awesome-appsec

Awesome AppSec A curated list of resources for learning about application security. Contains books, websites, blog posts, and self-assessment quizzes. Maintained by Paragon Initiative Enterprises with contributions from the application security and developer communities. We also have other...

rep-chrome

rep+ rep+ is a lightweight Chrome DevTools extension inspired by Burp Suite's Repeater, now supercharged with AI. I often need to poke at a few requests without spinning up the full Burp stack, so I built this extension to keep my workflow fast, focused, and intelligent with integrated LLM suppor...

awesome-malware-analysis

Awesome Malware Analysis A curated list of awesome malware analysis tools and resources. Inspired by awesome-python and awesome-php. Malware Collection Anonymizers Honeypots Malware Corpora Open Source Threat Intelligence Tools Other Resources Detection and Classification Online Scanners and...

AppSecEzine

AppSec Ezine Raising awareness towards the prevention of security risks is challenging. Most people are unaware of or just don’t have access to the right information. Keeping up the pace in the tech world is a golden rule. If you are not ready to deal with security issues, you are heading in the...

appsec-forge

appsec-forge Created for Developers, DevOps, AppSec, DevSecOps, and Security Engineers. A repository-first security knowledge base covering secure development, application security, infrastructure, software supply chain, AI, and DevSecOps. Study security problems the same way experienced...

STEWS

STEWS: Security Testing and Enumeration of WebSockets STEWS is a tool suite for security testing of WebSockets This research was first presented at OWASP Global AppSec US 2021 Features STEWS provides the ability to: Discover : find WebSockets endpoints on the web by testing a list of domains...

witcher

witcher Implement and monitor Appsec control at scale. Requirements NodeJS 20.13 Tested on Mac Ubuntu How to install $ git clone [email protected]:mf-labs/witcher.git $ cd witcher $ npm i Build a Docker image $ git clone [email protected]:mf-labs/witcher.git $ cd witcher $ docker build ...

Application-Security-Curriculum

Application-Security-Curriculum Grant Ongers - Scaling AppSec through Education - DEF CON 29 AppSec Village...

purify

Purify All-in-one tool for managing vulnerability reports 🎮 Demo 📃 Docs 📹 Quick Vimeo Description The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various even custom tools. Purify is aims to be a tool-agnostic applicatio...

appsec-agent

AppSec Agent AI-powered security agents for code review, PR scanning, threat modeling, fix generation, and more. You can use AppSec Agent in three ways: Path| Best for| Get started ---|---|--- CLI agent-run| Trying agents from your terminal| Getting started npm library| Building your own app or...

awesome-appsec-interview

Awesome AppSec Interview A curated list of resources, practice questions, and study materials to help you prepare for Application Security Engineer interviews, organized by interview type. Contents Interview Overview Secure Code Review Threat Modeling Coding & Scripting Scenario-Based Interviews...

Teach-AppSec

Teach-AppSec Teach AppSec is a OWASP Application Security project which currently has teaching modules for Risk Management, Software Developement and Operations Security. More modules will be added to this project as and when they are developed. This project is made available on GNU general Publi...

What Must Be Done Here? Using a Bounded Application-Security Ontology at the Point of Change

The security guidance that bears on code is real but scattered. It lives across secure-development frameworks, verification standards, controls catalogues, threat taxonomies, and, increasingly, normative regimes such as the EU's NIS2 -- and most of it is written for readers other than the enginee...

PHP 8.5.11 Session Upload Progress Detection

A CrowdSec AppSec rule blocks multipart POST requests containing PHP's PHPSESSIONUPLOADPROGRESS field as defense in depth for affected PHP versions...

witcher

witcher Implementa y monitorea controles de Appsec a escala. Requisitos NodeJS 20.13 Probado en Mac Ubuntu Cómo instalar $ git clone [email protected]:mf-labs/witcher.git $ cd witcher $ npm i Construir una imagen Docker $ git clone [email protected]:mf-labs/witcher.git $ cd witcher $...

toolbox v0.2.2

-Significant%20AI%2C%20fully%20reviewed-1f77b4 MCP-based application security testing tools for your coding agent. Not a scanner — a collaborative workbench. Agents struggle with UI and stateful APIs; you're good at both. Sectool lets you explore an application through its proxy while an agent...

Malicious code in ctosec-appsec-wb-xray-adapters (PyPI)

Source: kam193 71bd5cbfd64c9f4eec926fb0345f7a31ed5a012dfcf6182a0a550c2d3ad93240 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in ctosec-appsec-wb-xray-adapter (PyPI)

Source: kam193 33176e85f6e5dce44273ddbf5be45cf64ddd36db281b50a5868851a32fb19d0c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in appsec-script-py (PyPI)

Source: kam193 41394b4e398c9e82b5b97d5800a6304490350b988e3f053bb6ff9f4f0a5731f9 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in appsec-utils (PyPI)

Source: kam193 c03052298655ba853abe857c8ebbdf21fbb59942800dd2e86aeffbd8ed2751bc Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...