Skip to content

🐶 A curated list of Web Security materials and resources.

Notifications You must be signed in to change notification settings

Ksoy/awesome-web-security

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

50 Commits
 
 
 
 
 
 

Repository files navigation

Awesome Web Security Awesome

🐶 Curated list of Web Security materials and resources.

Needless to say, most of websites on-line are suffered from various type of bugs, which might eventually lead to vulnerabilities. Why would this happen so often? Many factors can be involved, including misconfiguration, shortage of engineers' security skills, and etc. Therefore, here is the curated list of Web Security materials and resources for learning the cutting edge penetrating techniques.

Please read the contribution guidelines before contributing.


🌈 Want to strengthen your penetration skills?
I would recommend to play some awesome-ctfs.


Check out my repos 🐾 or say hi on my Twitter.

Contents

Forums

  • Drops (backup) - Drops was known as a famous knowledge base for hacking technology.
  • Paper from Seebug - Knowledge base for hacking technology built by Seebug.
  • Freebuf - Freebuf is the most popular forum in China for exchanging and sharing hacking technology.
  • 安全脉搏 - Blog for Security things.

Resources

Introductions

XSS

SQL Injection

XML

CSRF

Rails

AngularJS

SSL/TLS

Webmail

AWS

Books

Evasions

CSP

WAF

JSMVC

Authentication

Tricks

Remote Code Execution

XSS

SQL Injection

SSRF

Header Injection

URL

Others

Browser Exploitation

PoCs

JavaScript

Tools

Code Generating

Disassembler

Fuzzing

Penetrating

  • Burp Suite - Burp Suite is an integrated platform for performing security testing of web applications by portswigger.
  • mitmproxy - Interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers by @mitmproxy.

Leaking

Detecting

  • sqlchop - [DEPRECATED] Novel SQL injection detection engine built on top of SQL tokenizing and syntax analysis by chaitin.
  • retire.js - Scanner detecting the use of JavaScript libraries with known vulnerabilities by @RetireJS.
  • malware-jail - Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction by @HynekPetrak.

Preventing

  • js-xss - Sanitize untrusted HTML (to prevent XSS) with a configuration specified by a Whitelist by @leizongmin.

Webshell

Others

Blogs

Twitter Users

Practices

AWS

XSS

Community

Miscellaneous

License

CC0

To the extent possible under law, @qazbnm456 has waived all copyright and related or neighboring rights to this work.

About

🐶 A curated list of Web Security materials and resources.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published