Global

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

sh 会先构建并嵌入前端，再使用 Go linker 去除调试信息，并将发布文件压缩为 zip。Release 模式默认生成 Linux amd64/arm64、macOS amd64/arm64 和 Windows amd64 的 zip 包：

Built by Sachin Sharma — Bug Hunting & GenAI Security Research.

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

This repository contains prompts adapted from a private hunting workflow. It does not contain the original helpers, browser fleet, proxy or email services, dashboard, proof-of-concept runtime, credentials, private operating rules, or reference corpus.

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.

The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.

Let's make it the biggest resource repository for our community.

SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.

XSStrike is a Cross Site Scripting detection suite equipped with four hand written parsers, an intelligent payload generator, a powerful fuzzing engine and an incredibly fast crawler.

Thanks to all contributors, you're awesome and wouldn't be possible without you! The goal is to build a categorized community-driven collection of very well-known resources.

Hacker101 is a free class for web security. Whether you're a programmer with an interest in bug bounties or a seasoned security professional, Hacker101 has something to teach you.

Your local copy of HackTricks will be available at after <5 minutes (it needs to build the book, be patient).

🛡️ Open-source and cloud-native Web Application Firewall (WAF)

Run as a Docker container from Docker Hub: docker pull hackllc/nikto:latest

More elaborate documentation that goes through many features with a lot of examples is available in the ffuf wiki at

Damn Vulnerable Web Application (DVWA) is a PHP/MariaDB web application that is damn vulnerable.

js is a template which aims to provide as much privacy and enhanced security as possible, and to reduce tracking and fingerprinting as much as possible - while minimizing any loss of functionality and breakage (but it will happen).

404StarLink - 推荐优质、有意义、有趣、坚持维护的安全开源项目

The Big List of Naughty Strings is a list of strings which have a high probability of causing issues when used as user-input data.

A list of resources for those interested in getting started in bug bounties

在 DSH 对话中生成交互式可视化｜Render model-generated interactive cards inside DSH conversations

Checklist of the most important security countermeasures when designing, testing, and releasing your API

Our detailed explanations should help the first type while we hope our checklist helps the second one create more secure systems. This is by no means a comprehensive guide, it just covers stuff based on the most common issues we have discovered in the past.

Gitbook

一款长亭自研的完善的安全评估工具，支持常见 web 安全问题扫描和自定义 poc | 使用之前务必先阅读文档

Helmet helps secure Node/Express apps. It sets HTTP response headers such as Content-Security-Policy and Strict-Transport-Security. It aims to be quick to integrate and be low maintenance afterward.