Apache Tomcat Examples Web Application - Cross-Site Scripting

Apache Tomcat 8.5.50 to 8.5.81, 9.0.30 to 9.0.64, 10.0.0-M1 to 10.0.22, and 10.1.0-M1 to 10.1.0-M16 contain a reflected cross-site scripting caused by displaying unfiltered user data in the Form authentication example, letting attackers execute scripts in victim browsers, exploit requires attacke...

OpenCATS 0.9.6 - Cross-Site Scripting

OpenCATS 0.9.6 contains a cross-site scripting vulnerability via the joborderID parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...

NS-ASG Application Security Gateway 6.3 - Sql Injection

A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. This affects an unknown part of the file /protocol/index.php. The manipulation of the argument IPAddr leads to sql injection. It is possible to initiate the attack remotely. The...

CVE-2025-55182_Vulnerable-Application

CVE-2025-55182 Vulnerable Lab Educational testing lab using vulnerable React Server Components to demonstrate security vulnerabilities in modern web frameworks. ⚠️ Important Disclaimer This application is intentionally vulnerable and should ONLY be used for educational purposes in controlled...

pmd

PMD - source code analyzer PMD is an extensible multilanguage static code analyzer. It finds common programming flaws like unused variables, empty catch blocks, unnecessary object creation, and so forth. It's mainly concerned with Java and Apex , but supports 16 other languages. It comes with 400...

tachyon

Tachyon Tachyon is a fast web application security reconnaissance tool. It is specifically meant to crawl a web application and look for left over or non-indexed files with the addition of reporting pages or scripts leaking internal data. User Requirements Linux Python 3.6+ User Installation...

bulwark

An organizational asset and vulnerability management tool, with Jira integration, designed for generating application security reports. Features Multi-client Vulnerability Management Security Report Generation Jira Integration Team-based Roles Authorization API Key & Management Email Integration...

xvna

XVNA Extreme Vulnerable Node Application XVNA is an extreme vulnerable node application coded in NodejsExpressjs/MongoDB that helps security enthusiasts to learn application security. it's not counseled to host this application online as it is intended to be Vulnerable. We tend to suggest hosting...

appsec-forge

appsec-forge Created for Developers, DevOps, AppSec, DevSecOps, and Security Engineers. A repository-first security knowledge base covering secure development, application security, infrastructure, software supply chain, AI, and DevSecOps. Study security problems the same way experienced...

0l4bs

0l4bs Cross-site scripting labs for web application security enthusiasts List of Chall : Chall 1 | URL Chall 2 | Form Chall 3 | User-Agent Chall 4 | Referrer Chall 5 | Cookie Chall 6 | LocalStorage Chall 7 | Login Page Chall 8 | File Upload Chall 9 | Base64 Encoding Chall 10 | Removes Alert Chall...

lightbulb-framework

LightBulb LightBulb is an open source python framework for auditing web application firewalls and filters. Synopsis The framework consists of two main algorithms: GOFA : An active learning algorithm that infers symbolic representations of automata in the standard membership/equivalence query mode...

toolbox

-Significant%20AI%2C%20fully%20reviewed-1f77b4 MCP-based application security testing tools for your coding agent. Not a scanner — a collaborative workbench. Agents struggle with UI and stateful APIs; you're good at both. Sectool lets you explore an application through its proxy while an agent...

Vulnvault

VulnVault 🔐 VulnVault is a practical, developer‑first knowledge base of common and critical application security vulnerabilities, covering the full lifecycle from code to build , infrastructure , and deployment. It provides clear explanations , realistic insecure vs secure code examples , and...

Firefox-Security-Toolkit

Firefox Security Toolkit A tool that transforms Firefox browsers into a penetration testing suite How? It downloads the most important extensions, and install it on your browser. The used extensions has been chosen by a survey among the information security community. Based on it's results, Firef...

awesome-malware-analysis

Awesome Malware Analysis A curated list of awesome malware analysis tools and resources. Inspired by awesome-python and awesome-php. Malware Collection Anonymizers Honeypots Malware Corpora Open Source Threat Intelligence Tools Other Resources Detection and Classification Online Scanners and...

skf-flask

OLD and archived Security Knowledge Framework Please note that this is the archived version of SKF, we are busy building a brand new Security Knowledge Framework. For more updates please visit this github repo: https://github.com/Security-Knowledge-Framework/Platform...

CheatSheetSeries

Welcome to the OWASP Cheat Sheet Series Welcome to the official repository for the Open Worldwide Application Security Project® OWASP Cheat Sheet Series project. The project focuses on providing good security practices for builders in order to secure their applications. In order to read the cheat...

Pegasus-Pentest-Arsenal

Pegasus Pentest Arsenal PPA /\ / | / \ | \ | || | | | | / | /| |/ |/ |/ ,/; ; ; ,'/|; ,/,/, ,'/ |;/,/,/,/| ,/; |;|/,/,/,/,/| ,/'; |;|,/,/,/,/,/| ,/'; |;|/,/,/,/,/,/|, / ; |;|,/,/,/,/,/,/| / ,'; |;|/,/,/,/,/,/,/| /,/'; |;|,/,/,/,/,/,/,/| /;/ '; |;|/,/,/,/,/,/,/,/| ██████╗ ███████╗ ██████╗ █████╗...

AppSecDC2019

This repository does not have a README...

w3af

w3af - Web Application Attack and Audit Framework w3af is an open source web application security scanner which helps developers and penetration testers identify and exploit vulnerabilities in their web applications. The scanner is able to identify 200+ vulnerabilities, including Cross-Site...