Appsec Open Source Projects

The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.

The ZAP by Checkmarx Core project

Web path scanner

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.

A list of web application security

Next generation web scanner

Open Source Vulnerability Management Platform

Golang Secure Coding Practices guide

Complete Practical Study Plan to become a successful cybersecurity engineer based on roles like Pentest, AppSec, Cloud Security, DevSecOps and so on...

w3af: web application attack and audit framework, the open source web vulnerability scanner.

Open-Source Unified Vulnerability Management, DevSecOps & ASPM

An OOB interaction gathering server and client library

The parent project for OpenZiti. Here you will find the executables for a fully zero-trust, programmable network @OpenZiti

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

Git All the Payloads! A collection of web attack payloads.

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.

A deliberately vulnerable CI/CD environment. Learn CI/CD security through multiple challenges.

Publications from Trail of Bits

A curated list of threat modeling resources (Books, courses - free and paid, videos, tools, tutorials and workshops to practice on ) for learning Threat modeling and initial phases of security review.

TCP/UDP Non-HTTP Proxy Extension (NoPE) for Burp Suite.

open-appsec is a machine learning security engine that preemptively and automatically prevents threats against Web Application & APIs. This repo include the main code and logic.

OWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security training. This is an easy-to-use web hacking environment designed for labs, security enthusiasts, classrooms, CTF, and vulnerability assessment tool targets.

OWASP Community Pages are a place where OWASP can accept community contributions for security-related content.

vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios through Exercises.

OWASP Top 10 for Large Language Model Apps (Part of the GenAI Security Project)

AppSec Ezine Public Repository.

A collection of special paths linked to common sensitive APIs, devops internals, frameworks conf, known misconfigurations, juicy APIs ..etc. It could be used as a part of web content discovery, to scan passively for high-quality endpoints and quick-wins.

ZAP Add-ons

An open source, git-ops, zero-trust secret encryption and decryption solution for Kubernetes applications

A vulnerable version of Rails that follows the OWASP Top 10

:warning: This repo is no longer in use. Please refer to https://github.com/OWASP/www-project-vulnerable-web-applications-directory

Scan is a free & Open Source DevSecOps tool for performing static analysis based security testing of your applications and its dependencies. CI and Git friendly.

Some of my security stuff and vulnerabilities. Nothing advanced. More to come.

Datadog Go Library including APM tracing, profiling, and security monitoring.

A library for detecting known secrets across many web frameworks

Spoofy is a program that checks if a list of domains can be spoofed based on SPF and DMARC records.

Oversecured Vulnerable Android App

Integrates Dependency-Check reports into SonarQube

Some of the questions which i was asked when i was giving interviews for Application/Product Security roles. I am sure this is not an exhaustive list but i felt these questions were important to be asked and some were challenging to answer

Resources for Application Security including Web, API, Android, iOS and Thick Client

Open Source Static Scanning tool to detect data flows in your code, find data security vulnerabilities & generate accurate Play Store Data Safety Report.

Tests for race conditions in web applications. Includes a RESTful API to integrate into a continuous integration pipeline.

Datadog PHP Clients

SDK providing threat detection & security monitoring for mobile devices. Works with Flutter, React Native, Android and iOS. Shield your app with free RASP. Detect reverse engineering, root (Magisk), jailbreak, Frida, emulators, bots, tampering and integrity issues, obfuscation, VPN usage, malware, and monitor device identification and fingerprint.

OWASP VulnerableApp Project: Break it. Scan it. Reproduce it. Benchmark against it. Improve it.

njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js applications.

This project is about creating and publishing threat model examples.

Version 0.2 - Exploit Time-based blind-SQL injection in HTTP-Headers (MySQL/MariaDB).

Research on GraphQL from an AppSec point of view.

Home of the developement for OWASP WTE - the Web Testing Environment, a collection of pre-packaged Linux AppSec tools, apps and documentation used to create pre-configured VMs or installed ala carte in the Linux of your choice..

A Burp Suite extension for identifying injection flaws (LFI, RCE, SQLi), authentication/authorization issues, and HTTP 403 access violations. It supports dynamic payload generation, including BCheck syntax, and can automatically generate Bambdas scripts. Additionally, it offers "Copy as JavaScript" to convert HTTP requests for enhanced XSS testing.

Security Champions Playbook v 2.1

This repo contains the code for my appsec challenges

Collect crash (or UndefinedBehaviorSanitizer error) reports, triage, and estimate severity.

SecHub provides a central API to test software with different security tools.

A source code static analysis platform for AppSec enthusiasts.

The ZAP Heads Up Display (HUD)