Top 122 owasp open source projects

Capture-the-Flag (CTF) environment setup tools for OWASP Juice Shop

✭ 238

javascript hacktoberfest hacking pentesting ctf owasp application-security

Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).

✭ 216

javascript go swift kotlin csharp android nodejs ios cli dotnet security-tools static-analysis maven security-scanner owasp security-automation android-security static-analyzer

Securecodingdojo

The Secure Coding Dojo is a platform for delivering secure coding training.

✭ 216

owasp

Wstg

The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.

✭ 3,873

shell Dockerfile security pentesting penetration-testing guide best-practices bugbounty owasp application-security hacktoberfest

Zap Hud

The OWASP ZAP Heads Up Display (HUD)

✭ 201

java hacktoberfest owasp appsec hud

Fdsploit

File Inclusion & Directory Traversal fuzzing, enumeration & exploitation tool.

✭ 199

python security hacking security-tools pentesting penetration-testing fuzzing exploitation enumeration owasp oscp web-security

Sbt Dependency Check

SBT Plugin for OWASP DependencyCheck. Monitor your dependencies and report if there are any publicly known vulnerabilities (e.g. CVEs). 🌈

✭ 187

scala security devops static-analysis infosec security-audit vulnerabilities vulnerability-scanners sbt owasp security-automation cve devsecops sbt-plugin appsec

Apicheck

The DevSecOps toolset for REST APIs

✭ 184

python security api devops rest-api hacking rest owasp devsecops

Securetea Project

The OWASP SecureTea Project provides a one-stop security solution for various devices (personal computers / servers / IoT devices)

✭ 181

javascript firewall owasp antivirus

Csrf Protector Php

CSRF Protector library: standalone library for CSRF mitigation

✭ 178

security owasp csrf

Zap Cli

A simple tool for interacting with OWASP ZAP from the commandline.

✭ 166

python security pentesting penetration-testing security-audit owasp

Python Honeypot

OWASP Honeypot, Automated Deception Framework.

✭ 160

python security infosec cybersecurity owasp honeypot

Bluemonday

bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS

✭ 2,135

go Makefile html security xss owasp whitelist sanitization

Phpvuln

Audit tool to find common vulnerabilities in PHP source code

✭ 146

python hacking penetration-testing vulnerability xss audit owasp sql-injection sqli

Owasp Cloud Security

OWASP Cloud Security - Enabling conversations through threat and control stories

✭ 148

cloud bdd owasp gherkin

Astra

Automated Security Testing For REST API's

✭ 1,898

python HTML CSS javascript Dockerfile security penetration-testing ci-cd owasp security-automation penetration-testing-framework postman-collection sdlc restapiautomation

Owaspheaders.core

A .NET Core middleware for injecting the Owasp recommended HTTP Headers for increased security

✭ 138

security middleware aspnetcore nuget owasp

Amass

In-depth Attack Surface Mapping and Asset Discovery

✭ 1,693

go lua dns recon enumeration owasp subdomain maltego

Go Agent

Sqreen's Application Security Management for the Go language

✭ 134

go golang security agent instrumentation owasp waf protection scans

Owasp Orizon

Owasp Orizon is a source code static analyzer tool designed to spot security issues in Java applications.

✭ 130

java static-code-analysis vulnerability-scanners owasp code-review

Django Defectdojo

DefectDojo is an open-source application vulnerability correlation and security orchestration tool.

✭ 1,926

python HTML javascript Smarty shell CSS hacktoberfest security kubernetes django automation analytics owasp security-automation devsecops vulnerability-management vulnerability-databases security-orchestration vulnerability-correlation

Find Sec Bugs

The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)

✭ 1,748

java kotlin HTML groovy CSS XSLT hacktoberfest security static-analysis security-audit owasp code-analysis findbugs taint-analysis cwe

Awesome Hacking Resources

A collection of hacking / penetration testing resources to make you better!

✭ 11,466

hacking reverse-engineering penetration-testing exploit malware ctf owasp mitm privilege-escalation buffer-overflow windows-privilege-escalation privilege-escalation-linux

Securityrat

OWASP SecurityRAT (version 1.x) - Tool for handling security requirements in development

✭ 115

javascript security automation owasp appsec application-security

Pwning Juice Shop

GitBook markdown content for the eBook "Pwning OWASP Juice Shop"

✭ 110

book ebook gitbook owasp kindle

Owtf

Offensive Web Testing Framework (OWTF), is a framework which tries to unite great tools and make pen testing more efficient http://owtf.org https://twitter.com/owtfp

✭ 1,516

python javascript shell Makefile SCSS Dockerfile security framework pentest kali-linux owasp owtf web-application-security

Cazador unr

Hacking tools

✭ 95

http automation hacking dns tcp bugbounty fuzzing xss poc owasp rce csrf sqli

Awesome Nodejs Security

Awesome Node.js Security resources

✭ 1,294

javascript nodejs security pentest infosec cybersecurity vulnerabilities owasp web-security

Asvs

A simple web app that helps developers understand the ASVS requirements.

