seccubus

About Seccubus Seccubus automates regular vulnerability scans with various tools and aids security people in the fast analysis of its output, both on the first scan and on repeated scans. On repeated scan delta reporting ensures that findings only need to be judged when they first appear in the...

coraza

Coraza - Web Application Firewall...

dependency-track

OWASP Dependency-Track Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials SBO...

ZSC

OWASP ZSC THIS SOFTWARE WAS CREATED TO CHALLENGE ANTIVIRUS TECHNOLOGY, RESEARCH NEW ENCRYPTION METHODS, AND PROTECT SENSITIVE OPEN SOURCE FILES WHICH INCLUDE IMPORTANT DATA. CONTRIBUTORS AND OWASP FOUNDATION WILL NOT BE RESPONSIBLE FOR ANY ILLEGAL USAGE. OWASP ZSC is open source software written ...

route-detect

route-detect Find authentication authn and authorization authz security bugs in web application routes: Routes fromkoel streaming server Web application HTTP route authn and authz bugs are some of the most common security issues found today. These industry standard resources highlight the severit...

pmd

PMD - source code analyzer PMD is an extensible multilanguage static code analyzer. It finds common programming flaws like unused variables, empty catch blocks, unnecessary object creation, and so forth. It's mainly concerned with Java and Apex , but supports 16 other languages. It comes with 400...

ARTLAS

ARTLAS Apache Real Time Logs Analyzer System Real time Apache log analyzer, based on top 10 OWASP vulnerabilities, identifies attempts of exploration in your web application, and notify you or your incident team on Telegram, Zabbix and Syslog/SIEM. ARTLAS uses the regular expression from the...

agent-governance-toolkit

🌍 English | 日本語 | 简体中文 | 한국어 Agent Governance Toolkit Ship agents to production without losing sleep 🚀Quick Start · 📋 Specifications · 📦 PyPI · 📝 Changelog -brightgreen !IMPORTANT Public P...

nmap

Nmap Nmap is released under a custom license, which is based on but not compatible with GPLv2. The Nmap license allows free usage by end users, and we also offer a commercial license for companies that wish to redistribute Nmap technology with their products. See Nmap Copyright and Licensing for...

SecureTea-Project

OWASP SECURETEA TOOL PROJECT Codacy Badge The OWASP SecureTea Project is an application designed to help Secure a person's laptop or computer / server with IoT Internet Of Things for notify users via various communication mechanisms, whenever someone accesses their computer / server. This...

multi-juicer

Running CTFs and Security Trainings with OWASP Juice Shop is usually quite tricky, Juice Shop just isn't intended to be used by multiple users at a time. Instructing everybody how to start Juice Shop on their own machine works ok, but takes away too much valuable time. MultiJuicer gives you the...

wstg

OWASP Web Security Testing Guide Welcome to the official repository for the Open Worldwide Application Security Project® OWASP® Web Security Testing Guide WSTG. The WSTG is a comprehensive guide to testing the security of web applications and web services. Created by the collaborative efforts of...

FiddleZAP

FiddleZAP FiddleZAP is a simplified version of EKFiddle for OWASP ZAP. With ZAP as your web proxy, you are able to flag malicious traffic based on predefined regular expressions. Example: Alert, highlighting and tagging when a regex matches on a string within the HTML source code of a compromised...

D4N155

OWASP D4N155 BUG: Extract urls by domain dont work. Crawler Google stop. I'll fix It's an information security audit tool that creates intelligent wordlists based on the content of the target page. Help us, See some calculations used Ongoing projects 👷: D4N155 in docker 🎁, Web API D4N155 ☁️,...

metlo

Metlo API Security Secure Your API. Metlo is an open-source API security platform Metlo is an open source API security tool you can setup in 15 minutes that inventories your endpoints, detects bad actors and blocks malicious traffic in real time. Detect API attacks in real time. Automatically blo...

VAmPI

VAmPI The Vulnerable API Based on OpenAPI 3 VAmPI is a vulnerable API made with Flask and it includes vulnerabilities from the OWASP top 10 vulnerabilities for APIs. It was created as I wanted a vulnerable API to evaluate the efficiency of tools used to detect security issues in APIs. It includes...

IoTGoat

OFFICIAL REPO HAS BEEN MOVED TOhttps://github.com/OWASP/IoTGoat Description The IoTGoat Project is a deliberately insecure firmware based on OpenWrt and maintained by OWASP to educate users how to test for the most common vulnerabilities found in IoT devices. The vulnerability challenges are base...

autopentest-ai

AutoPentest An agentic pentesting MCP server that automates web application penetration testing using the full OWASP Web Security Testing Guide and PortSwigger Web Security Academy technique references. Point it at a target — it crawls your app, maps every endpoint, then spawns role-specialized...

SecureAI-Scan

SecureAI-Scan Offline CLI that scans TypeScript, JavaScript, and Python for LLM, MCP, Agent Skill, and RAG risks — import-resolved dataflow evidence, zero default false positives, mapped to OWASP LLM/ASI/MCP Top 10...

CheatSheetSeries

Welcome to the OWASP Cheat Sheet Series Welcome to the official repository for the Open Worldwide Application Security Project® OWASP Cheat Sheet Series project. The project focuses on providing good security practices for builders in order to secure their applications. In order to read the cheat...