849097 matches found
llm-agent-testbed
🛡️ LLM 智能体安全测试平台 面向工具调用型 LLM 智能体的实证漏洞与防御测试框架 一个严谨的安全测试平台，用于检验配备工具的 LLM 智能体是否可能通过提示注入、角色冒充社会工程学和混淆代理攻击被操纵，从而实施未经授权的数据外泄。 核心架构 • 攻击分类 • 朴素版 vs 加固版 • 快速开始 • 路线图 🎯 执行摘要 现代 LLM 驱动的智能体会执行特权操作：查询内部数据库、读取文件系统以及与后端 API 交互。每一个操作都是一道边界，攻击者的提示都可能在此触发未经授权的执行。 ⚠️ 关键架构要点： 漏洞很少单独存在于 LLM 权重之中。...
OWASP-Hunting
Este repositorio no tiene un README...
OWASP-Top-10-AI-Infrastructure-Security-Risks
数据中心与AI基础设施安全风险Top 10 FORGE - 加固模型之下的金属层。 🌐 网站： https://forge-framework.io 执行摘要 AI数据中心的建设速度远超其安全防护速度。 数据中心、GPU云和专用计算环境的快速扩张，在硬件、网络、存储、编排、身份、管理平面和物理运维等方面引入了安全风险。其中许多风险与传统数据中心或云安全问题相似，但现代数据中心和AI基础设施改变了其严重程度：原本为可信运营商设计的系统，如今正在支撑来自无关客户的高价值、多租户工作负载。 数据中心与AI基础设施安全风险Top 10...
CVE-2026-21876
CVE-2026-21876 OWASP CRS WAF bypass CVE-2026-21876 docker container + minimal PoC. I would like to thank @airween and @fzipi separately for their quick response! The vulnerability fix was ready in a very short time. PoC Run: root@kitploit: cd springbootundertowstand or aspnetstand docker compose ...
Teach-AppSec
Teach-AppSec Teach AppSec is a OWASP Application Security project which currently has teaching modules for Risk Management, Software Developement and Operations Security. More modules will be added to this project as and when they are developed. This project is made available on GNU general Publi...
Joomla-CMS-Full-Lifecycle-Pentest
Full-Lifecycle CMS Penetration Testing Joomla 4.2.5 📌 Project Overview This project demonstrates a full-lifecycle penetration test conducted on an open-source CMS Joomla 4.2.5. The entire test follows standard methodologies OWASP/PTES from lab deployment up to exploitation, post-exploitation, and...
Nest
!Issueshttps://img.shields.io/github/issues/owasp/nest?color=blue&style=...
Open-Worldwide-Application-Security-Project-OWASP-
Open-Worldwide-Application-Security-Project-OWASP- Automated Web Vulnerability Assessment of DVWA using OWASP ZAP to identify and analyze critical security flaws like Remote Code Execution CVE-2012-1823...
PSCF
OWASP Product Security Capability Framework PSCF https://prods.ec/ The OWASP Product Security Capability Framework PSCF is a comprehensive guide designed to frame and enhance the security of software products. By leveraging a structured approach to identify, implement, and manage security...
OWASP-MCP-Threat-Modeling
This repository does not have a README...
CVE-2026-21876
CVE-2026-21876（OWASP CRS WAF 绕过） CVE-2026-21876 docker 容器 + 最小化 PoC。 我分别感谢 @airween 和 @fzipi 的快速响应！漏洞修复在很短的时间内就准备好了。 PoC root@kitploit: POST /submit HTTP/1.1 Host: localhost User-Agent: curl/8.17.0 Accept: / Origin: https://example.com Content-Length: 367 Content-Type: multipart/form-data;...
multi-juicer v10.3.1
Running CTFs and Security Trainings with OWASP Juice Shop is usually quite tricky, Juice Shop just isn't intended to be used by multiple users at a time. Instructing everybody how to start Juice Shop on their own machine works ok, but takes away too much valuable time. MultiJuicer gives you the...
wrongsecrets-binaries v0.3.0
wrongsecrets-binaries This is a supportive repository for OWASP WrongSecrets. Here we create our binaries which are included in the official project. Want to add a challenge related to secrets hiding in binary? Open a ticket at WrongSecrets issues. Want to fix something you found in one of the...
django-DefectDojo v3.2.400
DefectDojo | ---|--- DefectDojo is a DevSecOps, ASPM application security posture management, and vulnerability management tool. DefectDojo orchestrates end-to-end security testing, vulnerability tracking, deduplication, remediation, and reporting. Demo Pro Edition: pro.demo.defectdojo.com OWASP...
CICD-Goat-Vapt-Writeup — Updated!
CICD-Goat VAPT Writeup A full vulnerability assessment & penetration test against OWASP CICD-Goat — a deliberately vulnerable CI/CD environment Jenkins, Gitea, GitLab, CTFd — mapped end-to-end against the OWASP Top 10 CI/CD Security Risks. 🧭 How This Fits With My Other Repos Repository| What's in...
CVE-2026-37736
An issue in the JsonSanitizer.sanitize component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service DoS via a crafted input...
EUVD-2026-67773
An issue in the JsonSanitizer.sanitize component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service DoS via a crafted input...
CVE-2026-37736
An issue in the JsonSanitizer.sanitize component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service DoS via a crafted input...
CVE-2026-37736
An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service (DoS) via a crafted input. The vulnerability is rated CVSS 3.1: 7.5 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, meaning it is network-exploitable with n...