Topics / #web-security

Web-security projects on GitHub

Learning resources and tools for securing web applications against attacks.

As of , the most-starred Web-security projects on GitHub are PayloadsAllTheThings (81.8K stars), SecLists (74.2K stars) and big-list-of-naughty-strings (47.7K stars). GitHub.Locker tracks 30 Web-security repositories with 584.4K stars combined. The fastest-growing on October 16 was PayloadsAllTheThings, with +27 stars in a day.

30Projects
584.4KStars in total
+174Stars in a day
Browse in the catalog →github.com/topics/web-security ↗

Hot right now

Most stars gained in a day · Oct 16

+27

PayloadsAllTheThings

swisskyrepo/PayloadsAllTheThings · ★ 81.8K

A massive curated collection of payloads, bypass techniques, and exploitation methodology for web application security testing, pentesting, and CTF challenges.

+18

SecLists

danielmiessler/SecLists · ★ 74.2K

SecLists is a huge collection of ready-made wordlists for security testing: usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells and more, all gathered in one repository.

+14

Claude-BugHunter

elementalsouls/Claude-BugHunter · ★ 5.1K

A drop-in skill bundle for the Claude Code skills system that turns Claude into a bug-hunting researcher or red-team operator: it ships 83 skills, 15 slash commands, and knowledge curated from 681 disclosed HackerOne reports across 24 vulnerability classes, plus enterprise identity and infrastructure attack matrices.

+12

SafeLine

chaitin/SafeLine · ★ 22.8K

SafeLine is a self-hosted web application firewall (WAF) and reverse proxy that protects your web apps from attacks and exploits by filtering and monitoring HTTP traffic.

The all-time top

30 projects · by stars

  1. #1 · swisskyrepo/PayloadsAllTheThings

    PayloadsAllTheThings

    A massive curated collection of payloads, bypass techniques, and exploitation methodology for web application security testing, pentesting, and CTF challenges.

    81.8K
  2. #2 · danielmiessler/SecLists

    SecLists

    SecLists is a huge collection of ready-made wordlists for security testing: usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells and more, all gathered in one repository.

    74.2K
  3. #3 · minimaxir/big-list-of-naughty-strings

    big-list-of-naughty-strings

    It is a curated collection of strings with a high probability of breaking software when used as user input, meant to help QA testing of input validation.

    47.7K
  1. 4

    CheatSheetSeries

    33.7KOWASP/CheatSheetSeries · JavaScript

    A collection of concise, high-value cheat sheets covering specific application security topics, maintained by OWASP.

  2. 5

    API-Security-Checklist

    23.3Kshieldfy/API-Security-Checklist

    A community checklist of the most important security countermeasures to apply when designing, testing, and releasing an API — a list of checkboxes you run through before shipping.

  3. 6

    SafeLine

    22.8Kchaitin/SafeLine · Go

    SafeLine is a self-hosted web application firewall (WAF) and reverse proxy that protects your web apps from attacks and exploits by filtering and monitoring HTTP traffic.

  4. 7

    Mobile-Security-Framework-MobSF

    22KMobSF/Mobile-Security-Framework-MobSF · JavaScript

    MobSF is an automated, all-in-one mobile security framework: it performs static and dynamic analysis, penetration testing, malware analysis and privacy analysis on Android, iOS and Windows Mobile apps.

  5. 8

    security-guide-for-developers

    21.1KFallibleInc/security-guide-for-developers

    This is a practical security guide for web developers that explains common security issues (authentication, encryption, sessions, attacks, etc.) and gives a checklist for building more secure systems.

  6. 9

    Micro8

    18KMicropoor/Micro8

    A free, open-source series of penetration-testing lessons written by veteran Chinese pentester Micropoor and published as a GitBook. It covers code audit, web, intranet and domain penetration, tunneling, and log-based tracing.

  7. 10

    Awesome-Hacking-Resources

    17.5Kvitalysim/Awesome-Hacking-Resources

    A curated collection of hacking, penetration testing and AI red-teaming resources — courses, YouTube channels, CTF platforms and guides, picked to make you better at offensive security.

  8. 11

    DOMPurify

    17.5Kcure53/DOMPurify · JavaScript

    DOMPurify is an XSS sanitizer for HTML, MathML and SVG: you feed it a string of dirty HTML and it returns clean HTML with everything dangerous stripped out, preventing XSS attacks.

  9. 12

    ffuf

    16.9Kffuf/ffuf · Go

    ffuf is a fast web fuzzer written in Go — a command-line tool that sends many crafted requests to a target to discover directories, virtual hosts, and fuzzable GET/POST parameters.

