Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

Projects in Awesome Lists tagged with appsec

A curated list of projects in awesome lists tagged with appsec .

https://github.com/owasp/cheatsheetseries

The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.

application-security appsec best-practices cheatsheets code owasp security

Last synced: 28 Oct 2024

https://github.com/OWASP/CheatSheetSeries

The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.

application-security appsec best-practices cheatsheets code owasp security

Last synced: 24 Oct 2024

https://github.com/juice-shop/juice-shop

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

24pullrequests application-security appsec ctf hacking hacktoberfest javascript owasp owasp-top-10 owasp-top-ten pentesting security vulnapp vulnerable

Last synced: 16 Dec 2024

https://bkimminich.github.io/juice-shop

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

24pullrequests application-security appsec ctf hacking hacktoberfest javascript owasp owasp-top-10 owasp-top-ten pentesting security vulnapp vulnerable

Last synced: 27 Oct 2024

https://github.com/OWASP/wstg

The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.

application-security appsec best-practices bugbounty guide hacking hacktoberfest owasp penetration-testing pentesting security

Last synced: 01 Nov 2024

https://github.com/owasp/wstg

The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.

application-security appsec best-practices bugbounty guide hacking hacktoberfest owasp penetration-testing pentesting security

Last synced: 04 Dec 2024

https://github.com/owasp/go-scp

Golang Secure Coding Practices guide

appsec golang

Last synced: 17 Dec 2024

https://github.com/OWASP/Go-SCP

Golang Secure Coding Practices guide

appsec golang

Last synced: 02 Nov 2024

https://github.com/andresriancho/w3af

w3af: web application attack and audit framework, the open source web vulnerability scanner.

appsec cross-site-scripting scanner security sql-injection

Last synced: 19 Dec 2024

https://github.com/jassics/security-study-plan

Complete Practical Study Plan to become a successful cybersecurity engineer based on roles like Pentest, AppSec, Cloud Security, DevSecOps and so on...

api-security application-security appsec appsec-tutorials aws-security azure-security cybersecurity cybersecurity-education devsecops-university gcp-security infosec pentesting security-testing study-guide study-plan study-planner

Last synced: 05 Dec 2024

https://github.com/foospidy/payloads

Git All the Payloads! A collection of web attack payloads.

appsec cybersecurity hacking passwords payload payloads pentest sqli web-attack-payloads xss

Last synced: 19 Dec 2024

https://github.com/projectdiscovery/interactsh

An OOB interaction gathering server and client library

appsec bugbounty dns golang http ldap oast oob security smtp

Last synced: 16 Dec 2024

https://github.com/openziti/ziti

The parent project for OpenZiti. Here you will find the executables for a fully zero trust, application embedded, programmable network @OpenZiti

appsec golang mesh netsec network networking overlay overlay-network secure-networking vpn vpn-2 zero-trust zero-trust-cloud zero-trust-network zero-trust-network-access zero-trust-security zerotrust ztaa ztha ztna

Last synced: 17 Dec 2024

https://github.com/dependencytrack/dependency-track

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

appsec bill-of-materials bom component-analysis cyclonedx devsecops hacktoberfest nvd ossindex owasp package-url purl sbom sca security security-automation software-composition-analysis software-security vulnerabilities vulnerability-detection

Last synced: 18 Dec 2024

https://github.com/DependencyTrack/dependency-track

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

appsec bill-of-materials bom component-analysis cyclonedx devsecops hacktoberfest nvd ossindex owasp package-url purl sbom sca security security-automation software-composition-analysis software-security vulnerabilities vulnerability-detection

Last synced: 01 Nov 2024

https://github.com/cider-security-research/cicd-goat

A deliberately vulnerable CI/CD environment. Learn CI/CD security through multiple challenges.

appsec cicd ctf devops devsecops gitlab infosec jenkins security

Last synced: 21 Dec 2024

https://github.com/checkmarx/kics

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.

appsec cloudnative devsecops golang hacktoberfest iac infrastructure-as-code open-policy-agent security security-tools vulnerability-detection vulnerability-scanners

Last synced: 24 Oct 2024

https://github.com/Checkmarx/kics

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.

appsec cloudnative devsecops golang hacktoberfest iac infrastructure-as-code open-policy-agent security security-tools vulnerability-detection vulnerability-scanners

Last synced: 25 Oct 2024

https://github.com/webpwnized/mutillidae

OWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security training. This is an easy-to-use web hacking environment designed for labs, security enthusiasts, classrooms, CTF, and vulnerability assessment tool targets.

