Application Security Open Source Projects

The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.

A list of web application security

A curated list of resources for learning about application security

Next generation web scanner

Complete Practical Study Plan to become a successful cybersecurity engineer based on roles like Pentest, AppSec, Cloud Security, DevSecOps and so on...

Security automation content in SCAP, Bash, Ansible, and other formats

A curated list of awesome Android Reverse Engineering training, resources, and tools.

🎯 Command Injection Payload List

♾️ Collection and Roadmap for everyone who wants DevSecOps. Hope your DevOps are more safe 😎

Complete Solution for VAPT/AppSec and Pentesting Guide: Web | Mobile | API | Thick Client | Source Code Review | DevSecOps | Wireless | Network Pentesting | SAST | DAST etc...

Metlo is an open-source API security platform.

XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security.

This repository is about @harshbothra_'s 365 days of Learning Tweets & Mindmaps collection.

Curating the best DevSecOps resources and tooling.

一款社区驱动的免费、高性能、高扩展顶级Web应用和API安全防护产品-南墙

open-appsec is a machine learning security engine that preemptively and automatically prevents threats against Web Application & APIs. This repo include the main code and logic.

JANUSEC Application Gateway provides secure access, including reverse proxy, K8S Ingress Controller, Automatic ACME Certificate, WAF, 5-Second Shield, CC Defense, OAuth2 Authentication, Global Server Load Balance, and Cookie Compliance etc. JANUSEC应用网关，提供安全的接入，包括反向代理、K8S Ingress Controller、自动化ACME证书、WAF、5秒盾、CC防御、OAuth2身份认证、GSLB负载均衡与Cookie合规等。

Automatic authorization enforcement detection extension for burp suite written in Jython developed by Barak Tawily in order to ease application security people work and allow them perform an automatic authorization tests

A Virtual Machine For Assessing Android applications, Reverse Engineering and Malware Analysis

Awesome PHP Security Resources 🕶🐘🔐

secureCodeBox (SCB) - continuous secure delivery out of the box

Course content, lab setup instructions and documentation of our very popular Breaking and Pwning Apps and Servers on AWS and Azure hands on training!

Open-Source Security Architecture | 开源安全架构

🔥 A curated list of awesome links related to application security related to the environments with NGINX or Kubernetes Ingres Controller (based on NGINX)

Spoofy is a program that checks if a list of domains can be spoofed based on SPF and DMARC records.

Damn Vulnerable Bank is designed to be an intentionally vulnerable android application. This provides an interface to assess your android application security hacking skills.

Jackhammer - One Security vulnerability assessment/management tool to solve all the security team problems.

Some of the questions which i was asked when i was giving interviews for Application/Product Security roles. I am sure this is not an exhaustive list but i felt these questions were important to be asked and some were challenging to answer

Resources for Application Security including Web, API, Android, iOS and Thick Client

A curated list of awesome iOS application security resources.

This repository contains a curated list of resources I suggest on LinkedIn and Twitter.📝🌝

Pen Test Report Generation and Assessment Collaboration

A list of cheat sheets for application security

SDK providing threat detection & security monitoring for mobile devices. Works with Flutter, React Native, Android and iOS. Shield your app with free RASP. Detect reverse engineering, root (Magisk), jailbreak, Frida, emulators, bots, tampering and integrity issues, obfuscation, VPN usage, malware, and monitor device identification and fingerprint.

【iOS应用安全、安全攻防】hook及越狱的基本防护与检测(动态库注入检测、hook检测与防护、越狱检测、签名校验、汇编分析、IDA反编译分析加密协议Demo)；【数据传输安全】浅谈http、https与数据加密；代码加密&混淆；防抓包、http-dns解决方案，防止DNS劫持等

Tool to export Juice Shop challenges and hints in data format compatible with CTFd, RootTheBox or FBCTF

Security interview questions with possible explanation for roles in AppSec, Pentesting, Cloud Security, DevSecOps, Network Security and so on

Web application vulnerability scanner

Skills and career roadmap for various security roles like appsec, cloud security, devsecops, security engineer, security researchers, pentesting, api security, network security, mobile security and so on.with helpful resources, guidelines

Watchdog - A Comprehensive Security Scanning and a Vulnerability Management Tool.

Secure Content Management for the Modern Web - "The sky is only the beginning"

Grab’n Run, a simple and effective Java Library for Android projects to secure dynamic code loading.

A Burp Suite extension for identifying injection flaws (LFI, RCE, SQLi), authentication/authorization issues, and HTTP 403 access violations. It supports dynamic payload generation, including BCheck syntax, and can automatically generate Bambdas scripts. Additionally, it offers "Copy as JavaScript" to convert HTTP requests for enhanced XSS testing.

AndroGoat

Cross-site scripting labs for web application security enthusiasts

https://github.com/swisskyrepo/PayloadsAllTheThings

intentionally vuln web Application Security in django

A Continuous Threat Modeling methodology

Fast Advanced Spam Analysis Tool

A unified DevSecOps Framework that allows you to go from iterative, collaborative Threat Modeling to Application Security Test Orchestration

The Secure Coding Framework

Web Application Security Testing Tools

This repository is about @AnubhavSingh_'s 365 days of Learning Tweets collection.

Spring Security Architecture:: Topical guide to Spring Security, how the bits fit together and how they interact with Spring Boot

An open source Android application that is intentionally vulnerable so as to act as a learning platform for Android application security beginners.

🎯 RFI/LFI Payload List

Burp Extension for testing authorization issues. Automated request repeating and parameter value extraction on the fly.

Burp Suite extension to decrypt/encrypt any encrypted traffic (AES/RSA/Encodings and more) with custom code in any language