The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.
-
Updated
Sep 24, 2021 - Python
#
owasp
Here are 449 public repositories matching this topic...
A collection of hacking / penetration testing resources to make you better!
exploit
reverse-engineering
malware
mitm
hacking
owasp
penetration-testing
ctf
privilege-escalation
buffer-overflow
windows-privilege-escalation
privilege-escalation-linux
-
Updated
Sep 29, 2021
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
python
rest
static-analysis
apk
owasp
dynamic-analysis
web-security
malware-analysis
mobsf
android-security
mobile-security
windows-mobile-security
ios-security
mobile-security-framework
api-testing
cwe
devsecops
runtime-security
mstg
masvs
-
Updated
Sep 27, 2021 - Python
snowbear
commented
Jun 11, 2021
⭐ Challenge idea
Description
Several users originally missing security question answers - most notably bjoern.k
In-depth Attack Surface Mapping and Asset Discovery
go
dns
osint
owasp
subdomain
enumeration
recon
maltego
network-security
information-gathering
osint-reconnaissance
attack-surfaces
-
Updated
Sep 28, 2021 - Go
A curated list of resources for learning about application security
-
Updated
Jul 30, 2021 - PHP
kingthorin
commented
Apr 2, 2020
Merge /Testing_for_Vertical_Bypassing_Authorization_Schema_WSTG-AUTHZ-00X.md into 4-Web_Application_Security_Testing/05-Authorization_Testing/03-Testing_for_Privilege_Escalation.md
Next generation web scanner
ruby
security
web
scanner
hacking
owasp
penetration-testing
application-security
pentesting
recon
pentest
kali-linux
appsec
network-security
web-hacking
security-tools
penetration-test
hacking-tools
pentesting-tools
penetration-testing-tools
-
Updated
Jun 30, 2021 - Ruby
bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS
go
html
sanitization
security
whitelist
risk
xss
data-uri
owasp
html-element
scenario
turns
nofollow
bluemonday
-
Updated
Sep 2, 2021 - Go
Automated Security Testing For REST API's
python
security
owasp
ci-cd
penetration-testing
postman-collection
sdlc
security-automation
penetration-testing-framework
restapiautomation
-
Updated
Aug 22, 2021 - Python
zakrush
commented
Jun 30, 2021
Slack us first!
Hello. I write about problem here:
https://owasp.slack.com/archives/C2P5BA8MN/p1624892081234100
Be informative
As additional into slack I find the same behaviour with Risk Accepted findings. Into Metrics I see 0 Risk Accepted findings, but I have 1 Risk Accepted finding
Bug description
No error. Metrics into product, or metrics dushboard has incorrect info
Awesome Node.js Security resources
-
Updated
Sep 12, 2021 - JavaScript
h3xstream
commented
Oct 5, 2020
Description
BeanUtils is a library that is doing automatic mapping to Java object.
It can cause arm when the attack controls part of the list of properties being sets. BeanUtils does not blacklist properties like class, classloader or other objects that are likely to load arbitrary classes and possibly run code.
Code
import org.apache.commons.beanutils.BeanUtils;
publicKubernetes Goat
docker
kubernetes
infrastructure
security
microservices
helm
container
hacking
owasp
cloud-native
pentesting
cloudsecurity
devsecops
cloud-security
container-security
vulnerable-app
kubernetes-security
kubernetes-goat
-
Updated
Aug 6, 2021 - HTML
Offensive Web Testing Framework (OWTF), is a framework which tries to unite great tools and make pen testing more efficient http://owtf.org https://twitter.com/owtfp
python
linux
security
nist
framework
passive
mozilla
traffic
owasp
pentest
impact
kali-linux
owtf
semi-passive
web-application-security
-
Updated
Sep 23, 2021 - JavaScript
Easy to use cryptographic framework for data protection: secure messaging with forward secrecy and secure data storage. Has unified APIs across 14 platforms.
javascript
ruby
python
java
swift
rust
golang
php
security
ios
cryptography
encryption
authentication
objective-c
owasp
cryptography-library
secure-messenger
asymmetric-cryptography
symmetric-cryptography
secure-storage
-
Updated
Sep 15, 2021 - C
Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management
python
security
automation
scanner
bruteforce
owasp
nmap
penetration-testing
pentesting
cve
network-analysis
vulnerability-management
vulnerability-scanners
information-gathering
portscanner
security-tools
vulnerability-scanner
penetration-testing-framework
hacking-tools
pentesting-tools
cves
-
Updated
Sep 28, 2021 - HTML
hackers
hacking
resources
owasp
penetration-testing
exploitation
youtube-channel
web-hacking
vulnerable-applications
learning-hacking
-
Updated
Oct 1, 2020
1
stevespringett
commented
Nov 18, 2020
The current swagger definition is autogenerated. The automatically generated definitions rely on reflection and annotations to create the documentation. The reflection capabilities are poor at best and lead to missing API parameters. Annotations can help in some cases, but the only fix for Swagger is to create individual POJOs for every possible request. This will lead to unnecessary large number
OWASP Joomla Vulnerability Scanner Project
-
Updated
Aug 9, 2021 - Raku
OWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security enthusiasts. Mutillidae can be installed on Linux and Windows using LAMP, WAMP, and XAMMP. It is pre-installed on SamuraiWTF and OWASP BWA. The existing version can be updated on these platforms. With dozens of vulnerabilities and hints to help the user; this is an easy-to-use web hacking environment designed for labs, security enthusiast, classrooms, CTF, and vulnerability assessment tool targets. Mutillidae has been used in graduate security courses, corporate web sec training courses, and as an "assess the assessor" target for vulnerability assessment software.
-
Updated
Sep 25, 2021 - PHP
OWASP Web Application Security Testing Checklist
-
Updated
Jul 11, 2019
OWASP WEB Directory Scanner
proxy
scanner
bruteforce
proxies
dirscanner
owasp
dir-scanner
dir-search
pentest
directories-scanner
blackarch
dirsearch
-
Updated
Feb 24, 2021 - Python
6
kingthorin
commented
Nov 9, 2020
I just finished dealing with auto-migrated issues for this article, it could definitely use some content updates:
https://github.com/OWASP/www-community/blob/master/pages/HttpOnly.md it still talks about old versions of IE and Opera.
This article includes an extensive table that needs re-working after the auto-migration as well (which I did not tackle).
Is Opera even relevant in 2020? Do
Open
sim swapping
3
OWASP ZAP Add-ons
-
Updated
Sep 28, 2021 - Java
Improve this page
Add a description, image, and links to the owasp topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the owasp topic, visit your repo's landing page and select "manage topics."
Hi,
I am getting some XSS Reflected and persistent alerts generated when a .xls or .pdf file contains unsantised XSS injection strings. I do not want to add an alert filter because it is an .asp page that generates these files and so there could be another XSS vulnerability on the page.
I was wondering if the XSS rule could check the Content-Type header and the file identifying line (first