10 application appsec cybersecurity owasp owasp-top-10 penetration-testing security top training web

Last synced: 19 Dec 2024

https://github.com/roottusk/vapi

vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios through Exercises.

api apitop10 appsec appsec-tutorials bugbounty cors docker exercises hacktoberfest hacktoberfest-accepted owasp owasp-top-10 owasp-top-ten php postman vulnerable-application

Last synced: 21 Dec 2024

https://github.com/owasp/www-community

OWASP Community Pages are a place where OWASP can accept community contributions for security-related content.

appsec community-project owasp

Last synced: 04 Dec 2024

https://github.com/Soluto/kamus

An open source, git-ops, zero-trust secret encryption and decryption solution for Kubernetes applications

appsec devops gitops kms kubernetes kubernetes-secrets soluto-open-source

Last synced: 01 Nov 2024

https://github.com/ayoubfathi/leaky-paths

A collection of special paths linked to common sensitive APIs, devops internals, frameworks conf, known misconfigurations, juicy APIs ..etc. It could be used as a part of web content discovery, to scan passively for high-quality endpoints and quick-wins.

appsec axiom bugbounty dirbuster dirsearch ffuf fuzzing hacktoberfest meg nuclei penetration-testing pentest recon redteam redteaming security security-tools subfinder wayback-machine wordlist

Last synced: 21 Nov 2024

https://github.com/openappsec/openappsec

open-appsec is a machine learning security engine that preemptively and automatically prevents threats against Web Application & APIs. This repo include the main code and logic.

api-security application-security appsec devsecops kong kubernetes nginx nginx-proxy-manager owasp owasp-top-ten rate-limiting security-tools threat-prevention waf web-application-firewall

Last synced: 06 Nov 2024

https://github.com/owasp/railsgoat

A vulnerable version of Rails that follows the OWASP Top 10

appsec owasp-top rails ruby ruby-on-rails security vulnerabilities

Last synced: 19 Dec 2024

https://github.com/OWASP/railsgoat

A vulnerable version of Rails that follows the OWASP Top 10

appsec owasp-top rails ruby ruby-on-rails security vulnerabilities

Last synced: 27 Oct 2024

https://github.com/numirias/security

Some of my security stuff and vulnerabilities. Nothing advanced. More to come.

appsec pentesting security

Last synced: 16 Nov 2024

https://github.com/owasp/owasp-vwad

The OWASP Vulnerable Web Applications Directory project (VWAD) is a comprehensive and well maintained registry of all known vulnerable web applications currently available.

appsec owasp vulnerable vulnerable-web-app vulnerable-web-application

Last synced: 03 Nov 2024

https://github.com/OWASP/OWASP-VWAD

The OWASP Vulnerable Web Applications Directory project (VWAD) is a comprehensive and well maintained registry of all known vulnerable web applications currently available.

appsec owasp vulnerable vulnerable-web-app vulnerable-web-application

Last synced: 10 Nov 2024

https://github.com/zaproxy/community-scripts

A collection of ZAP scripts and tips provided by the community - pull requests very welcome!

appsec dast scripts tips webappsec zaproxy

Last synced: 16 Nov 2024

https://github.com/ShiftLeftSecurity/sast-scan

Scan is a free & Open Source DevSecOps tool for performing static analysis based security testing of your applications and its dependencies. CI and Git friendly.

appsec dependency-scan devsecops license-scan sast scanners workflow

Last synced: 06 Nov 2024

https://github.com/datadog/dd-trace-go

Datadog Go Library including APM tracing, profiling, and security monitoring.

apm appsec datadog distributed-tracing monitoring opentelemetry opentracing otel performance profiling tracing

Last synced: 16 Dec 2024

https://github.com/DataDog/dd-trace-go

Datadog Go Library including APM tracing, profiling, and security monitoring.

apm appsec datadog distributed-tracing monitoring opentelemetry opentracing otel performance profiling tracing

Last synced: 31 Oct 2024

https://github.com/security-prince/Application-Security-Engineer-Interview-Questions

