Awesome Lists

awesome-web-security

by qazbnm456

awesome listpushed over 2 years ago

šŸ¶ A curated list of Web Security materials and resources.

AI summary

Web Security Guide

A curated list of Web Security resources and materials to help developers learn about web vulnerabilities and security techniques.

stars
11.5K
forks
1.7K
watching
382
awesome lists
8
entries
398
View on GitHubawesomelists.top/#/repos/qazbnm456/awesome-web-security

Embed the badge

Show how many awesome lists link to your project. The count updates automatically.

Awesome Lists badge
Markdown
[![Awesome Lists Badge](https://awesome.facts.dev/shield/qazbnm456/awesome-web-security/links.svg)](https://awesome.facts.dev/awesome/qazbnm456/awesome-web-security)
HTML
<a href="https://awesome.facts.dev/awesome/qazbnm456/awesome-web-security"><img src="https://awesome.facts.dev/shield/qazbnm456/awesome-web-security/links.svg" alt="Awesome Lists Badge" /></a>
Image URL
https://awesome.facts.dev/shield/qazbnm456/awesome-web-security/links.svg

What's in the list

398 links in 84 sections, with live GitHub stats.activeno commit in 2y

Digests

Forums

Introduction / XSS - Cross-Site Scripting

Introduction / Prototype Pollution

Introduction / CSV Injection

Introduction / SQL Injection

Introduction / Command Injection

Introduction / ORM Injection

Introduction / FTP Injection

Introduction / XXE - XML eXternal Entity

Introduction / CSRF - Cross-Site Request Forgery

Introduction / Clickjacking

Introduction / SSRF - Server-Side Request Forgery

Introduction / Web Cache Poisoning

Introduction / Relative Path Overwrite

Introduction / Open Redirect

Introduction / Security Assertion Markup Language (SAML)

Introduction / Upload

Introduction / Rails

Introduction / AngularJS

Introduction / ReactJS

Introduction / SSL/TLS

Introduction / Webmail

Introduction / NFS

Introduction / AWS

Introduction / Azure

Introduction / Sub Domain Enumeration

Introduction / Crypto

Introduction / Web Shell

Introduction / OSINT

Introduction / DNS Rebinding

Introduction / Deserialization

Introduction / OAuth

Introduction / JWT

Evasions / XXE

Evasions / CSP

Evasions / WAF

Evasions / JSMVC

Evasions / Authentication

Tricks / CSRF

Tricks / Clickjacking

Tricks / Remote Code Execution

Tricks / XSS

Tricks / SQL Injection

Tricks / NoSQL Injection

Tricks / FTP Injection

Tricks / XXE

Tricks / SSRF

Tricks / Web Cache Poisoning

Tricks / Header Injection

Tricks / URL

Tricks / Deserialization

Tricks / OAuth

Tricks / Others

Browser Exploitation / Frontend (like SOP bypass, URL spoofing, and something like that)

Browser Exploitation / Backend (core of Browser implementation, and often refers to C or C++ part)

PoCs / Database

  • js-vuln-db

    Collection of JavaScript engine CVEs with PoCs by

    2.3K7 years
  • awesome-cve-poc

    Curated list of CVE PoCs by

    3.3Kalmost 5 years
  • Some-PoC-oR-ExP

    各ē§ę¼ę“žpoc态Expēš„ę”¶é›†ęˆ–ē¼–写 by

    2.4Kover 2 years
  • uxss-db

    Collection of UXSS CVEs with PoCs by

    686over 5 years
  • SPLOITUS

    Exploits & Tools Search Engine by

  • Exploit Database

    ultimate archive of Exploits, Shellcode, and Security Papers by

Cheetsheets

Tools / Auditing

  • prowler

    Tool for AWS security assessment, auditing and hardening by

    10.9Kalmost 2 years
  • slurp

    Evaluate the security of S3 buckets by

    24 years
  • A2SV

    Auto Scanning to SSL Vulnerability by

    627almost 6 years

Tools / Command Injection

  • commix

    Automated All-in-One OS command injection and exploitation tool by

    4.6Kalmost 2 years

Tools / Reconnaissance

  • Shodan

    Shodan is the world's first search engine for Internet-connected devices by

  • Censys

    Censys is a search engine that allows computer scientists to ask questions about the devices and networks that compose the Internet by

