OWASP Juice Shop: Probably the most modern and sophisticated insecure web application
A comprehensive guide for web application penetration testing and bug bounty hunting, covering methodologies, tools, and resources for identifying and exploiting vulnerabilities.
OWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security training. This is an easy-to-use web hacking environment designed for labs, security enthusiasts, classrooms, CTF, and vulnerability assessment tool targets.
vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios through Exercises.
A Huge Learning Resources with Labs For Offensive Security Players
A laboratory for learning secure web and mobile development in a practical manner.
Damn Vulnerable NodeJS Application
Roadmap for Web Application Penetration Testing | FREE Resources (Not Pirated)
OWASP iGoat (Swift) - A Damn Vulnerable Swift Application for iOS
Think of Local sheriff as a recon tool in your browser (WebExtension). While you normally browse the internet, Local Sheriff works in the background to empower you in identifying what data points (PII) are being shared / leaked to which all third-parties.
API Security Vulnerability Scanner designed to help you secure your APIs.
Enhance the security of your web applications effortlessly with AWS Firewall Factory. Safeguard your valuable assets through seamless WAF deployment, updates, and staging, all centrally managed with AWS Firewall Manager.
Bypass 4xx HTTP response status codes and more. The tool is based on Python Requests, PycURL, and HTTP Client.
IDOR Forge is an advanced and versatile tool designed to detect Insecure Direct Object Reference (IDOR) vulnerabilities in web applications.
🚀 Join us for 30days of daily API security tests. #30days30tests We've spent last 120days building amazing API security tests for the community. Next 30 days we will post test tutorials here.
Top 10 for Agentic AI (AI Agent Security) serves as the core for OWASP and CSA Red teaming work
OWASP ASST (Automated Software Security Toolkit) | A Novel Open Source Web Security Scanner.
Vulnerable code snippets with fixes for Web2, Web3, API, iOS, Android and Infrastructure-as-Code (IaC)
Burp Suite extension (BApp Store) that finds backup, old, temporary and unreferenced files leaking sensitive data on web servers. OWASP WSTG-CONF-04.
To associate your repository with the owasp-top-10 topic, visit your repo's landing page and select "manage topics."