Toolbox · Security
Security Commands
Scanners, secrets checks, hashes, keys and quick posture checks you can run from any terminal.
On this page
Scanning
| Command | Purpose |
|---|---|
trivy image --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 img:tag | Image gate |
trivy fs --scanners vuln,secret,misconfig . | Repo scan |
trivy k8s --report summary | Cluster posture |
grype sbom:app.cdx.json --only-fixed --fail-on high | SBOM scan |
syft img:tag -o cyclonedx-json=app.cdx.json | Generate SBOM |
gitleaks git --redact --exit-code 1 . | Secrets in history |
semgrep scan --config p/default --error | SAST |
kube-bench run --targets node | CIS checks |
docker run --rm -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t https://staging.example.com | DAST baseline |
Hashes, keys, certificates
| Command | Purpose |
|---|---|
sha256sum file / shasum -a 256 file | Checksum |
openssl rand -base64 32 | Random secret |
ssh-keygen -t ed25519 -C "ci@example.com" | SSH key |
ssh-keygen -lf key.pub | Fingerprint |
gpg --verify file.sig file | Verify signature |
cosign verify --certificate-identity-regexp '…' --certificate-oidc-issuer https://gitlab.com img@sha256:… | Verify image signature |
openssl x509 -in cert.pem -noout -dates | Certificate validity |
Host posture
| Command | Purpose |
|---|---|
ss -tulpn | What is listening |
sudo find / -perm -4000 -type f 2>/dev/null | SUID binaries |
find / -xdev \( -perm -o+w \) -type f 2>/dev/null | head | World-writable files |
sudo awk -F: '($2 == "") {print $1}' /etc/shadow | Accounts without a password |
grep -E '^PermitRootLogin|^PasswordAuthentication' /etc/ssh/sshd_config | SSH hardening flags |
sudo journalctl -u sshd --since today | grep -i failed | Failed logins |
last -a | head | Recent logins |
Kubernetes quick checks
| Command | Purpose |
|---|---|
kubectl get pods -A --as=system:anonymous | Anonymous access check (expect Forbidden) |
kubectl get pods -A -o json | jq -r '.items[] | select(.spec.containers[].securityContext.privileged==true) | .metadata.name' | Privileged pods |
kubectl get clusterrolebindings -o json | jq -r '.items[] | select(.roleRef.name=="cluster-admin") | .metadata.name' | cluster-admin bindings |
kubectl get ns -o custom-columns='NAME:.metadata.name,PSS:.metadata.labels.pod-security\.kubernetes\.io/enforce' | Pod Security enforcement per namespace |