Some of the questions which i was asked when i was giving interviews for Application/Product Security roles. I am sure this is not an exhaustive list but i felt these questions were important to be asked and some were challenging to answer

application-security appsec devsecops infosec interview-questions sdlc security-engineer-interview security-engineering security-team vulnerability webappsec websec websecurity websecurity-reference xss

Last synced: 08 Nov 2024

https://github.com/mobsf/mobsfscan

mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher.

android appsec codereview ios java kotlin mobile-sast objective-c sast security static-analysis swift

Last synced: 21 Dec 2024

https://github.com/TheHackerDev/race-the-web

Tests for race conditions in web applications. Includes a RESTful API to integrate into a continuous integration pipeline.

appsec devops-tools infosec race-conditions security security-tools

Last synced: 03 Nov 2024

https://github.com/Privado-Inc/privado

Open Source Static Scanning tool to detect data flows in your code, find data security vulnerabilities & generate accurate Play Store Data Safety Report.

android-privacy-tools appsec compliance devprivops devsecops gdpr gdpr-compliant hacktoberfest play-store-data-safety privacy-by-design privacy-engineering privacy-labels privacy-policy static-analysis

Last synced: 01 Nov 2024

https://github.com/TupleType/awesome-cicd-attacks

Practical resources for offensive CI/CD security research. Curated the best resources I've seen since 2021.

appsec awesome awesome-list bugbounty cicd cybersecurity devesecops hacking infosec offensive-security penetration-testing research tools

Last synced: 26 Sep 2024

https://github.com/OWASP/threat-model-cookbook

This project is about creating and publishing threat model examples.

appsec threat-model threat-modeling threat-modelling threat-models

Last synced: 09 Nov 2024

https://github.com/ajinabraham/njsscan

njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js applications.

appsec codereview codescanner devsecops expressjs jslint lint linter njsscan nodejs nodejsscan nodesecurity python sast security security-tools semantic static-analysis static-analyzer staticanalysis

Last synced: 19 Dec 2024

https://github.com/volkandindar/agartha

A Burp extension helps identifying injection flaws (LFI, RCE, SQLi), authentication/authorization issues, and HTTP 403 access violations, while also converting HTTP requests to JavaScript for enhanced XSS exploitation.

application-security appsec burp-extensions burpsuite cybersecurity hacking hacking-tool offensivesecurity offsec penetration-testing pentesting

Last synced: 18 Nov 2024

https://github.com/JohnTroony/Blisqy

Version 0.2 - Exploit Time-based blind-SQL injection in HTTP-Headers (MySQL/MariaDB).

appsec blind-sql-injection blisqy database-security exploitation john-ombagi sql sql-injection sql-payloads

Last synced: 21 Nov 2024

https://github.com/m14r41/PentestingEverything

Penetration Testing For - Web | Mobile | API | Thick Client | Source Code Review | DevSecOps | Wireless | Network Pentesting, etc...

active-directory-security api-pentesting application-security appsec docker-security forensic-analysis infrastucture iot-security-testing mobile-pentesting network-security source-code thick-client wifi-hacking

Last synced: 25 Nov 2024

https://github.com/albuch/sbt-dependency-check

SBT Plugin for OWASP DependencyCheck. Monitor your dependencies and report if there are any publicly known vulnerabilities (e.g. CVEs). :rainbow:

appsec cve devops devsecops infosec nvd owasp owasp-dependencycheck sbt sbt-plugin scala security security-audit security-automation software-composition-analysis software-security static-analysis vulnerabilities vulnerability-scanners

Last synced: 21 Nov 2024

https://github.com/zaproxy/zap-hud

The ZAP Heads Up Display (HUD)

appsec hacktoberfest hud zap

Last synced: 16 Nov 2024

https://github.com/ispras/casr

Collect crash (or UndefinedBehaviorSanitizer error) reports, triage, and estimate severity.

afl aflplusplus apport appsec coredump crash crash-reporting devsecops dynamic-analysis exploitable fuzzing gdb libfuzzer rust sdl security ssdlc testing triage vulnerability-management

Last synced: 18 Dec 2024

https://github.com/dschadow/JavaSecurity

Java web and command line applications demonstrating various security topics

appsec cryptography csp csrf esapi google-tink java java-security java-web owasp security security-topics spring spring-boot spring-security xss

