitoring
                                          • Self-assessment

                                          Gitem review

                                          Some relevant tool missing as an alternative to YASAT? Please contact us with your suggestion.