dvna

Damn Vulnerable NodeJS Application DVNA Damn Vulnerable NodeJS Application DVNA 是一个简单的 NodeJS 应用程序，用于演示 OWASP Top 10 漏洞 并提供修复和避免这些漏洞的指南。fixes 分支包含漏洞的修复代码。OWASssP Top 10 2017 漏洞的修复在 fixes-2017 分支。 该应用程序由常用的库驱动，例如 express、passport、sequelize 等。 开发者安全指南书 该应用程序附带一本 开发者友好的全面指南书 ，可用于学习、避免和修复漏洞。该指南位于 doc...

GCPGoat

GCPGoat : Una infraestructura GCP damnificada y vulnerable Comprometer la infraestructura en la nube de una organización es como sentarse sobre una mina de oro para los atacantes. Y a veces, una simple mala configuración o una vulnerabilidad en aplicaciones web es todo lo que un atacante necesita...

atomicvulns

⚠️ Intentionally vulnerable. Run locally only. Never expose to the internet or a shared network. Read this in other languages: Português Brasil What is atomicvulns? Milestone — v1.0: the web series now covers all ten OWASP Top 10 2021 categories A01–A10 , across . See the...

ARTLAS

ARTLAS Apache 实时日志分析系统 实时 Apache 日志分析器，基于 OWASP 十大漏洞，识别对您 Web 应用程序的探测尝试，并通过 Telegram、Zabbix 和 Syslog/SIEM 通知您或您的应急团队。 ARTLAS 使用来自 PHP-IDS 项目的正则表达式来识别探测尝试，下载最新版本文件的链接： 下载文件 更新日志 root@kitploit: - 为 syslog 和 SIEM 添加 CEF 支持 - 添加连接到 syslog 服务器或 SIEM 的选项 - 添加 Zabbix 集成，支持不同触发器 - 代码审查，添加类结构 - 添加虚拟主机功能 -...

metlo

Metlo API Security Secure Your API. Metlo is an open-source API security platform Metlo is an open source API security tool you can setup in 15 minutes that inventories your endpoints, detects bad actors and blocks malicious traffic in real time. Detect API attacks in real time. Automatically blo...

MobileApp-Pentest-Cheatsheet

Mobile Application Penetration Testing Cheat Sheet La hoja de referencia de pentest de aplicaciones móviles fue creada para proporcionar una colección concisa de información de alto valor sobre temas específicos de pruebas de penetración en aplicaciones móviles y una lista de verificación, que es...

adapt

Summary ADAPT is a tool that performs Automated Dynamic Application Penetration Testing for web applications. It is designed to increase accuracy, speed, and confidence in penetration testing efforts. ADAPT automatically tests for multiple industry standard OWASP Top 10 vulnerabilities, and outpu...

training-application-security

Free Secure Coding & Application Security Training — Open Source SCORM Exercises 40 free, open-source secure coding exercises that teach web application security the way developers learn — by exploiting real vulnerabilities like SQL injection, cross-site scripting XSS, and broken access control,...

dvna

Damn Vulnerable NodeJS Application DVNA Damn Vulnerable NodeJS Application DVNA is a simple NodeJS application to demonstrate OWASP Top 10 Vulnerabilities and guide on fixing and avoiding these vulnerabilities. The fixes branch will contain fixes for the vulnerabilities. Fixes for vulnerabilities...

llm-security-101

Seguridad de LLM 101 Adentrándonos en el ámbito de la seguridad de LLM: una exploración de herramientas ofensivas y defensivas, revelando sus capacidades actuales. A medida que adoptamos los Modelos de Lenguaje de Gran Tamaño LLM en diversas aplicaciones y funcionalidades, es crucial comprender l...

CICD-Goat-Vapt-Writeup

CICD-Goat VAPT Writeup A full vulnerability assessment & penetration test against OWASP CICD-Goat — a deliberately vulnerable CI/CD environment Jenkins, Gitea, GitLab, CTFd — mapped end-to-end against the OWASP Top 10 CI/CD Security Risks. 🧭 How This Fits With My Other Repos Why this exists Most...

Audio-Video-Communications-Top-10

Este repositorio no tiene un README...

thm-cybersec-portfolio

TryHackMe 笔记 — 网络安全作品集 个人笔记和已完成的 TryHackMe 房间总结。 作为 IT 安全角色学习参考和作品集使用。 已完成的房间 | 房间| 主题 ---|---|--- 01| Linux 权限提升| Linux 提权技术 02| Sudo 缓冲区溢出| CVE-2019-18634 03| OWASP Top 10 2025：IAAA 失败| 访问控制失效、认证失败、日志记录 04| OWASP Top 10 2025：应用程序设计缺陷| 配置错误、供应链、加密、不安全设计 05| OWASP Top 10 2025：不安全的数据处理| 加密失败、注入、反序...

cso-vibecheck

cso-vibecheck root@kitploit: ██████╗███████╗ ██████╗ ██╗ ██╗██╗██████╗ ███████╗ ██╔════╝██╔════╝██╔═══██╗ ██║ ██║██║██╔══██╗██╔════╝ ██║ ███████╗██║ ██║ ██║ ██║██║██████╔╝█████╗ ██║ ╚════██║██║ ██║ ╚██╗ ██╔╝██║██╔══██╗██╔══╝ ╚██████╗███████║╚██████╔╝ ╚████╔╝ ██║██████╔╝███████╗ ╚═════╝╚══════╝...

SecureAI-Scan v0.10.0

SecureAI-Scan The AI security scanner that proves its findings. SecureAI-Scan finds LLM, MCP, Agent Skill, and RAG vulnerabilities in TypeScript, JavaScript, and Python — and shows you the evidence: the exact source → flow → sink path for every dataflow finding, resolved through real imports, not...

The OWASP LLM Top 10 Was the Warm-Up: What Comes Next

This is Post 3 of a three-part series. Start withPost 1: Agentic AI Security: The Chatbot Era Is Over, then continue to Post 2: Generative AI Security: Why AI Needs a New Kind of Security. When the OWASP Top 10 for LLM Applications arrived, it did the industry a real service. It gave security tea...

exp-labs

exp-labs Cybersecurity Training Platform This modern web secu...

Why API Discovery Is Critical for Modern AppSec Programs

Hidden API Estate And AI-speed Recon Are Reshaping Modern Application Risk Key Takeaways Unknown APIs create unattributed exposure , and such exposure rarely gets tested. Attackers build their own inventory through live reconnaissance; they do not wait for your spreadsheet. API discovery must pul...

SecureAI-Scan v0.8.0

SecureAI-Scan The AI security scanner that proves its findings. SecureAI-Scan finds LLM, MCP, Agent Skill, and RAG vulnerabilities in TypeScript, JavaScript, and Python — and shows you the evidence: the exact source → flow → sink path for every dataflow finding, resolved through real imports, not...

SecureAI-Scan v0.7.0

SecureAI-Scan The AI security scanner that proves its findings. SecureAI-Scan finds LLM, MCP, Agent Skill, and RAG vulnerabilities in TypeScript, JavaScript, and Python — and shows you the evidence: the exact source → flow → sink path for every dataflow finding, resolved through real imports, not...