awesome-appsec-interview

Awesome AppSec Interview A curated list of resources, practice questions, and study materials to help you prepare for Application Security Engineer interviews, organized by interview type. Contents Interview Overview Secure Code Review Threat Modeling Coding & Scripting Scenario-Based Interviews...

ngrep

ngrep 1.49.0 2.7.2026 ngrep is like GNU grep applied to the network layer. It's a PCAP-based tool that allows you to specify an extended regular or hexadecimal expression to match against data payloads of packets. It understands many kinds of protocols, including IPv4/6, TCP, UDP, ICMPv4/6, IGMP...

purify

Purify All-in-one tool for managing vulnerability reports 🎮 Demo 📃 Docs 📹 Quick Vimeo...

rep-chrome

rep+ rep+ is a lightweight Chrome DevTools extension inspired by Burp Suite's Repeater, now supercharged with AI. I often need to poke at a few requests without spinning up the full Burp stack, so I built this extension to keep my workflow fast, focused, and intelligent with integrated LLM suppor...

witcher

witcher Appsecコントロールを大規模に実装・監視します。 必要条件 NodeJS 20.13 テスト済み環境 Mac Ubuntu インストール方法 root@kitploit: $ git clone [email protected]:mf-labs/witcher.git $ cd witcher $ npm i Dockerイメージのビルド root@kitploit: $ git clone [email protected]:mf-labs/witcher.git $ cd witcher $ docker build -t witcher...

witcher

witcher Implement and monitor Appsec control at scale. Requirements NodeJS 20.13 Tested on Mac Ubuntu How to install root@kitploit: $ git clone [email protected]:mf-labs/witcher.git $ cd witcher $ npm i Build a Docker image root@kitploit: $ git clone [email protected]:mf-labs/witcher.gi...

AppSecEzine

AppSec Ezine 提高对安全风险防范的意识是一项挑战。大多数人不知道或无法获得正确的信息。在科技领域跟上步伐是黄金法则。如果你没有准备好应对安全问题，你就走错了方向。 AppSec Ezine 的诞生源于对信息安全相关内容进行精选的需求，否则这些内容可能会零散地分布在网络上。每一期都涵盖广泛的主题。AppSec Ezine 专注于提供你应该了解的问题（无论新旧）的信息，并让你概览最新的热门话题——那些能帮你度过日常工作或点燃你对这一主题热情的有趣事物。 阅读 AppSec Ezine...

appsec-agent

AppSec Agent コードレビュー、PRスキャン、脅威モデリング、修正生成などのためのAI駆動のセキュリティエージェント。 AppSec Agent は以下の3つの方法で使用できます：...

Teach-AppSec

Teach-AppSec Teach AppSec は、現在リスク管理、ソフトウェア開発、および運用セキュリティの教育モジュールを備えた OWASP Application Security プロジェクトです。 このプロジェクトには、モジュールが開発され次第、さらに追加される予定です。 このプロジェクトは GNU General Public License v2.0 の下で提供されており、以下の許可と条件が適用されます: Permissions| Limitations| Conditions ---|---|--- 商用利用| 免責| ライセンスおよび著作権表示 変更| 保証|...

STEWS

STEWS: Security Testing and Enumeration of WebSockets STEWS is a tool suite for security testing of WebSockets This research was first presented at OWASP Global AppSec US 2021 Features STEWS provides the ability to: Discover : find WebSockets endpoints on the web by testing a list of domains...

Application-Security-Curriculum

Application-Security-Curriculum Grant Ongers - 教育を通じたAppSecのスケーリング - DEF CON 29 AppSec Village...

awesome-appsec

Awesome AppSec アプリケーションセキュリティを学ぶための厳選されたリソースのリストです。書籍、ウェブサイト、ブログ記事、自己評価クイズが含まれています。 Paragon Initiative Enterprises によって管理されており、アプリケーションセキュリティおよび開発者コミュニティからの貢献により成り立っています。また、将来のアプリケーションセキュリティ専門家に役立つ可能性がある他のコミュニティプロジェクトも提供しています。 ソフトウェアセキュリティのトピックについてまったくの初心者であれば、A Gentle Introduction to Application...

appsec-forge

appsec-forge 专为开发人员、DevOps、AppSec、DevSecOps 和安全工程师 打造。 一个以仓库为先的安全知识库，涵盖安全开发、应用安全、基础设施、软件供应链、AI 和 DevSecOps。 像经验丰富的工程团队那样研究安全问题：理解功能、定位根因、分析漏洞利用、对比修复方案，并探索支撑性的安全工程实践。 目录 1. 开始之前 关于 当前可用的案例 Pro 访问权限 可以期待什么？ 如何学习 appsec-forge 2. 仓库结构 仓库布局 如何浏览案例 每个案例的内部结构 3. 继续学习 Public 与 Pro 许可协议 1. 开始之前 关于...

toolbox v0.2.2

-Significant%20AI%2C%20fully%20reviewed-1f77b4 MCP-based application security testing tools for your coding agent. Not a scanner — a collaborative workbench. Agents struggle with UI and stateful APIs; you're good at both. Sectool lets you explore an application through its proxy while an agent...

CVE-2026-44982

CVE-2026-44982 affects CrowdSec AppSec. The bug in pkg/appsec/request.go NewParsedRequestFromRequest reads the body using max(r.ContentLength, 0), causing HTTP/1.1 chunked and HTTP/2 without Content-Length to appear with an empty body, bypassing body-inspection rules (REQUEST_BODY, BODY_ARGS, ARG...

CVE-2026-44982 CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests

CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer from maxr.ContentLength, 0, so HTTP/1.1 requests using Transfer-Encoding: chunked and HTTP/2 requests without a content-length...

CVE-2026-44982 CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests

CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer from maxr.ContentLength, 0, so HTTP/1.1 requests using Transfer-Encoding: chunked and HTTP/2 requests without a content-length...

GO-2026-5641 CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests in github.com/crowdsecurity/crowdsec

CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests in github.com/crowdsecurity/crowdsec...

CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests

Summary The CrowdSec AppSec component fails to read the HTTP request body for any request whose Content-Length is not positive — most notably HTTP/1.1 requests using Transfer-Encoding: chunked and HTTP/2 requests sent without a content-length header. Coraza is then evaluated against an empty body...

[Webinar] Mythos Reality Check: Beating Automated Exploitation at AI Speed

Imagine a world where hackers don't sleep, don't take breaks, and find weak spots in your systems instantly. Well, that world is already here. Thanks to AI, attackers are now launching automated, large-scale exploits faster than ever before. The time you have to fix a vulnerability before it gets...