zap-hud

ZAP Heads Up Display The HUD is no longer under active development Unfortunately the HUD is no longer under active development due to the fact no one is focusing on it. The HUD is a unique and innovative interface that we know some people love. But it also needs a non trivial amount of maintenanc...

dvna

Damn Vulnerable NodeJS Application DVNA Damn Vulnerable NodeJS Application DVNA is a simple NodeJS application to demonstrate OWASP Top 10 Vulnerabilities and guide on fixing and avoiding these vulnerabilities. The fixes branch will contain fixes for the vulnerabilities. Fixes for vulnerabilities...

owasp-threat-dragon-desktop

OWASP Threat Dragon Threat Dragon is a free, open-source, cross-platform threat modeling application including system diagramming and a rule engine to auto-generate threats/mitigations. It is an OWASP Incubator Project. The focus of the project is on great UX, a powerful rule engine and integrati...

golismero

What's GoLismero? GoLismero is an open source framework for security testing. It's currently geared towards web security, but it can easily be expanded to other kinds of scans. The most interesting features of the framework are: Real platform independence. Tested on Windows, Linux, BSD and OS X. ...

web-threat-mitigation

web-threat-mitigation Laboratorio pratico per rilevare e mitigare le minacce alle applicazioni web utilizzando OWASP ZAP, Burp Suite e ModSecurity WAF con OWASP CRS. Caso di studio: Spring4Shell CVE-2022-22965. Setup locale basato su Docker. Laboratorio di Mitigazione delle Minacce Web – OWASP ZA...

maswe

OWASP Mobile Application Security Weakness Enumeration MASWE Die OWASP Mobile Application Security Weakness Enumeration MASWE ist eine Liste häufiger Sicherheits- und Datenschutzschwächen in mobilen Anwendungen. Sie dient als Referenz für Entwickler, Sicherheitsforscher und Sicherheitsexperten. S...

LLM-MCP-Security-Field-Guide

🛡️ KI-Sicherheitsleitfaden — LLM + MCP-Sicherheit Der umfassendste, aktuellste, praxisorientierte Sicherheitsleitfaden für LLM-Anwendungen und Model Context Protocol MCP-Bereitstellungen. Behandelt echte CVEs, Live-Angriffsmuster, OWASP-Frameworks, Red-Teaming-Tools und handlungsorientierte...

Owasp-top-10-k8s-2025

OWASP Kubernetes Top 10 2025, praktisch Ein Capture-the-Flag , aufbauend auf dem OWASP Kubernetes Top 10 — 2025. Du wurdest angeheuert, um NimbusMart zu red-teamen, ein fiktives E-Commerce-Unternehmen, dessen Cluster schneller wuchs als seine Sicherheit. Zehn Herausforderungen, eine pro...

Teach-AppSec

Teach-AppSec Teach AppSec ist ein OWASP Application Security Projekt, das derzeit Lehrmodule für Risikomanagement, Softwareentwicklung und Betriebssicherheit umfasst. Weitere Module werden diesem Projekt hinzugefügt, sobald sie entwickelt werden. Dieses Projekt wird unter der GNU General Public...

Joomla-CMS-Full-Lifecycle-Pentest

Test di Penetrazione CMS a Ciclo Completo Joomla 4.2.5 📌 Panoramica del Progetto Questo progetto dimostra un test di penetrazione a ciclo di vita completo condotto su un CMS open source Joomla 4.2.5. L'intero test segue metodologie standard OWASP/PTES dalla distribuzione del laboratorio fino allo...

cwe-tool

cwe-tool Uno strumento da riga di comando per la scoperta di CWE basato sul database OWASP / CAPSEC della Common Weakness Enumeration. Pagina ufficiale di OWASP CWE Toolkit Installazione...

thm-cybersec-portfolio

TryHackMe Notizen — Cybersicherheits-Portfolio Persönliche Notizen und Zusammenfassungen abgeschlossener TryHackMe-Räume. Erstellt als Studienreferenz und Portfolio für IT-Sicherheitsrollen. Abgeschlossene Räume | Raum| Thema ---|---|--- 01| Linux Privilege Escalation|...

ssh-audit

ssh-audit ssh-audit is a tool for ssh server & client configuration auditing. jtesta/ssh-audit v2.0+ is the updated and maintained version of ssh-audit forked from arthepsy/ssh-audit v1.x due to inactivity. Features Usage Screenshots Server Standard Audit Example Server Policy Audit Example Clien...

WebGoat

WebGoat: un'applicazione web deliberatamente insicura Introduzione...

DependencyCheck

...

threat-model-cookbook

OWASP Threat Model Cookbook Projekt Dieses Projekt befasst sich mit der Erstellung und Veröffentlichung von Threat-Model-Beispielen. Sie können in Form von Code, grafischen oder textuellen Darstellungen vorliegen. Die Modelle verwenden verschiedene Technologien, Methoden und Techniken. Sie können...

log4shell-coraza

Log4Shell Security Lab — nginx + Coraza WAF Propósito educacional/defensivo : este laboratório contém um aplicativo intencionalmente vulnerável Log4j 2.14.1 e um kit de exploit JNDI, APENAS para aprender a detectar e bloquear Log4Shell em ambiente isolado. Não implantar na Internet, não usar para...

training-application-security

फ्री सिक्योर कोडिंग और एप्लिकेशन सुरक्षा प्रशिक्षण — ओपन सोर्स SCORM अभ्यास 40 फ्री, ओपन-सोर्स सिक्योर कोडिंग अभ्यास जो वेब एप्लिकेशन सुरक्षा को उस तरह सिखाते हैं जिस तरह डेवलपर्स सीखते हैं — SQL इंजेक्शन, क्रॉस-साइट स्क्रिप्टिंग XSS, और टूटे हुए एक्सेस कंट्रोल जैसी वास्तविक कमजोरियों का शोषण करक...

Drupal-Exploit-Lab

Drupal-Exploit-Lab Dimostrazione sullo sfruttamento di Drupal 7.57 CVE-2018-7600 con e senza WAF Web Application Firewall Descrizione Il progetto mostra come appare lo sfruttamento di Drupal 7.57 in due diversi scenari: 1. Server non protetto → sfruttamento riuscito con Metasploit e ottenimento d...

llm-security-101

एलएलएम सुरक्षा 101 एलएलएम सुरक्षा के क्षेत्र में गहराई से उतरना: आक्रामक और रक्षात्मक टूल्स की खोज, उनकी वर्तमान क्षमताओं को उजागर करना। जैसे-जैसे हम विभिन्न अनुप्रयोगों और कार्यक्षमताओं में लार्ज लैंग्वेज मॉडल एलएलएम को अपना रहे हैं, संबंधित जोखिमों को समझना और संभावित सुरक्षा प्रभावों को सक्रिय...