owasp

Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.

The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

A collection of hacking / penetration testing resources to make you better!

In-depth attack surface mapping and asset discovery

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.

A list of web application security

A curated list of resources for learning about application security

Next generation web scanner

AI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10/10 OWASP Agentic Top 10.

Kubernetes Goat is a "Vulnerable by Design" cluster environment to learn and practice Kubernetes security using an interactive hands-on playground 🚀

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management

Open-Source Unified Vulnerability Management, DevSecOps & ASPM

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

😎 🔗 Awesome list about all kinds of resources for learning Ethical Hacking and Penetration Testing.

bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS

OWASP CRS (Official Repository)

Awesome Node.js Security resources