Across the Delivery Pipeline

Build

• Trivy - All-in-one scanner for containers, file systems, git repos, IaC, and Kubernetes; SBOM-aware.
• Grype - Vulnerability scanner for container images and filesystems.
• Syft - SBOM generator for container images and filesystems; output to CycloneDX, SPDX, and others.
• OSV-Scanner - Frontend to the OSV.dev database; scans lockfiles and SBOMs for known vulnerabilities.
• Snyk Open Source CLI - Commercial SCA tool with a free tier; covers many ecosystems.
• Checkov - Static analysis for Terraform, CloudFormation, Kubernetes, Helm, ARM, and more.
• tfsec - Security scanner for Terraform code (now part of the Trivy project).
• KICS - Find security vulnerabilities, compliance issues, and IaC misconfigurations across many IaC platforms.
• Terrascan - IaC scanner that detects compliance and security violations.
• cdxgen - CycloneDX SBOM generator for source code and container images across many languages and package managers.
• OSS Review Toolkit (ORT) - Toolkit that analyzes dependency trees, performs license and vulnerability scanning, and generates SBOMs in CycloneDX and SPDX formats.
• cdk-nag - Checks AWS CDK applications at synthesis time against rule packs (AWS Solutions, HIPAA, NIST 800-53, PCI-DSS) to flag insecure infrastructure definitions before deployment.
• terraform-compliance - BDD-style test framework that checks Terraform plans against user-defined security and compliance rules.

Code

• Semgrep - Lightweight static analysis for many languages, driven by pattern rules; strong AppSec rule packs.
• CodeQL - Semantic code analysis engine from GitHub; treats code as data you can query.
• Bandit - Security linter for Python code.
• Brakeman - Static analysis security scanner for Ruby on Rails.
• gosec - Inspects Go source code for security problems by AST analysis.
• njsscan - Static security scanner for Node.js applications powered by libsast and semgrep.
• Gitleaks - SAST tool for detecting hardcoded secrets like passwords, API keys, and tokens in git repos.
• TruffleHog - Finds and verifies leaked credentials by scanning repos, S3, and other sources.
• detect-secrets - Pre-commit-friendly secrets scanner from Yelp with baseline-based suppression.
• Bearer - Static analysis scanner that discovers and prioritizes security and data-privacy risks in application source code.
• Find Security Bugs - SpotBugs plugin for security audits of Java, Kotlin, Groovy, and Scala applications.
• Horusec - Static analysis tool that scans projects across multiple languages for vulnerabilities from a single command.
• SonarQube Community Edition - Self-hosted static analysis platform for code quality and security issues across 30+ languages.
• 2ms (Too Many Secrets) - Secret scanner for files, git history, and collaboration platforms such as Confluence, Slack, and Discord.
• ggshield - CLI from GitGuardian for detecting and validating hardcoded secrets in code, pre-commit hooks, and CI pipelines.
• Talisman - Pre-commit and pre-push hook that scans outgoing changesets for secrets such as tokens, passwords, and private keys.
• KeyDrift - Scans deployed HTML and JavaScript for exposed secrets while recognizing public browser credentials that should not be treated as leaks.

Operate and Monitor

• Falco - Cloud-native runtime security tool that detects abnormal behavior using kernel events.
• Clair - Open-source project for static analysis of vulnerabilities in container images.
• Dockle - Container image linter for security, helping build best-practice Docker images.
• kube-bench - Checks whether Kubernetes is deployed securely per the CIS Kubernetes Benchmark.
• kube-hunter - Hunts for security weaknesses in Kubernetes clusters.
• kube-linter - Static analysis tool that checks Kubernetes YAML and Helm charts against security and configuration best practices.
• KubeArmor - Runtime security enforcement engine that uses Linux Security Modules (AppArmor/BPF-LSM) to restrict process execution, file access, and network behavior in containers and hosts.
• Kubescape - Open-source Kubernetes security platform covering misconfiguration, compliance, and vulnerability scanning across the pipeline and runtime.
• Kyverno - Kubernetes-native policy engine that validates, mutates, and generates cluster resources as admission-time policy-as-code.
• Popeye - Kubernetes cluster sanitizer that scans live clusters for misconfigurations and resources that deviate from best practices.
• Cloud Custodian - Rules engine for enforcing security, cost, and governance policies across AWS, Azure, and GCP via a YAML DSL.
• CloudFox - Command-line situational-awareness tool that enumerates AWS/Azure/GCP environments to surface exploitable attack paths for penetration testers.
• Cloudsplaining - AWS IAM security-assessment tool that parses account policies to flag violations of least privilege and produces a risk-prioritized report.
• Prowler - Open-source cloud security and compliance tool covering AWS, Azure, GCP, and Kubernetes with hundreds of built-in checks.
• ScoutSuite - Multi-cloud security auditing tool that assesses AWS, Azure, GCP, and other providers' configurations.