  • urlscan.io

    Service which analyses websites and the resources they request by

  • ZoomEye

    Cyberspace Search Engine by

  • FOFA

    Cyberspace Search Engine by

  • NSFOCUS

    THREAT INTELLIGENCE PORTAL by NSFOCUS GLOBAL

  • Photon

    Incredibly fast crawler designed for OSINT by

    11.1K2 years
  • FOCA

    FOCA (Fingerprinting Organizations with Collected Archives) is a tool used mainly to find metadata and hidden information in the documents its scans by

    3Kalmost 4 years
  • SpiderFoot

    Open source footprinting and intelligence-gathering tool by

  • xray

    XRay is a tool for recon, mapping and OSINT gathering from public networks by

    2.2K2 years
  • gitrob

    Reconnaissance tool for GitHub organizations by

    6K4 years
  • GSIL

    Github Sensitive Information Leakageļ¼ˆGithubꕏꄟäæ”ęÆę³„éœ²ļ¼‰by

    2.1Kalmost 3 years
  • raven

    raven is a Linkedin information gathering tool that can be used by pentesters to gather information about an organization employees using Linkedin by

    778over 6 years
  • ReconDog

    Reconnaissance Swiss Army Knife by

    1.8Kover 5 years
  • Databases - start.me

    Various databases which you can use for your OSINT research by

  • peoplefindThor

    the easy way to find people on Facebook by [postkassen]( ?subject=peoplefindthor.dk comments)

  • tinfoleak

    The most complete open-source tool for Twitter intelligence analysis by

    1.9Kover 7 years
  • Raccoon

    High performance offensive security tool for reconnaissance and vulnerability scanning by

    3.1Kover 2 years
  • Social Mapper

    Social Media Enumeration & Correlation Tool by Jacob Wilkin(Greenwolf) by

    3.8Kover 4 years
  • espi0n/Dockerfiles

    Dockerfiles for various OSINT tools by

    398 years
  • Sublist3r

    Sublist3r is a multi-threaded sub-domain enumeration tool for penetration testers by

    9.9K2 years
  • EyeWitness

    EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible by

    20over 2 years
  • subDomainsBrute

    A simple and fast sub domain brute tool for pentesters by

    3.5K4 years
  • AQUATONE

    Tool for Domain Flyovers by

    5.7Kover 4 years
  • domain_analyzer

    Analyze the security of any domain by finding all the information possible by

    1.8Kalmost 4 years
  • VirusTotal domain information

    Searching for domain information by

  • Certificate Transparency

    Google's Certificate Transparency project fixes several structural flaws in the SSL certificate system by

    8703 years
  • Certificate Search

    Enter an Identity (Domain Name, Organization Name, etc), a Certificate Fingerprint (SHA-1 or SHA-256) or a crt.sh ID to search certificate(s) by

  • GSDF

    Domain searcher named GoogleSSLdomainFinder by

    176over 8 years

Tools / Code Generating

  • VWGen

    Vulnerable Web applications Generator by

    84almost 9 years

Tools / Fuzzing

  • wfuzz

    Web application bruteforcer by

    6K2 years
  • charsetinspect

    Script that inspects multi-byte character sets looking for characters with specific user-defined properties by

    26over 10 years
  • IPObfuscator

    Simple tool to convert the IP to a DWORD IP by

    1384 years
  • domato

    DOM fuzzer by

    1.7Kalmost 2 years
  • FuzzDB

    Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery

    8.3Kalmost 3 years
  • dirhunt

    Web crawler optimized for searching and analyzing the directory structure of a site by

    1.8Kalmost 3 years
  • ssltest

    Online service that performs a deep analysis of the configuration of any SSL web server on the public internet. Provided by