  10. 13

    XSStrike

    15.2Ks0md3v/XSStrike · Python

    XSStrike is a Cross Site Scripting (XSS) detection suite built around four hand-written parsers, an intelligent payload generator, a fuzzing engine, and a fast crawler. Instead of just firing generic payloads like most scanners, it analyzes the live response and crafts payloads guaranteed to work through context analysis.

  11. 14

    crowdsec

    15.2Kcrowdsecurity/crowdsec · Go

    CrowdSec is an open-source IDS/IPS and WAF that detects malicious behavior by analyzing logs and HTTP requests, blocks bad actors locally, and shares anonymized attack data with a crowdsourced network to build a real-time community blocklist.

  12. 15

    awesome-security

    15Ksbilly/awesome-security

    A curated, categorized collection of well-known security resources — software, libraries, documents, books and other cool stuff — maintained by the community in the spirit of awesome-php and awesome-python.

  13. 16

    hacker101

    14.6KHacker0x01/hacker101 · SCSS

    Hacker101 is a free online class for web and mobile security from HackerOne (the Hacker0x01 org), aimed at everyone from programmers curious about bug bounties to seasoned security professionals.

  14. 17

    juice-shop

    14.1Kjuice-shop/juice-shop · TypeScript

    OWASP Juice Shop is an intentionally insecure web application (a fake online juice store) built for security training, awareness demos, CTFs, and testing security tools.

  15. 18

    DVWA

    13.9Kdigininja/DVWA · PHP

    DVWA (Damn Vulnerable Web Application) is a PHP/MariaDB web app that is deliberately full of security bugs, built as a legal practice target for security pros, students, and developers to learn web application security.

  16. 19

    user.js

    12.9Karkenfox/user.js · JavaScript

    arkenfox user.js is a community-maintained Firefox configuration template that hardens privacy and security settings, aiming to reduce tracking and fingerprinting as much as possible while trying to keep the browser usable.

  17. 20

    hacktricks

    12.6KHackTricks-wiki/hacktricks · JavaScript

    A free, open wiki of hacking tricks and techniques — everything the author has learnt from CTFs, real-world apps and security research, organized into a browsable reference with 12.5k+ GitHub stars.

  18. 21

    Resources-for-Beginner-Bug-Bounty-Hunters

    12.3Knahamsec/Resources-for-Beginner-Bug-Bounty-Hunters

    A curated collection of resources for people getting started with web hacking and bug bounty hunting, including blog posts, talks, books, tools, labs and vulnerability-type guides.

  19. 22

    xray

    11.8Kchaitin/xray · Vue

    xray is a security assessment tool built by Chaitin for scanning common web vulnerabilities and running custom PoCs against targets.

  20. 23

    404StarLink

    11.4Kknownsec/404StarLink

    404StarLink is a curated list of security-focused open-source projects maintained by Knownsec 404 Lab, created to showcase, support, and track high-quality, actively-maintained security tools.

  21. 24

    bunkerweb

    11.1Kbunkerity/bunkerweb · Python

    BunkerWeb is an open-source, next-generation Web Application Firewall (WAF) built as a full-featured web server on top of NGINX. It protects your web applications and APIs 'secure by default' while integrating as a reverse proxy into your existing environment.

  22. 25

    nikto

    10.8Ksullo/nikto · Perl

    Nikto is an open-source web server scanner that checks servers for dangerous files, outdated software versions, and other common vulnerabilities.

  23. 26

    helmet

    10.7Khelmetjs/helmet · TypeScript

    Helmet is a middleware for Node/Express apps that sets a collection of HTTP response headers to help secure your app against common web vulnerabilities.

  24. 27

    Claude-BugHunter

    5.1Kelementalsouls/Claude-BugHunter · Python

    A drop-in skill bundle for the Claude Code skills system that turns Claude into a bug-hunting researcher or red-team operator: it ships 83 skills, 15 slash commands, and knowledge curated from 681 disclosed HackerOne reports across 24 vulnerability classes, plus enterprise identity and infrastructure attack matrices.

  25. 28

    bug-bounty-hunting-prompts

    612mdpsec/bug-bounty-hunting-prompts

    A pack of reusable prompt files for running a structured, evidence-first bug bounty hunting workflow with an LLM agent, covering recon through triage and escalation.

  26. 29

    CVE-2026-9830

    477opaxial/CVE-2026-9830 · Python

    A Python proof-of-concept that validates a reported unauthenticated REST API exposure in the BookingPress Pro WordPress plugin, which can leak booking and customer data.

  27. 30

    dsh-visualize

    309Nagi-ovo/dsh-visualize · TypeScript

    dsh-visualize is a plugin for DeepSeek Harness (DSH) that lets the model render interactive visual cards - simulators, charts, comparison panels, or UI mockups - right inside a chat conversation instead of just replying with text.

Often tagged together