849093 matches found
androwarn
Androwarn Yet another static code analyzer for malicious Android applications Description Androwarn is a tool whose main aim is to detect and warn the user about potential malicious behaviours developped by an Android application. The detection is performed with the static analysis of the...
awesome-appsec-interview
Awesome AppSec Interview A curated list of resources, practice questions, and study materials to help you prepare for Application Security Engineer interviews, organized by interview type. Contents Interview Overview Secure Code Review Threat Modeling Coding & Scripting Scenario-Based Interviews...
mastg
OWASP Mobile Application Security Testing Guide MASTG The OWASP Mobile Application Security Testing Guide MASTG is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration MASWE...
Massive-Web-Application-Penetration-Testing-Bug-Bounty-Notes
Penetration Testing, Beginners To Expert! This guide is designed for both beginners and experienced penetration testers. It covers all aspects of web application penetration testing, including foundational concepts, setting up testing environments with tools such as Burp Suite and bWAPP, and...
jackhammer
Jackhammer: One Security vulnerability assessment/management tool to solve all the security team problems. What is Jackhammer? Jackhammer is a collaboration tool built with an aim of bridging the gap between Security team vs dev team, QA team and being a facilitator for TPM to understand and trac...
BlackWidow
ABOUT: BlackWidow is a python based web application spider to gather subdomains, URL's, dynamic parameters, email addresses and phone numbers from a target website. This project also includes Inject-X fuzzer to scan dynamic URL's for common OWASP vulnerabilities. DEMO VIDEO: BlackWidow Demo...
ASVS
OWASP 应用安全验证标准 本作品采用 知识共享署名-相同方式共享 4.0 国际许可协议 进行许可。 🎉🎉🎉 欢迎使用 ASVS 5.0 版本！ 🎉🎉🎉 于 2025 年巴塞罗那 Global AppSec EU 大会现场直播发布！ 简介 OWASP 应用安全验证标准（ASVS）项目的主要目标是为所有类型的 Web 应用和 Web 服务提供开放的应用安全标准。 ASVS 于 2008 年通过全球社区合作首次发布，定义了一套全面的安全要求，用于设计、开发和测试现代 Web 应用和服务。 继 2019 年发布 ASVS 4.0 以及 2021 年发布小版本更新（v4.0.3）之后，5.0...
ESAPI__esapi-java-legacy_CVE-2022-23457_2-2-3-1
Enterprise Security API for Java（Legacy） OWASP® ESAPI（OWASP 企业安全 API）是一个免费、开源、Web 应用程序安全控制库，旨在帮助程序员更轻松地开发低风险应用。ESAPI for Java 库专为程序员设计，使其更容易为现有应用程序添加安全功能，同时也为新开发提供了坚实基础。 --- OWASP ESAPI Wiki 页面在哪里？ 您可以访问 https://owasp.org/www-project-enterprise-security-api/ 查看 OWASP ESAPI Wiki 页面。ESAPI legacy...
argus-wp-watcher
Ethical WordPress vulnerability scanner — real-time CVE correlation, OWASP mapping, AI-powered analysis, and consent-based testing. Quick Start · Documentation · Docker · AI Features · Star on GitHub...
dep-scan
Introduction OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration with ASPM/VM...
skill-scanner
Skill Scanner A best-effort security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. Combines YAML + YARA, , and to maximize detection coverage of probable threats while minimizing false positives...
web-threat-mitigation
web-threat-mitigation 关于使用 OWASP ZAP、Burp Suite 和 ModSecurity WAF（含 OWASP CRS）检测和缓解 Web 应用程序威胁的动手实验。案例研究：Spring4Shell CVE-2022-22965。基于本地 Docker 的设置。 Web 威胁缓解实验 – OWASP ZAP、ModSecurity 与 CVE 利用 本仓库记录了一个专注于模拟、分析和缓解常见 Web 应用程序威胁的实验。它包括部署存在漏洞的目标、扫描工具、部署 WAF（ModSecurity with OWASP CRS），以及实时利用...
OSIB
OWASP 开放安全信息库（OSIB） 项目页面： https://owasp.org/www-project-open-security-information-base 软件仓库： https://github.com/OWASP/OSIB 提供的工具： mkdocsmacroosib.py （可手动安装的 Python 模块） osibmacro.py （复制此宏以导入该 Python 模块） 链接/数据： osib.yml （提供数千个（深层）链接，指向 MITRE CWE、OWASP Top10、ASVS、速查表（Cheat Sheets）、主动控制（Proactive...
owasp-istg
OWASP IoT Security Testing Guide The OWASP IoT Security Testing Guide provides a comprehensive methodology for penetration tests in the IoT field offering flexibility to adapt innovations and developments on the IoT market while still ensuring comparability of test results. The guide provides an...
Nettacker
OWASP Nettacker...
GCPGoat
GCPGoat : A Damn Vulnerable GCP Infrastructure Compromising an organization's cloud infrastructure is like sitting on a gold mine for attackers. And sometimes, a simple misconfiguration or a vulnerability in web applications, is all an attacker needs to compromise the entire infrastructure. Since...
OFFAT
OWASP OFFAT OWASP OFFAT OFFensive Api Tester is created to automatically test API for common vulnerabilities after generating tests from openapi specification file. It provides feature to automatically fuzz inputs and use user provided inputs during tests specified via YAML config file. Demo Note...