defenselessV1

defenselessV1 Defenseless is a vulnerable web application written in PHP/MySQL. This is the first version of this application. The purpose of this application is to create security awareness among developers and new guys in application security. It would soon be updated with with more bugs and a...

Probable-Wordlists

Probable Wordlists - Version 2.0 Do you know what the world's most common passwords are? Do you know what they look like? You'll want to avoid them to be secure! Thinking of Cloning? This repository does not contain code, but links to a group of lists. A clone may not be necessary to get the file...

gophish

Gophish Gophish: Open-Source Phishing Toolkit Gophish is an open-source phishing toolkit designed for businesses and penetration testers. It provides the ability to quickly and easily setup and execute phishing engagements and security awareness training. Install Installation of Gophish is...

camjacking

Camjacking CamJackingは、カメラの権限とユーザーの認識を標的とした現実的なフィッシング攻撃をシミュレートするように設計された、エンタープライズグレードのセキュリティ意識向上トレーニングフレームワークです。 🎯 CamJackingとは？ CamJacking は、カメラの権限とユーザーの認識を標的とした現実的なフィッシング攻撃をシミュレートするように設計された、エンタープライズグレードのセキュリティ意識向上トレーニングフレームワーク です。倫理的ハッカー、ペネトレーションテスター、セキュリティ専門家向けに構築されたCamJackingは、組織に以下を可能にします： ✅...

Security-Champions

OWASP セキュリティチャンピオンガイド https://securitychampions.owasp.org/ で、MKDocs を使用してコンテンツをホストしています（OWASP プロジェクトページの隣にあります）。 https://github.com/OWASP/API-Security と https://github.com/OWASP/Top10/tree/master/2021 に触発されています。 Windows でのローカルコピーの構築 Python をインストール python3 -m pip install -r requirements.txt python...

Reel

Reel 設定可能なワークフロー、キャンペーン管理、オプションの認証情報プロキシを備えた、フィッシングシミュレーションおよびセキュリティ意識向上フレームワーク。 クイックスタート（OPS 用途） 1. リポジトリをクローンして、その中に cd します。 2. ./deploy.sh を実行します。Ubuntu を使用している前提で、前提条件を自動設定します。 3. ./start.sh --preload-ml を実行します。これによりサーバーが起動し、使用する ML モデルが事前ロードされます。 Admin UI は http://localhost:8000、フィッシングサーバーは...

csaf

The Cyber Security Awareness Framework CSAF is a structured approach aimed at enhancing cybersecurity awareness and understanding among individuals, organizations, and communities. It provides guidance for the development of effective cybersecurity awareness programs, covering key areas such as...

camjacking-templates

CamJacking CamJackingは、管理された承認済み環境において、カメラ権限のリスク、ブラウザセキュリティ、ソーシャルエンジニアリングへの意識向上についてユーザーを教育することを目的として設計されたセキュリティ意識向上トレーニングおよびシミュレーションフレームワーク です。 🎯 CamJackingとは？ CamJacking は、管理されたラボ環境で実際のカメラ権限プロンプトとユーザー同意シナリオをシミュレートするために構築された、エンタープライズ向けのサイバーセキュリティ意識向上フレームワークです。 組織に以下のことを支援します： ✅...

gophish

Gophish Gophish: 오픈소스 피싱 툴킷 Gophish는 기업과 침투 테스터를 위해 설계된 오픈소스 피싱 툴킷입니다. 신속하고 쉽게 피싱 캠페인과 보안 인식 교육을 설정하고 실행할 수 있는 기능을 제공합니다. 설치 Gophish 설치는 매우 간단합니다. 시스템에 맞는 릴리스가 포함된 zip 파일을 다운로드하여 압축을 풀고 바이너리를 실행하면 됩니다. Gophish는 Windows, Mac, Linux 플랫폼용 바이너리 릴리스를 제공합니다. 소스에서 빌드하기 소스에서 빌드하는 경우 Gophish에는 Go v1.10 이상...

free-interactive-ai-training-materials

すべてのファイルは公式のプロジェクト組織の下に移動されました。このリポジトリへのコントリビューションは自由に行ってください: https://github.com/ransomleak/training-security-awareness...

training-security-awareness

Free Security Awareness Training for Employees — Open Source Interactive SCORM Library 130+ free, open-source security awareness training exercises for employees — hands-on, interactive SCORM modules covering phishing awareness training, phishing simulation, GDPR training, EU AI Act compliance, A...

First-Person Identity Theft Story

Harrowing story of an identity theft victim. Yes, the person made a mistake--they gave the scammer a two-factor authentication code that allowed the scammer to take over their email address. But the real story here is how, for many of us, the security of most of our accounts hangs on the security...

Exploit for CVE-2026-61498

cve-id ⚡ Simple Usage Use this project only in safe and...

From Preventive to Reactive: How AI Coding Assistants Transform Developers' Security Awareness

AI coding assistants are now central to professional software development, yet their impact on how developers think about and practice security remains poorly understood. While prior work has documented vulnerability rates in AI-generated code, a more fundamental question persists: how do these...

Comprehensive List of User Deception Techniques in Emails

Email remains a central communication medium, yet its long-standing design and interface conventions continue to enable deceptive attacks. This research note presents a structured list of 42 email-based deception techniques, documented with 64 concrete example implementations, organized around th...

CISO Spotlight: Dimitris Georgiou on Building Security that Serves People First

Dimitris Georgiou has been a self-professed computer geek since the early 80s. At university, he studied the convergence of educational technology with computer science as part of his psychology MA – finding, to his disbelief, that systems were perilously insecure. Since then, he’s always worked ...

Apeman Cameras

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to take control of the device or view camera feeds. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize...

Women’s History Month: Encouraging women in cybersecurity at every career stage

Women’s History Month—and International Women’s Day on March 8, 2026—always gives me pause for reflection. It’s a moment to think about how far we’ve come and think about who we choose to uplift as we look ahead. Throughout my career, I’ve been inspired by extraordinary women leaders—trailblazers...

CVE-2025-6592

Vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/auth/AuthManager.Php. This issue affects AbuseFilter: from fe0b1cb9e9691faf4d8d9bd80646589f6ec37615 before 1.43.2, 1.44.0...

HardSecBench: Benchmarking the Security Awareness of LLMs for Hardware Code Generation

Large language models LLMs are being increasingly integrated into practical hardware and firmware development pipelines for code generation. Existing studies have primarily focused on evaluating the functional correctness of LLM-generated code, yet paid limited attention to its security issues...