OWASP

The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.

The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.

The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.

Official OWASP Top 10 Document Repository

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management

Golang Secure Coding Practices guide

Application Security Verification Standard

The OWASP MASVS (Mobile Application Security Verification Standard) is the industry standard for mobile app security.

OWASP API Security Project

The OWASP Developer Guide

The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.

An open source threat modeling tool from OWASP

completely ridiculous API (crAPI)

QRLJacking or Quick Response Code Login Jacking is a simple-but-nasty attack vector affecting all the applications that relays on “Login with QR code” feature as a secure way to login into accounts which aims for hijacking users session by attackers.

Vulnerable app with examples showing how to not use secrets

Web and mobile application security training platform

OWASP Foundation Web Respository

OWASP Community Pages are a place where OWASP can accept community contributions for security-related content.

OWASP Top 10 for Large Language Model Apps (Part of the GenAI Security Project)

OWASP Joomla Vulnerability Scanner Project https://www.secologist.com/

A Pythonic framework for threat modeling

The OWASP DevSecOps Guideline can help us to embedding security as a part of the development pipeline.

Takes third-party HTML and produces HTML that is safe to embed in your web application. Fast and easy to configure.

IoTGoat is a deliberately insecure firmware created to educate software developers and security professionals with testing commonly found vulnerabilities in IoT devices.

A vulnerable version of Rails that follows the OWASP Top 10

:warning: This repo is no longer in use. Please refer to https://github.com/OWASP/www-project-vulnerable-web-applications-directory

OWASP Foundation web repository

OWASP Autonomous Penetration Testing Standard

Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practical remediation guidance.

The OWASP OFFAT tool autonomously assesses your API for prevalent vulnerabilities, though full compatibility with OAS v3 is pending. The project remains a work in progress, continuously evolving towards completion.

OWASP Foundation main site repository

OWASP ZSC - Shellcode/Obfuscate Code Generator https://www.secologist.com/

OWASP Foundation Web Respository

The Web Security Testing Guide (WSTG) Project produces the premier cybersecurity testing resource for web application developers and security professionals.

The Secure Coding Dojo is a platform for delivering secure coding knowledge.

The OWASP Java Encoder is a Java 1.5+ simple-to-use drop-in high-performance encoder class with no dependencies and little baggage. This project will help Java web developers defend against Cross Site Scripting!