OWASP / CheatSheetSeries

Star

The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.

security code best-practices owasp application-security appsec cheatsheets

Updated Nov 11, 2021
Python

juice-shop / juice-shop

Star

Open

[🐛] Hacking Instructor doesn't take into account a custom domain

2

eyalch commented Oct 23, 2021

🐛 Bug report

Description

Hacking Instructor doesn't take into account a custom domain.

Here's a part of my custom config:

application:
  domain: "example.com"

Take the "Login Jim" challenge instructor script. At the stage of inputting Jim's email, the instructor script expects "jim@juice-sh.op" and not "jim@example.com".

Looking at the source code, looks li

paragonie / awesome-appsec

Star

A curated list of resources for learning about application security

security curated owasp application-security security-experts reading-list

Updated Nov 1, 2021
PHP

OWASP / wstg

Star

Open

Common Platform Enumeration (CPE) naming schema on information gathering process

14

jespunya commented Mar 13, 2020

What would you like added?
Common Platform Enumeration (CPE) is a structured naming scheme for information technology systems, software, and packages. Based upon the generic syntax for Uniform Resource Identifiers (URI), CPE includes a formal name format, a method for checking names against a system, and a description format for binding text and tests to a name.

The usage of CPE naming is

Merge REST Assessment CS into WSTG

7

Open

Add OAuth Testing (OTG-AUTHN)

23

Find more good first issues

urbanadventurer / WhatWeb

Star

Next generation web scanner

Updated Oct 22, 2021
Ruby

s4n7h0 / xvwa

Star

XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security.

mysql php knowledge vulnerability application-security xvwa learning-appsec

Updated Sep 12, 2020
PHP

ComplianceAsCode / content

Star

Open

Bash and Ansible remediation of selinux_state are misaligned

1

ggbecker commented Aug 25, 2021

Description of problem:

The bash remediation of selinux_state runs:

fixfiles onboot
fixfiles -f relabel

whereas the Ansible remediation doe

`sshd_set_maxstartups` does not use the variable `var_sshd_set_maxstartups` in the OVAL check

2

Open

remediation for maxpoll not working on rhel 8 chrony.conf

1

Find more good first issues

sh4hin / Androl4b

Star

A Virtual Machine For Assessing Android applications, Reverse Engineering and Malware Analysis

android reverse-engineering penetration-testing application-security malware-analyzer mobile-security

Updated Jul 27, 2020

harsh-bothra / learn365

Star

This repository is about @harshbothra_'s 365 days of Learning Tweets & Mindmaps collection.

learning community infosec application-security pentesting vulnerabilities bugbounty pentesting-tools bugbountytips

Updated Nov 10, 2021

payloadbox / command-injection-payload-list

Star

🎯 Command Injection Payload List

Updated Apr 19, 2021

Janusec / janusec

Star

Janusec Application Gateway, Provides Fast and Secure Application Delivery (Authentication, WAF/CC, HTTPS and ACME automatic certificates). JANUSEC应用网关，提供快速、安全的应用交付（身份认证, WAF/CC, HTTPS以及ACME自动证书）。

go golang security acme gateway waf brotli sql-injection application-security web-application-firewall port-forwarding web-application-security web-ssh application-gateway load-balance janusec-application-gateway janusec

Updated Oct 9, 2021
Go

appsecco / breaking-and-pwning-apps-and-servers-aws-azure-training

Star

Course content, lab setup instructions and documentation of our very popular Breaking and Pwning Apps and Servers on AWS and Azure hands on training!

opensource penetration-testing free application-security pentesting aws-security azure-security

Updated Jun 9, 2021
CSS

bloodzer0 / ossa

Star

Open-Source Security Architecture | 开源安全架构

security security-audit ids application-security security-vulnerability vulnerabilities ips vulnerability-scanners security-scanner security-tools code-audit business-security

Updated May 10, 2021

guardrailsio / awesome-php-security

Star

Awesome PHP Security Resources 🕶

🐘

🔐

php security awesome application-security awesome-list security-tools devsecops

Updated Sep 22, 2021

olacabs / jackhammer

Star

Jackhammer - One Security vulnerability assessment/management tool to solve all the security team problems.

security static-code-analysis penetration-testing dynamic-analysis application-security wordpress-security mobile-security vulnerability-management vulnerability-scanners security-scanner vulnerability-assessment network-security webappsec vulnerability-scanning source-code-analysis penetration-testing-framework security-vulnerability-assessment

Updated Jul 1, 2020
Java

wallarm / awesome-nginx-security

Star

🔥 A curated list of awesome links related to application security related to the environments with NGINX or Kubernetes Ingres Controller (based on NGINX)

nginx kubernetes security webserver waf load-balancer apigateway application-security awesome-list naxsi modsecurity nginx-server nginx-configuration mod-security awesome-lists nginx-security api-security nginx-environment

Updated Sep 25, 2020

Quitten / Autorize

Star

Automatic authorization enforcement detection extension for burp suite written in Jython developed by Barak Tawily in order to ease application security people work and allow them perform an automatic authorization tests

authorization application-security jython burp-plugin burpsuite authorization-enforcement

Updated Sep 26, 2021
Python

paragonie / airship

Star

Secure Content Management for the Modern Web - "The sky is only the beginning"

php cms security postgresql free-software secure content-management libsodium cms-airship application-security secure-by-default

Updated Mar 22, 2019
PHP

lukeFalsina / Grab-n-Run

Star

Grab’n Run, a simple and effective Java Library for Android projects to secure dynamic code loading.

java dynamic android-development android-application application-security signature-verification

Updated May 24, 2016
Java

enkomio / Taipan

Sponsor Star

Web application vulnerability scanner

security security-audit web hacking web-application application-security web-security hacking-tool security-scanner security-automation security-tools web-security-research web-sec-scanner security-testing taipan

Updated May 7, 2021

security-prince / Application-Security-Engineer-Interview-Questions

Star

Some of the questions which i was asked when i was giving interviews for Application/Product Security roles. I am sure this is not an exhaustive list but i felt these questions were important to be asked and some were challenging to answer

xss vulnerability infosec application-security interview-questions appsec webappsec sdlc websecurity devsecops security-engineering websec websecurity-reference security-team security-engineer-interview

Updated Aug 7, 2020

TaptuIT / awesome-devsecops

Star

Curating the best DevSecOps resources and tooling.

devops awesome application-security awesome-list hacktoberfest devsecops secure-software-development

Updated Oct 19, 2021

flipkart-incubator / watchdog

Star

Watchdog - A Comprehensive Security Scanning and a Vulnerability Management Tool.

security application-security security-vulnerability bugbounty vulnerability-management vulnerability-assessment network-security security-tools pentest-tool security-testing penetration-testing-framework cve-search cve-databases product-security

Updated Jul 18, 2018
Python

rewanthtammana / Damn-Vulnerable-Bank

Star

Damn Vulnerable Bank is designed to be an intentionally vulnerable android application. This provides an interface to assess your android application security hacking skills.