OWASP

The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.

The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the...

The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.

Official OWASP Top 10 Document Repository

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management

Golang Secure Coding Practices guide

Application Security Verification Standard

The OWASP MASVS (Mobile Application Security Verification Standard) is the industry standard for mobile app security.

OWASP API Security Project

The OWASP Developer Guide

The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.

An open source threat modeling tool from OWASP

completely ridiculous API (crAPI)

QRLJacking or Quick Response Code Login Jacking is a simple-but-nasty attack vector affecting all the applications that relays on “Login with QR code” feature as a secure way to login into...

OWASP Top 10 for Large Language Model Apps (Part of the GenAI Security Project)

Vulnerable app with examples showing how to not use secrets

Web and mobile application security training platform

OWASP Foundation Web Respository

OWASP Community Pages are a place where OWASP can accept community contributions for security-related content.

OWASP Joomla Vulnerability Scanner Project https://www.secologist.com/

A Pythonic framework for threat modeling

The OWASP DevSecOps Guideline can help us to embedding security as a part of the development pipeline.

IoTGoat is a deliberately insecure firmware created to educate software developers and security professionals with testing commonly found vulnerabilities in IoT devices.

Takes third-party HTML and produces HTML that is safe to embed in your web application. Fast and easy to configure.

A vulnerable version of Rails that follows the OWASP Top 10

This repo is no longer in use. Please refer to https://vwad.owasp.org

OWASP Foundation web repository

Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practical remediation guidance.

OWASP Autonomous Penetration Testing Standard

Getting a handle on container security

The OWASP OFFAT tool autonomously assesses your API for prevalent vulnerabilities, though full compatibility with OAS v3 is pending. The project remains a work in progress, continuously evolving...

OWASP Foundation main site repository

OWASP ZSC - Shellcode/Obfuscate Code Generator https://www.secologist.com/

The Web Security Testing Guide (WSTG) Project produces the premier cybersecurity testing resource for web application developers and security professionals.

OWASP Foundation Web Respository

The Secure Coding Dojo is a platform for delivering secure coding knowledge.

OWASP WebScarab

The AI Security Verification Standard (AISVS) focuses on providing developers, architects, and security professionals with a structured checklist to verify the security of AI-driven applications.

Contextual output encoding for Java 8+: HTML, JavaScript, CSS, XML and URI components. Zero-dependency core with optional JSP and Jakarta adapters.

a Damn Vulnerable Serverless Application

Application Security Automation

AI-powered Docker security scanner that explains vulnerabilities in plain English. An OWASP Lab Project.

OWASP Honeypot, Automated Deception Framework.

Your gateway to OWASP. Discover, engage, and help shape the future!

OWASP iGoat (Swift) - A Damn Vulnerable Swift Application for iOS

OWASP iGoat - A Learning Tool for iOS App Pentesting and Security by Swaroop Yermalkar

OWASP Foundation Web Respository

PHP-RBAC is an authorization library for PHP. It provides developers with NIST Level 2 Standard Role Based Access Control and more, in the fastest implementation yet.

This project is about creating and publishing threat model examples.

OWASP Vulnerable Web Application Project https://github.com/hummingbirdscyber

OWASP Foundation web repository

SAMM stands for Software Assurance Maturity Model.

O-Saft - OWASP SSL advanced forensic tool

OWASP ServerlessGoat: a serverless application demonstrating common serverless security flaws

OWASP VBScan is a Black Box vBulletin Vulnerability Scanner

The OWASP SecureTea Project provides a one-stop security solution for various devices (personal computers / servers / IoT devices)

The Secure Coding Framework

OWASP D4N155 - Intelligent and dynamic wordlist using OSINT

pysap is an open source Python library that provides modules for crafting and sending packets using SAP's NI, Diag, Enqueue, Router, MS, SNC, IGS, RFC and HDB protocols.

OWASP Foundation Web Respository

The OWASP Secure Headers Project

Given JSON-like content, The JSON Sanitizer converts it to valid JSON.

OWASP Serverless Top 10

OWASP Secure Agent Playbook Project

Runtime defense against memory poisoning in AI agents (OWASP ASI06). Drop-in for LangChain, OpenAI Agents, AutoGen, CrewAI and mem0.

OWASP PHP Security Project - THIS PROJECT IS INACTIVE AND MAY CONTAIN SECURITY FLAWS

Node application to help managing Maturity Models like the ones created by BSIMM and OpenSAMM

OWASP ASST (Automated Software Security Toolkit) | A Novel Open Source Web Security Scanner.

OWASP Foundation Web Respository

OWASP Passfault evaluates passwords and enforces password policy in a completely different way.

Software Component Verification Standard (SCVS)

A deliberately vulnerable web application for learning web application security.

OWASP IoT Security Verification Standard (ISVS)

The source files and tools needed to build the OWASP Cornucopia decks in various languages

OWASP Foundation web repository

OWASP Code Review Guide Web Repository

The IoT Security Testing Guide (ISTG) provides a comprehensive methodology for penetration tests in the IoT field, offering flexibility to adapt innovations, and developments in the IoT market...

Content for OWASP Summit 2017 site

OWASP MCP Taxonomy

OWASP MCP Top10

OWASP ThreatAtlas is a collaborative platform for community-driven threat modeling.

Repo to hold mapping of user-security-stories

OWASP Zed Attack Proxy project landing page.

OWASP Project Developer Guide - Document and Project Web pages

OWASP Testing Guide

OWASP Foundation Web Respository

OWASP Foundation Web Respository

OWASP SonarQube Project

OWASP Machine Learning Security Top 10 Project

SEDATED® Project (Sensitive Enterprise Data Analyzer To Eliminate Disclosure)

OWASP Kubernetes security and compliance tool [WIP]

OWASP Foundation Web Respository

OWASP Raider: a novel framework for manipulating the HTTP processes of persistent sessions

The OWASP Vulnerable Web Applications Directory Project (VWAD) is a comprehensive and well maintained registry of all known vulnerable web applications currently available.

OWASP Foundation Web Respository