threat-dragon

build latest practices OWASP Threat Dragon OWASPowasp Threat Dragonproject is a free, open-source, cross-platform threat modeling application. It is used to draw threat modeling diagrams and to list threats for elements in the diagram. Mike Goodwin created Threat Dragon as an open source communit...

training-application-security

Free Secure Coding & Application Security Training — Open Source SCORM Exercises 40 free, open-source secure coding exercises that teach web application security the way developers learn — by exploiting real vulnerabilities like SQL injection, cross-site scripting XSS, and broken access control,...

wrongsecrets-binaries

wrongsecrets-binaries This is a supportive repository for OWASP WrongSecrets. Here we create our binaries which are included in the official project. Want to add a challenge related to secrets hiding in binary? Open a ticket at WrongSecrets issues. Want to fix something you found in one of the...

skill-scanner

Skill Scanner A best-effort security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. It combines pattern-based detection YAML + YARA-X, AST and dataflow analysis , an optional LLM-as-a-judge , and a bounded CEL decision layer over typed...

DonkAI

Hands-on lab for the OWASP Top 10 for LLM Applications 2025 - no real LLM required. DonkAI is deliberately vulnerable web app you can run in one command and use to learn how LLM-integrated systems get broken by actually breaking them. Every OWASP LLM Top 10 category is represented by at least one...

BlackWidow

ABOUT: BlackWidow is a python based web application spider to gather subdomains, URL's, dynamic parameters, email addresses and phone numbers from a target website. This project also includes Inject-X fuzzer to scan dynamic URL's for common OWASP vulnerabilities. DEMO VIDEO: BlackWidow Demo...

Python-Honeypot

OWASP Honeypot OWASP Honeypot is an open-source software in Python language which designed for creating honeypot and honeynet in an easy and secure way! This project is compatible with Python 3.x and tested on Mac OS X, and Linux. We appreciate any contribution, ideas, feedback. feel free to...

OWASP-VWAD

OWASP-VWAD 2024-10-26 ⚠️ This repo is being wound down. Future work should be via www-project-vulnerable-web-applications-directory The OWASP Vulnerable Web Applications Directory Project VWAD, https://owasp.org/www-project-vulnerable-web-applications-directory/ is a comprehensive and well...

VulnReach

VulnReach Runtime-aware SCA — proves which CVEs are actually reachable, not just installed. VulnReach is now an officialOWASP Project. 🎉 Demo Step 1 — SCA surfaces 74 CVEs across dependencies Step 2 — VulnReach proves which ones are actually reachable Findings — evidence chain per CVE Dashboard —...

IoT-Security-Verification-Standard-ISVS

IoT Security Verification Standard ISVS ⚠️ Release Candidate —1.0.0-RC2. This is a release candidate under community review and may change before the final release. It is not yet a finalized standard. Please review and share feedback via GitHub Discussions. The OWASP Internet of Things Security...

STEWS

STEWS: Security Testing and Enumeration of WebSockets STEWS is a tool suite for security testing of WebSockets This research was first presented at OWASP Global AppSec US 2021 Features STEWS provides the ability to: Discover : find WebSockets endpoints on the web by testing a list of domains...

Thick-Client-Pentest-Checklist

THICK CLIENT PENTESTING CHECKLIST OWASP Based Checklist 🌟🌟 80+ Test Cases 🚀🚀 Notion link: https://hariprasaanth.notion.site/THICK-CLIENT-PENTESTING-CHECKLIST-35c6803f26eb4c9d89ba7f5fdc901fb0 INFORMATION GATHERING Information Gathering Find out the application architecture two-tier or three-tier...

FIASSE

A Framework for Integrating Application Security into Software Engineering FIASSE Note: This repository is an ongoing work. Contributions are welcome! Overview TL;DR: please read the DOC. Explore FIASSE website. Visit GitHub Discussions to contribute. This repository contains resources and...

mastg

OWASP Mobile Application Security Testing Guide MASTG The OWASP Mobile Application Security Testing Guide MASTG is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration MASWE...

kstg

OWASP KSTG OWASP Kubernetes Security Testing Guide Our Vision Create a comprehensive manual for Kubernetes Cluster Security Assessment We are creating a comprehensive testing guide for Kubernetes cluster security assessment that covers a top down approach to assess the security of a cluster. The...

pmd

PMD - source code analyzer PMD is an extensible multilanguage static code analyzer. It finds common programming flaws like unused variables, empty catch blocks, unnecessary object creation, and so forth. It's mainly concerned with Java and Apex , but supports 16 other languages. It comes with 400...

SecureAI-Scan

SecureAI-Scan An offline scanner for the code that talks to LLMs, MCP servers, vector stores, and Agent Skills. It finds prompt injection, MCP command injection and path traversal, RAG data leaks, and poisoned skills, and it proves each finding with a source → sink trace through your real imports...

OFFAT

OWASP OFFAT OFFensive Api Tester — source-aware API security testing. Maps your API from code, proves source→sink paths on a code graph, executes tests with a Rust engine, and triages the results with AI. Documentation · Install · Usage · GitHub Action Authorized use only. Live runs send real...

ssh-audit

ssh-audit ssh-audit is a tool for ssh server & client configuration auditing. jtesta/ssh-audit v2.0+ is the updated and maintained version of ssh-audit forked from arthepsy/ssh-audit v1.x due to inactivity. Features Usage Screenshots Server Standard Audit Example Server Policy Audit Example Clien...

json-sanitizer

json-sanitizer Given JSON-like content, The JSON Sanitizer converts it to valid JSON. Getting Started - Contact This can be attached at either end of a data-pipeline to help satisfy Postel's principle: be conservative in what you do, be liberal in what you accept from others Applied to JSON-like...