Release and Deploy

• cosign (Sigstore) - Container and binary signing, verification, and transparency-log tooling from the Sigstore project.
• GUAC - Aggregates SBOMs, attestations, and vulnerability data into a graph database to map and query software supply-chain relationships.
• in-toto - Framework for cryptographically attesting to and verifying each step of a software supply chain.
• OpenSSF Scorecard - Automated checks that score open-source projects on security best practices (branch protection, pinned dependencies, fuzzing, etc.).
• zizmor - Static analysis tool for GitHub Actions, Dependabot, and pre-commit configs that flags injection flaws and credential-leak risks in CI/CD pipeline definitions.
• SLSA (Supply-chain Levels for Software Artifacts) - Framework with graduated compliance levels for preventing tampering and securing the software supply chain.

Test

• ZAP - Flagship-grade web application scanner with passive scanning, active attack, fuzzing, and scriptable automation. Originated as OWASP ZAP; the core team left OWASP stewardship in September 2023, and it's now maintained under the Linux Foundation, branded "ZAP by Checkmarx."
• Burp Suite - Industry-standard web vulnerability scanner and intercepting proxy by PortSwigger; Community Edition is free.
• Nuclei - Fast, template-based vulnerability scanner driven by a large community template library.
• Nikto - Long-running open-source web server scanner that tests for outdated software and common misconfigurations.
• sqlmap - Automatic SQL injection detection and exploitation tool.
• Wapiti - Web application vulnerability scanner that fuzzes scripts and forms for common injection flaws.
• Schemathesis - Property-based testing for OpenAPI, GraphQL, and other API schemas; finds bugs the spec implies must not exist.
• Postman / Newman - Command-line collection runner for Postman; useful for embedding API security checks into CI.
• Akto - Open-source API security testing platform with traffic-aware test generation.
• Insomnia - Open-source API client useful for manual API exploration alongside automated scans.
• Commix - Automated tool for detecting and exploiting OS command injection vulnerabilities in web applications.
• Dalfox - Go-based scanner that crawls and probes live web applications for XSS and related parameter-injection vulnerabilities, built for CI automation.
• Darkmoon - Open source (GPL-3.0) autonomous AI penetration testing platform covering web, API, Active Directory, and Kubernetes, orchestrating offensive tools as an MCP host with proof of exploitation and a local privacy gateway.
• Jaeles - Signature-based web application scanning framework that executes customizable YAML detection rules at scale.
• OWTF - Offensive Web Testing Framework that unifies many pentesting tools into a semi-automated workflow aligned with the OWASP Testing Guide.
• AFL++ - Community-maintained successor to AFL with modern instrumentation, coverage-guided fuzzing, and QEMU/Unicorn modes.
• boofuzz - Python framework for building network protocol fuzzers, forked and extended from the Sulley fuzzing framework.
• ffuf - Command-line web fuzzer used for content, parameter, and virtual-host discovery via wordlist-driven HTTP requests.
• Jazzer - Coverage-guided, in-process fuzzer for the JVM, commonly used to fuzz Java and Kotlin code.
• LibAFL - Modular Rust library for composing custom coverage-guided fuzzers from reusable components.
• OSS-Fuzz - Google's continuous fuzzing infrastructure for critical open-source projects, integrating with AFL++, libFuzzer, and Honggfuzz.
• Syzkaller - Coverage-guided kernel fuzzer that generates and mutates syscall sequences to uncover OS kernel bugs.
• InQL - GraphQL-focused security testing tool (Burp Suite extension and standalone CLI) that introspects schemas and probes for authorization, injection, and denial-of-service flaws.
• RESTler - Stateful REST API fuzzer that infers request sequences from an OpenAPI spec to uncover security and reliability bugs.
• vacuum - High-speed OpenAPI/AsyncAPI/JSON Schema linter with a built-in OWASP API Security Top 10 ruleset.

Adversarial and Offensive Ops

Adversary Emulation and Purple Teaming

• Atomic Red Team - Library of small, portable tests mapped directly to MITRE ATT&CK techniques for validating detections.
• Caldera - Automated adversary emulation platform, originally developed by MITRE and now under the Apache Software Foundation.
• Sliver - Cross-platform adversary emulation and command-and-control framework supporting multiple communication protocols for red team implants.
• Stratus Red Team - Command-line tool that executes granular, self-contained attack techniques against cloud environments to test detection and response.

