13.9K ·GitHub
What is this?
A curated list of web security materials and resources, organized by vulnerability class and attack type (XSS, SQL injection, CSRF, SSRF, XXE, deserialization, OAuth, JWT, and more), plus cheatsheets, tools, and write-ups for penetration testing.
A curated list of web security materials and resources, organized by vulnerability class and attack type (XSS, SQL injection, CSRF, SSRF, XXE, deserialization, OAuth, JWT, and more), plus cheatsheets, tools, and write-ups for penetration testing.Is this a tool I run, or just a reading list?It's a markdown index of links to external articles, cheatsheets and tools, not runnable code. It can also be queried live by AI agents through a bundled Claude Code Skill.
It's a markdown index of links to external articles, cheatsheets and tools, not runnable code. It can also be queried live by AI agents through a bundled Claude Code Skill.How is the list organized?Entries are grouped into major sections such as Digests, Forums, Introduction (one sub-section per vulnerability type: XSS, SQL injection, CSRF, SSRF, XXE, SAML, Upload, etc.), Tricks, Tools, Practices, and Miscellaneous, each with links and short descriptions.
Entries are grouped into major sections such as Digests, Forums, Introduction (one sub-section per vulnerability type: XSS, SQL injection, CSRF, SSRF, XXE, SAML, Upload, etc.), Tricks, Tools, Practices, and Miscellaneous, each with links and short descriptions.How do I use this with an AI coding agent?Install it as a Claude Code Skill with the one-line install command in the README, or add it through the Claude Code plugin marketplace; swap the '-a claude-code' flag for '-a codex' to use it with Codex instead.
Install it as a Claude Code Skill with the one-line install command in the README, or add it through the Claude Code plugin marketplace; swap the '-a claude-code' flag for '-a codex' to use it with Codex instead.Does the Claude Code Skill stay up to date automatically?Yes — it always reads data/index.json straight from the master branch when queried, rather than relying on a cached snapshot, so it should never be stale.
Yes — it always reads data/index.json straight from the master branch when queried, rather than relying on a cached snapshot, so it should never be stale.Who is this list for?Web security researchers, bug bounty hunters, and pentesters looking for topic-by-topic references, plus CTF players seeking write-ups and practice resources.
Web security researchers, bug bounty hunters, and pentesters looking for topic-by-topic references, plus CTF players seeking write-ups and practice resources.What kind of material is in the Tools/Tricks section?Beyond intro articles, it links to practical write-ups on remote code execution, header injection, SSRF/CSRF bypasses, browser exploitation, recon and sub-domain enumeration tools, fuzzers, scanners, web shells, and disassemblers/decompilers.
Beyond intro articles, it links to practical write-ups on remote code execution, header injection, SSRF/CSRF bypasses, browser exploitation, recon and sub-domain enumeration tools, fuzzers, scanners, web shells, and disassemblers/decompilers.Is there a file describing exactly how the Claude Code Skill behaves?Yes, the full trigger list and skill behaviour are documented in skills/awesome-web-security/SKILL.md in the repo.
Yes, the full trigger list and skill behaviour are documented in skills/awesome-web-security/SKILL.md in the repo.What should a beginner read first?The README recommends reading the article 'So you want to be a web security researcher?' before diving into the rest of the list.
The README recommends reading the article 'So you want to be a web security researcher?' before diving into the rest of the list.Is there a companion list for hands-on practice?The author points to the awesome-ctf list as a way to practice the techniques referenced throughout this list.
The author points to the awesome-ctf list as a way to practice the techniques referenced throughout this list.What are similar projects?awesome-reverse-engineering, PENTESTING-BIBLE, hacker-roadmap, Awesome-Hacking, Claude-Red, awesome-hacker-search-engines, Awesome-Hacking-Resources, exploitarium
awesome-reverse-engineering, PENTESTING-BIBLE, hacker-roadmap, Awesome-Hacking, Claude-Red, awesome-hacker-search-engines, Awesome-Hacking-Resources, exploitariumWhich topics is it in?waf, recon, appsec, information-gathering, disassembler, fuzzing, ctf, exploit, jwt, osint, cheatsheet, red-team
waf, recon, appsec, information-gathering, disassembler, fuzzing, ctf, exploit, jwt, osint, cheatsheet, red-team