  • fuzz.txt

    Potentially dangerous files by

    2.9Kalmost 2 years

Tools / Scanning

  • wpscan

    WPScan is a black box WordPress vulnerability scanner by

    8.7Kalmost 2 years
  • JoomlaScan

    Free software to find the components installed in Joomla CMS, built out of the ashes of Joomscan by

    2153 years
  • WAScan

    Is an open source web application security scanner that uses "black-box" method, created by

  • Nuclei

    Nuclei is a fast tool for configurable targeted scanning based on templates offering massive extensibility and ease of use by

    21.1Kalmost 2 years

Tools / Penetration Testing

  • Burp Suite

    Burp Suite is an integrated platform for performing security testing of web applications by

  • TIDoS-Framework

    A comprehensive web application audit framework to cover up everything from Reconnaissance and OSINT to Vulnerability Analysis by

    1.8Kover 3 years
  • Astra

    Automated Security Testing For REST API's by

    2.5Kover 2 years
  • aws_pwn

    A collection of AWS penetration testing junk by

    1.2K3 years
  • grayhatwarfare

    Public buckets by

Tools / Offensive

  • beef

    The Browser Exploitation Framework Project by

    9.9Kalmost 2 years
  • JShell

    Get a JavaScript shell with XSS by

    511over 7 years
  • XSStrike

    XSStrike is a program which can fuzz and bruteforce parameters for XSS. It can also detect and bypass WAFs by

    13.5K2 years
  • xssor2

    XSS'OR - Hack with JavaScript by

    2.1Kalmost 5 years
  • csp evaluator

    A tool for evaluating content-security-policies by

  • sqlmap

    Automatic SQL injection and database takeover tool

    32.8Kalmost 2 years
  • tplmap

    Code and Server-Side Template Injection Detection and Exploitation Tool by

    3.8Kover 2 years
  • dtd-finder

    List DTDs and generate XXE payloads using those local DTDs by

    615over 2 years
  • XSRFProbe

    The Prime CSRF Audit & Exploitation Toolkit by

    1.1Kalmost 2 years
  • Open redirect/SSRF payload generator

    Open redirect/SSRF payload generator by

Tools / Leaking

  • HTTPLeaks

    All possible ways, a website can leak HTTP requests by

    2Kalmost 2 years
  • dvcs-ripper

    Rip web accessible (distributed) version control systems: SVN/GIT/HG... by

    1.7K2 years
  • DVCS-Pillage

    Pillage web accessible GIT, HG and BZR repositories by

    314over 9 years
  • GitMiner

    Tool for advanced mining for content on Github by

    2.1K6 years
  • gitleaks

    Searches full repo history for secrets and keys by

    18.2Kalmost 2 years
  • CSS-Keylogging

    Chrome extension and Express server that exploits keylogging abilities of CSS by

    3.2Kover 8 years
  • pwngitmanager

    Git manager for pentesters by

    107over 10 years
  • snallygaster

    Tool to scan for secret files on HTTP servers by

    2.1Kalmost 2 years
  • LinkFinder

    Python script that finds endpoints in JavaScript files by

    3.8Kover 2 years

Tools / Detecting

  • sqlchop

    SQL injection detection engine by

  • xsschop

    XSS detection engine by

  • retire.js

    Scanner detecting the use of JavaScript libraries with known vulnerabilities by

    3.7Kalmost 2 years
  • malware-jail

    Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction by

    465over 3 years
  • repo-supervisor

    Scan your code for security misconfiguration, search for passwords and secrets

    638over 3 years
  • bXSS

    bXSS is a simple Blind XSS application adapted from by

    522over 3 years
  • OpenRASP

    An open source RASP solution actively maintained by Baidu Inc. With context-aware detection algorithm the project achieved nearly no false positives. And less than 3% performance reduction is observed under heavy server load

    2.8Kover 2 years
  • GuardRails

    A GitHub App that provides security feedback in Pull Requests

Tools / Preventing

  • DOMPurify

    DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG by

    14.2Kalmost 2 years
  • js-xss

    Sanitize untrusted HTML (to prevent XSS) with a configuration specified by a Whitelist by