AI and LLM Security

• DeepTeam - Open-source framework for red-teaming LLM applications and agents against common attack vectors.
• garak - LLM vulnerability scanner (maintained by NVIDIA) that probes models for prompt injection, hallucination, jailbreaks, and data leakage.
• NeMo Guardrails - Toolkit for adding programmable guardrails to LLM-based conversational systems to control input, output, and dialogue behavior.
• promptfoo - Open-source LLM testing and red-teaming tool for evaluating prompts, agents, and RAG pipelines in CI/CD.
• PyRIT - Open source framework for orchestrating automated red-teaming of generative AI systems to identify risks.

Mobile Security

• MobSF - Mobile Security Framework for automated, all-in-one mobile app pentesting (Android/iOS/Windows) - SAST, DAST, and API testing.
• Frida - Dynamic instrumentation toolkit for developers, reverse engineers, and security researchers.
• Objection - Runtime mobile exploration toolkit powered by Frida.
• APKLeaks - Scan APK files for URIs, endpoints, and secrets.
• Apktool - Tool for reverse engineering Android APK files to decode resources and disassemble bytecode, and to rebuild them after modification.
• JADX - Command-line and GUI tool that decompiles Android DEX and APK files into readable Java source code.

Password and Credential Testing

• hashcat - World's fastest and most advanced open-source password recovery and auditing tool with GPU acceleration.
• Hydra (thc-hydra) - Parallelized network login cracker supporting numerous protocols for testing authentication mechanisms.
• John the Ripper - Long-standing offline password cracker supporting hundreds of hash and cipher types.
• NetExec - Network service exploitation tool for enumerating and attacking Active Directory and other network protocols; the continuation of CrackMapExec.

Reconnaissance

• Nmap - De facto standard network scanner for host discovery and service/version detection.
• Subfinder - Fast passive subdomain enumeration tool.
• httpx - Fast, multi-purpose HTTP toolkit that probes hosts and pulls metadata at scale.
• Metasploit Framework - World's most-used penetration testing framework, with thousands of exploits and auxiliary modules.
• Katana - Crawling and spidering framework that discovers endpoints, forms, and JavaScript-embedded URLs to map a target's attack surface.
• theHarvester - OSINT tool that gathers emails, subdomains, hosts, and employee names from public sources such as search engines and key servers.

Field Kit

Bug Bounty Platforms

• YesWeHack - European bug bounty and vulnerability disclosure platform connecting ethical hackers with organizations.
• Bugcrowd - Crowdsourced security platform running bug bounty and vulnerability disclosure programs for organizations.
• HackerOne - One of the largest bug bounty and coordinated vulnerability disclosure platforms, used by governments and enterprises.
• Intigriti - European crowdsourced security platform for bug bounty and penetration-testing-as-a-service programs.

Certifications

• CISSP (ISC2) - Broad, management-oriented certification covering security and risk management across eight domains; the most widely recognized general infosec credential.
• OSCP (OffSec Certified Professional) - Widely recognized hands-on penetration testing certification built around the PEN-200 course.
• OSWE (OffSec Web Expert) - Advanced, hands-on certification focused on white-box web application exploitation.

Communities and Events

• OWASP Global AppSec - Flagship OWASP conferences held annually in multiple regions.
• OWASP Chapters - Local meetups around the world; a good entry point for the community.
• Black Hat - Information security event series with technical training and briefings.
• DEF CON - One of the world's largest hacker conferences.

Learning Platforms

• PortSwigger Web Security Academy - Free, hands-on web security training from the makers of Burp Suite.
• TryHackMe - Guided learning paths and rooms for offensive and defensive security topics.
• VulnHub - Collection of downloadable vulnerable VM images for offline practice.
• Security Knowledge Framework (SKF) - Expert system that walks developers through secure coding requirements per technology and feature. Started life as an OWASP flagship project; now maintained independently outside OWASP.
• Hack The Box - Penetration-testing labs and challenges, ranging from beginner to expert.
• PentesterLab - Exercises focused on web application vulnerabilities and exploitation.
• Pwning OWASP Juice Shop - Companion book and walkthrough for the Juice Shop challenges.

Newsletters and Podcasts

• tl;dr sec - Weekly newsletter curating notable AppSec tools, talks, and vulnerability research.
• Darknet Diaries - Podcast telling true stories from the dark side of the internet: hacks, breaches, and the people behind them.
• Risky Business - Long-running weekly security news podcast with deep technical and policy analysis.

Related Awesome Lists

Communities and Events

• awesome-security - Broad security tools and resources list.
• awesome-pentest - Penetration testing resources, tools, and references.
• awesome-web-security - Web security materials and resources.
• awesome-appsec - Application security learning resources.
• awesome-api-security - API security tools, talks, and references. (Archived May 2026 - useful as a historical reference.)
• awesome-mobile-security - Mobile security resources for Android and iOS.
• awesome-fuzzing - Fuzzing tools, papers, and resources.
• awesome-sec-talks - Curated links to security conference talks and recordings.