Last synced: 12 Dec 2024

https://github.com/stevespringett/nist-data-mirror

A simple Java command-line utility to mirror the CVE JSON data from NIST.

appsec cpe cve java nist nvd sca software-composition-analysis software-security

Last synced: 11 Nov 2024

https://github.com/tprynn/web-methodology

Methodology for high-quality web application security testing - https://github.com/tprynn/web-methodology/wiki

application-security appsec documentation security security-testing web web-application web-application-security

Last synced: 21 Nov 2024

https://github.com/enemy-submarine/pidrila

Python Interactive Deepweb-oriented Rapid Intelligent Link Analyzer

appsec bug-bounty dirbuster hacking netstalking penetration-testing pentest pentesting python scanner scanner-web security

Last synced: 31 Oct 2024

https://github.com/aeria-org/aeria

A CRUD engine for MongoDB with a Prisma-like schema definition language

aeria appsec bun deno javascript low-code mongodb node odm orm prisma rapid-development strong-typed typescript

Last synced: 21 Dec 2024

https://github.com/juxhindb/oob-server

A Bind9 server for pentesters to use for Out-of-Band vulnerabilities

appsec infosec

Last synced: 19 Dec 2024

https://github.com/klarna-incubator/gram

Gram is Klarna's own threat model diagramming tool

appsec cybersecurity infosec threat-modeling

Last synced: 19 Dec 2024

https://github.com/a0xnirudh/kurukshetra

Kurukshetra - A framework for teaching secure coding by means of interactive problem solving.

appsec infosec php secure-coding security

Last synced: 18 Nov 2024

https://github.com/Rezilion/mi-x

Determine whether your compute is truly vulnerable to a specific vulnerability by accounting for all factors which affect *actual* exploitability (runtime execution, configuration, permissions, existence of a mitigation, OS, etc..)

appsec security vulnerability-assessment vulnerability-validation

Last synced: 14 Nov 2024

https://github.com/andresriancho/websocket-fuzzer

HTML5 WebSocket message fuzzer

appsec fuzzing html5 websocket

Last synced: 14 Nov 2024

https://github.com/jenkinsci/dependency-check-plugin

Jenkins plugin for OWASP Dependency-Check. Inspects project components for known vulnerabilities (e.g. CVEs).

appsec component-analysis devops jenkins-plugin nvd owasp owasp-dependencycheck security software-security visibility vulnerabilities

Last synced: 21 Dec 2024

https://github.com/omar2535/GraphQLer

🔍A dependency-aware GraphQL API fuzzing tool

api api-testing-framework appsec automated-testing cybersecurity graphql pentesting

Last synced: 26 Sep 2024

https://github.com/gosecure/template-injection-workshop

Workshop on Template Injection (6 exercises) covering Twig, Jinja2, Tornado, Velocity and Freemaker engines.

appsec codelabs freemarker injection jinja2 template tornado twig velocity vulnerable-web-app

Last synced: 05 Nov 2024

https://github.com/ManuelBerrueta/FlowAnalyzer

FlowAnalyzer is a tool to help in testing and analyzing OAuth 2.0 Flows, including OpenID Connect (OIDC).

appsec identity oauth oauth2 oidc openid openid-connect redteam security security-tools

Last synced: 04 Nov 2024

https://github.com/Anof-cyber/Pentest-Mapper

A Burp Suite Extension for pentester and bug bounty hunters an to maintain checklist, map flows, write test cases and track vulnerabilities

appsec bugbounty burp burp-extensions burp-plugin burpsuite burpsuite-extender burpsuite-tools infosec pentesting

Last synced: 18 Nov 2024

https://github.com/anof-cyber/pentest-mapper

A Burp Suite Extension for pentester and bug bounty hunters an to maintain checklist, map flows, write test cases and track vulnerabilities

appsec bugbounty burp burp-extensions burp-plugin burpsuite burpsuite-extender burpsuite-tools infosec pentesting

Last synced: 06 Nov 2024

https://github.com/rishuranjanofficial/JWTweak

Detects the algorithm of input JWT Token and provide options to generate the new JWT token based on the user selected algorithm.

application-security appsec authentication authorization automation bugbounty jwt jwt-algorithm jwt-algorithm-confusion-attack jwt-tokens pentesting python security-enthusiasts vulnerability-assessment

Last synced: 21 Nov 2024