OWASP / CheatSheetSeries

Star

The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.

security code best-practices owasp application-security appsec cheatsheets

Updated Nov 25, 2020
Python

paragonie / awesome-appsec

Star

A curated list of resources for learning about application security

security curated owasp application-security security-experts reading-list

Updated Jun 17, 2020
PHP

bkimminich / juice-shop

Star

Open

[⭐] storage of entire credit card numbers

5

cnotin commented Oct 25, 2020

⭐ Challenge idea

Description

I notice that the Cards API returns the full credit card number, while the UI only shows the last digits

Underlying vulnerabilities

entire card storage -> PCI/DSS
returning more info than what's displayed

Expected difficulty

| ✔️ / ❌ | Difficulty |
|:------------------------

urbanadventurer / WhatWeb

Star

Next generation web scanner

Updated Nov 25, 2020
Ruby

OWASP / wstg

Star

Open

ATHN-02 Testing for Default Credentials

ThunderSon commented Sep 12, 2020

What's the issue?
Overwritten test scenario, can be summarized and link to payload lists from other repos

How do we solve it?
Chop down the content to the required and needed information, link to payload lists instead of enumerating all possible usernames and passwords, provide further guidance on how to test.

If no one is up to handle it, I can take care of it

ATHN-01 Can be removed and replaced by the Crypto Tests

Open

Status Tab in WSTG Checklist

1

Find more good first issues →

s4n7h0 / xvwa

Star

XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security.

mysql php knowledge vulnerability application-security xvwa learning-appsec

Updated Sep 12, 2020
PHP

ComplianceAsCode / content

Star

Security automation content in SCAP, OSCAL, Bash, Ansible, and other formats

Updated Nov 30, 2020
Python

sh4hin / Androl4b

Star

A Virtual Machine For Assessing Android applications, Reverse Engineering and Malware Analysis

android reverse-engineering penetration-testing application-security malware-analyzer mobile-security

Updated Jul 27, 2020

bloodzer0 / ossa

Star

Open-Source Security Architecture | 开源安全架构

security security-audit ids application-security security-vulnerability vulnerabilities ips vulnerability-scanners security-scanner security-tools code-audit business-security

Updated Nov 18, 2019

Janusec / janusec

Star

Janusec Application Gateway, Provides Fast and Secure Application Delivery. JANUSEC应用网关，提供快速、安全的应用交付。

go golang security gateway waf xss reverse-proxy sql-injection application-security web-application-firewall port-forwarding web-console web-application-security web-ssh application-gateway load-balance cc-attack-defense sensitive-data-leakage janusec-application-gateway janusec

Updated Nov 28, 2020
Go

appsecco / breaking-and-pwning-apps-and-servers-aws-azure-training

Star

Course content, lab setup instructions and documentation of our very popular Breaking and Pwning Apps and Servers on AWS and Azure hands on training!

opensource penetration-testing free application-security pentesting aws-security azure-security

Updated Jun 27, 2020
CSS

guardrailsio / awesome-php-security

Star

Awesome PHP Security Resources 🕶

🐘

🔐

php security awesome application-security awesome-list security-tools devsecops

Updated Oct 12, 2020

olacabs / jackhammer

Star

Jackhammer - One Security vulnerability assessment/management tool to solve all the security team problems.

security static-code-analysis penetration-testing dynamic-analysis application-security wordpress-security mobile-security vulnerability-management vulnerability-scanners security-scanner vulnerability-assessment network-security webappsec vulnerability-scanning source-code-analysis penetration-testing-framework security-vulnerability-assessment

Updated Jul 1, 2020
Java

payloadbox / command-injection-payload-list

Star

🎯 Command Injection Payload List

Updated Sep 3, 2020

paragonie / airship

Star

Secure Content Management for the Modern Web - "The sky is only the beginning"

php cms security postgresql free-software secure content-management libsodium cms-airship application-security secure-by-default

Updated Mar 22, 2019
PHP

lukeFalsina / Grab-n-Run

Star

Grab’n Run, a simple and effective Java Library for Android projects to secure dynamic code loading.

java dynamic android-development android-application application-security signature-verification

Updated May 24, 2016
Java

wallarm / awesome-nginx-security

Star

🔥 A curated list of awesome links related to application security related to the environments with NGINX or Kubernetes Ingres Controller (based on NGINX)

nginx kubernetes security webserver waf load-balancer apigateway application-security awesome-list naxsi modsecurity nginx-server nginx-configuration mod-security awesome-lists nginx-security api-security nginx-environment

Updated Sep 25, 2020

Quitten / Autorize

Star

Automatic authorization enforcement detection extension for burp suite written in Jython developed by Barak Tawily in order to ease application security people work and allow them perform an automatic authorization tests

authorization application-security jython burp-plugin burpsuite authorization-enforcement

Updated Oct 18, 2020
Python

enkomio / Taipan

Sponsor Star

Web application vulnerability scanner

security security-audit web hacking web-application application-security web-security hacking-tool security-scanner security-automation security-tools web-security-research web-sec-scanner security-testing taipan

Updated Jul 5, 2020

flipkart-incubator / watchdog

Star

Watchdog - A Comprehensive Security Scanning and a Vulnerability Management Tool.

security application-security security-vulnerability bugbounty vulnerability-management vulnerability-assessment network-security security-tools pentest-tool security-testing penetration-testing-framework cve-search cve-databases product-security

Updated Jul 18, 2018
Python

security-prince / Application-Security-Engineer-Interview-Questions

Star

Some of the questions which i was asked when i was giving interviews for Application/Product Security roles. I am sure this is not an exhaustive list but i felt these questions were important to be asked and some were challenging to answer