    5.2Kover 2 years
  • Acra

    Client-side encryption engine for SQL databases, with strong selective encryption, SQL injections prevention and intrusion detection by

    1.4K2 years
  • Csper

    A set of tools for building/evaluating/monitoring content-security-policy to prevent/detect cross site scripting by

Tools / Proxy

  • Charles

    HTTP proxy / HTTP monitor / Reverse Proxy that enables a developer to view all of the HTTP and SSL / HTTPS traffic between their machine and the Internet

  • mitmproxy

    Interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers by

    37.1Kalmost 2 years

Tools / Webshell

  • nano

    Family of code golfed PHP shells by

    436over 6 years
  • webshell

    This is a webshell open source project by

    10.2Kover 2 years
  • Weevely

    Weaponized web shell by

    3.2Kalmost 2 years
  • Webshell-Sniper

    Manage your website via terminal by

    422over 5 years
  • Reverse-Shell-Manager

    Reverse Shell Manager via TerminalĀ 

    240over 3 years
  • reverse-shell

    Reverse Shell as a Service by

    1.9Kover 2 years
  • PhpSploit

    Full-featured C2 framework which silently persists on webserver via evil PHP oneliner by

    2.2Kover 2 years

Tools / Disassembler

  • plasma

    Plasma is an interactive disassembler for x86/ARM/MIPS by

    3.1K5 years
  • radare2

    Unix-like reverse engineering framework and commandline tools by

    20.9Kalmost 2 years
  • Iaitō

    Qt and C++ GUI for radare2 reverse engineering framework by

    1.5Kover 5 years

Tools / Decompiler

  • CFR

    Another java decompiler by

Tools / DNS Rebinding

  • DNS Rebind Toolkit

    DNS Rebind Toolkit is a frontend JavaScript framework for developing DNS Rebinding exploits against vulnerable hosts and services on a local area network (LAN) by

    4875 years
  • dref

    DNS Rebinding Exploitation Framework. Dref does the heavy-lifting for DNS rebinding by

    486over 5 years
  • Singularity of Origin

    It includes the necessary components to rebind the IP address of the attack server DNS name to the target machine's IP address and to serve attack payloads to exploit vulnerable software on the target machine by

    1Kalmost 2 years
  • Whonow DNS Server

    A malicious DNS server for executing DNS Rebinding attacks on the fly by

    630almost 5 years

Tools / Others

  • Dnslogger

    DNS Logger by

  • CyberChef

    The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis - by

    29.6Kalmost 2 years
  • ntlm_challenger

    Parse NTLM over HTTP challenge messages by

    143almost 4 years
  • cefdebug

    Minimal code to connect to a CEF debugger by

    197over 6 years
  • ctftool

    Interactive CTF Exploration Tool by

    1.6K5 years

Social Engineering Database

  • haveibeenpwned

    Check if you have an account that has been compromised in a data breach by

Blogs

Twitter Users

Practices / Application

  • OWASP Juice Shop

    Probably the most modern and sophisticated insecure web application - Written by and the team

    10.6Kalmost 2 years
  • BadLibrary

    Vulnerable web application for training - Written by

    58over 2 years
  • Hackxor

    Realistic web application hacking game - Written by

  • SELinux Game

    Learn SELinux by doing. Solve Puzzles, show skillz - Written by

  • Portswigger Web Security Academy

    Free trainings and labs - Written by

Practices / AWS

  • FLAWS

    Amazon AWS CTF challenge - Written by

  • CloudGoat

    Rhino Security Labs' "Vulnerable by Design" AWS infrastructure setup tool - Written by

    3Kalmost 2 years

Practices / XSS

Practices / ModSecurity / OWASP ModSecurity Core Rule Set

Community

Miscellaneous

More related projects

Add a GitHub project

Missing a project or an awesome list? Paste its GitHub URL and we fetch it right away.