✭ 80

html django owasp

Themis

Easy to use cryptographic framework for data protection: secure messaging with forward secrecy and secure data storage. Has unified APIs across 14 platforms.

✭ 1,232

javascript python java c ruby swift rust golang ios security authentication cryptography encryption owasp

Mobile Security Framework Mobsf

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

Hacker ezines

A collection of electronic hacker magazines carefully curated over the years from multiple sources

✭ 72

exploit vulnerability redteam vulnerabilities owasp exploits hacker information-security blueteam

Zaproxy

The OWASP ZAP core project

✭ 9,078

java HTML python kotlin javascript shell hacktoberfest security security-scanner owasp appsec zap owasp-zap dast zaproxy zap-development

Owasp Seraphimdroid

OWASP Seraphimdroid is an open source project with aim to create, as a community, an open platform for education and protection of Android users against privacy and security threats.

✭ 62

java machine-learning security privacy android-application owasp malware-research malware-detection

Owasp Workshop Android Pentest

Learning Penetration Testing of Android Applications

✭ 60

java android-application penetration-testing ctf workshop owasp challenge

Breachdetector

Detect root, emulation, debug mode and other security concerns in your Xamarin apps

✭ 57

security mobile xamarin detection debug emulation owasp root

Threat Dragon

An open source, online threat modelling tool from OWASP

✭ 57

javascript owasp

Threat Dragon Desktop

Desktop variant of OWASP Threat Dragon

✭ 53

css owasp

Express Security

nodejs + express security and performance boilerplate.

✭ 37

javascript nodejs redis boilerplate express babel socket-io http2 xss owasp gzip rate-limiting csp brotli csrf

Nettacker

Automated Penetration Testing Framework

✭ 982

python automation penetration-testing network-analysis vulnerability-scanners information-gathering bruteforce owasp penetration-testing-framework

Blackwidow

A Python based web application scanner to gather OSINT and fuzz for OWASP vulnerabilities on a target website.

✭ 887

python web spider scanner osint bugbounty application vulnerability xss owasp fuzzer rce scan csrf automated sqli

Awesome Ethical Hacking Resources

🔗 All the resources I could find for learning Ethical Hacking and Penetration Testing.

✭ 933

hacking penetration-testing resources exploitation owasp hackers

Owasp Zap Glue Ci Images

Ready to use images of Zap and Glue, especially for CI integration.

✭ 25

shell docker-image ci owasp security-testing

Threat Dragon Core

OWASP Threat Dragon core files

✭ 24

javascript owasp

Dependency Track

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

✭ 718

java security vulnerabilities owasp security-automation vulnerability-detection devsecops appsec

Joomscan

OWASP Joomla Vulnerability Scanner Project

✭ 640

scanner exploit vulnerability-scanners owasp joomla

Opendoor

OWASP WEB Directory Scanner

✭ 586

python scanner pentest bruteforce owasp proxies

Amass

In-depth Attack Surface Mapping and Asset Discovery

✭ 6,284

go lua dns osint recon enumeration owasp subdomain network-security maltego hacktoberfest information-gathering osint-reconnaissance hacktoberfest2021 attack-surfaces

Security Code Scan

Vulnerability Patterns Detector for C# and VB.NET

✭ 550

security dotnet static-analysis scanner analysis code static-code-analysis analyzer owasp static roslyn scan

Owasp Web Checklist

OWASP Web Application Security Testing Checklist

✭ 543

owasp

Zsc

OWASP ZSC - Shellcode/Obfuscate Code Generator

✭ 536

python assembly shellcode linux windows osx owasp obfuscator

Owasp Vwad

The OWASP Vulnerable Web Applications Directory project (VWAD) is a comprehensive and well maintained registry of all known vulnerable web applications currently available.

✭ 487

owasp appsec

Zap Extensions

OWASP ZAP Add-ons

✭ 486

java hacktoberfest security security-scanner owasp appsec

Awesome Appsec

A curated list of resources for learning about application security

✭ 4,761

PHP security owasp application-security reading-list curated security-experts

Juice Shop

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application