Standards and Frameworks (non-OWASP)

AI and LLM Security

• CWE Top 25 - The most dangerous software weaknesses, maintained by MITRE.
• CIS Benchmarks - Consensus-developed secure-configuration guidelines for systems, cloud, and applications.
• MITRE ATT&CK - Globally accessible knowledge base of adversary tactics and techniques based on real-world observation.

Uncategorized

Uncategorized

• OWASP Top 10 - The flagship awareness document listing the most critical web application security risks.
• OWASP API Security Top 10 - Top API-specific risks (BOLA, broken authentication, mass assignment, etc.).
• OWASP Mobile Top 10 - Top risks for mobile applications.
• OWASP Top 10 for LLM Applications - Risks specific to applications built on large language models.
• OWASP Web Security Testing Guide (WSTG) - Comprehensive guide for testing the security of web applications and services.
• OWASP Mobile Application Security Testing Guide (MASTG) - Comprehensive manual for mobile app security testing and reverse engineering.
• OWASP Application Security Verification Standard (ASVS) - Verification requirements for designing, building, and testing application security controls.
• OWASP Mobile Application Security Verification Standard (MASVS) - Security verification standard for mobile apps, paired with MASTG.
• OWASP Cheat Sheet Series - Concise, high-value guidance for developers and testers on specific AppSec topics.
• OWASP Proactive Controls - Top techniques developers should adopt to build secure software.
• OWASP DevSecOps Guideline - Reference for integrating security into CI/CD pipelines.
• OWASP Nettacker - Automated penetration testing and vulnerability scanning framework.
• OWASP Amass - Attack-surface mapping and external asset discovery via active and passive techniques.
• OWASP Juice Shop - Intentionally insecure modern web application written in Node.js, with built-in challenges.
• OWASP WebGoat - Deliberately insecure Java web application used to teach AppSec lessons.
• OWASP crAPI - Completely Ridiculous API: a vulnerable API for practicing the API Security Top 10.
• OWASP Mutillidae II - Free, open, deliberately vulnerable PHP web application.
• OWASP Security Shepherd - Web and mobile application security training platform with lessons and CTF mode.
• OWASP Dependency-Check - SCA tool that identifies project dependencies and checks them against known vulnerability databases. (The former jeremylong/DependencyCheck repo was archived on 2025-09-27 and superseded by this org.)
• OWASP Dependency-Track - Continuous SBOM analysis platform for managing component risk across portfolios.
• OWASP Threat Dragon - Open-source threat modeling tool with web and desktop versions; supports STRIDE and LINDDUN.
• OWASP pytm - Pythonic framework for threat modeling: define your system in code, generate diagrams and threat reports.
• OWASP Core Rule Set (CRS) - Set of generic attack-detection rules for ModSecurity-compatible WAFs.
• OWASP Coraza - Golang Enterprise-grade WAF library, compatible with ModSecurity SecLang rules and the OWASP CRS.
• OWASP DefectDojo - Open-source application vulnerability correlation and security orchestration platform.
• OWASP SecureCodeBox - Kubernetes-based orchestration platform for running and aggregating security scans at scale.
• OWASP SamuraiWTF - Live linux environment pre-loaded with tools and vulnerable targets for web pen-testing practice.
• project maturity tier - tested a project actually is.
• OWASP AI Security and Privacy Guide - Guidance on securing and governing AI/ML systems across the development and deployment lifecycle.
• OWASP Machine Learning Security Top 10 - Top risks specific to machine learning systems and pipelines.
• OWASP CycloneDX - Lightweight SBOM standard designed for application security and supply-chain risk.
• OWASP Software Assurance Maturity Model (SAMM) - A prescriptive model for assessing and improving software security posture.

Vulnerability Databases and Disclosure

AI and LLM Security

• CISA Known Exploited Vulnerabilities (KEV) Catalog - U.S. government catalog of vulnerabilities with confirmed real-world exploitation, used to prioritize remediation.
• CVE Program - The MITRE-stewarded system for uniquely identifying and cataloging publicly known cybersecurity vulnerabilities.
• GitHub Advisory Database - Community- and vendor-reported security advisories covering open-source packages across major ecosystems.
• National Vulnerability Database (NVD) - NIST's repository of CVE-based vulnerability data enriched with CVSS scores and CPE mappings.
• OSV.dev - Open Source Vulnerabilities database with a machine-readable schema spanning multiple package ecosystems.