Highlighted
Open highlighted repo slot
Put your repository first
Promote a GitHub repo at the top of Awesome repository list views for 7 days.
Awesome List
Awesome Web Security
🐶 A curated list of Web Security materials and resources.
qazbnm456/awesome-web-security
#awesome
#awesome-list
#list
#penetration-testing
#security
#web
#websecurity
- List stars
- 13,913
- README repos
- 129
- Indexed repos
- 122
- List commits
- 584
- Forks
- 1,884
- Open issues
- 20
Tracked list growth
GitHub stars and default-branch commits for qazbnm456/awesome-web-security.
Latest scan 2026-10-18 10:50
Likes history
GitHub starsCommits history
Default branch commits
Latest repo push 2026-10-18
gchq/CyberChef
The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis
AI dev
Stack
GitHub topics
- Updated
- 2026-10-16
- Lists
- 4 list mentions
- First commit
- 2016-11-28
- License
- Apache-2.0
- Issues
- 600 open
36,148
stars
- Forks
- 4,177
- Commits
- 4,535 commits
- Star growth, last 7 days
- 0 0.0%
- Commit velocity, last 7 days
- 0 0.0%
cure53/DOMPurify
DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
Stack
GitHub topics
- Updated
- 2026-10-16
- Lists
- 3 list mentions
- First commit
- 2014-02-17
- License
- Apache-2.0
- Issues
- 12 open
17,470
stars
- Forks
- 871
- Commits
- 2,514 commits
- Star growth, last 7 days
- +2 0.0%
- Commit velocity, last 7 days
- 0 0.0%
beefproject/beef
The Browser Exploitation Framework Project
Stack
- Updated
- 2026-10-16
- Lists
- 2 list mentions
- First commit
- 2010-01-05
- License
- Unknown
- Issues
- 37 open
11,063
stars
- Forks
- 2,372
- Commits
- 5,334 commits
- Star growth, last 7 days
- 0 0.0%
- Commit velocity, last 7 days
- 0 0.0%
s0md3v/AwesomeXSS
Awesome XSS stuff
Stack
GitHub topics
- Updated
- 2024-10-30
- Lists
- 2 list mentions
- First commit
- 2018-03-11
- License
- MIT
- Issues
- 1 open
5,151
stars
- Forks
- 781
- Commits
- 73 commits
- Star growth, last 7 days
- 0 0.0%
- Commit velocity, last 7 days
- 0 0.0%
RetireJS/retire.js
scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.
AI dev
Stack
- Updated
- 2026-10-18
- Lists
- 1 list mention
- First commit
- 2013-08-30
- License
- Apache-2.0
- Issues
- 4 open
4,185
stars
- Forks
- 444
- Commits
- 1,218 commits
- Star growth, last 7 days
- 0 0.0%
- Commit velocity, last 7 days
- 0 0.0%
cure53/H5SC
HTML5 Security Cheatsheet - A collection of HTML5 related XSS attack vectors
Stack
- Updated
- 2026-09-09
- Lists
- 1 list mention
- First commit
- 2014-03-28
- License
- MPL-2.0
- Issues
- 0 open
2,938
stars
- Forks
- 415
- Commits
- 91 commits
- Star growth, last 7 days
- 0 0.0%
- Commit velocity, last 7 days
- 0 0.0%
evilcos/xssor2
XSS'OR - Hack with JavaScript.
Stack
GitHub topics
- Updated
- 2021-12-12
- Lists
- 1 list mention
- First commit
- 2017-06-25
- License
- BSD-2-Clause
- Issues
- 4 open
2,217
stars
- Forks
- 380
- Commits
- 40 commits
- Star growth, last 7 days
- 0 0.0%
- Commit velocity, last 7 days
- 0 0.0%
nccgroup/singularity
A DNS rebinding attack framework.
Stack
GitHub topics
- Updated
- 2026-07-21
- Lists
- 1 list mention
- First commit
- 2018-08-07
- License
- MIT
- Issues
- 17 open
1,322
stars
- Forks
- 159
- Commits
- 246 commits
- Star growth, last 7 days
- 0 0.0%
- Commit velocity, last 7 days
- 0 0.0%
momenbasel/keyFinder
Passive API key and secret discovery browser extension for Chrome and Firefox. 80+ detection patterns, zero config.
Stack
GitHub topics
- Updated
- 2026-07-19
- Lists
- 2 list mentions
- First commit
- 2019-08-07
- License
- MIT
- Issues
- 5 open
725
stars
- Forks
- 128
- Commits
- 28 commits
- Star growth, last 7 days
- 0 0.0%
- Commit velocity, last 7 days
- 0 0.0%
pompelmi/pompelmi
ClamAV antivirus scanning for Node.js — scan file uploads with a single function call. Zero dependencies. Typed Symbol verdicts. Local or Docker/clamd.
Stack
GitHub topics
- Updated
- 2026-05-23
- Lists
- 4 list mentions
- First commit
- 2026-04-11
- License
- ISC
- Issues
- 6 open
680
stars
- Forks
- 32
- Commits
- 91 commits
- Star growth, last 7 days
- 0 0.0%
- Commit velocity, last 7 days
- 0 0.0%
brannondorsey/whonow
A "malicious" DNS server for executing DNS Rebinding attacks on the fly (public instance running on rebind.network:53)
Stack
GitHub topics
- Updated
- 2021-12-17
- Lists
- 1 list mention
- First commit
- 2018-03-31
- License
- MIT
- Issues
- 9 open
658
stars
- Forks
- 90
- Commits
- 23 commits
- Star growth, last 7 days
- 0 0.0%
- Commit velocity, last 7 days
- 0 0.0%
LewisArdern/bXSS
bXSS is a utility which can be used by bug hunters and organizations to identify Blind Cross-Site Scripting.
Stack
GitHub topics
- Updated
- 2023-03-04
- Lists
- 1 list mention
- First commit
- 2017-12-13
- License
- MIT
- Issues
- 20 open
580
stars
- Forks
- 63
- Commits
- 147 commits
- Star growth, last 7 days
- 0 0.0%
- Commit velocity, last 7 days
- 0 0.0%
HoLyVieR/prototype-pollution-nsec18
Content released at NorthSec 2018 for my talk on prototype pollution
Stack
- Updated
- 2024-05-25
- Lists
- 1 list mention
- First commit
- 2018-05-16
- License
- Unknown
- Issues
- 1 open
- Forks
- 88
- Commits
- 5 commits
- Star growth, last 7 days
- 0 0.0%
- Commit velocity, last 7 days
- 0 0.0%
brannondorsey/dns-rebind-toolkit
A front-end JavaScript toolkit for creating DNS rebinding attacks.
Stack
GitHub topics
- Updated
- 2021-10-02
- Lists
- 1 list mention
- First commit
- 2018-05-19
- License
- MIT
- Issues
- 3 open
- Forks
- 84
- Commits
- 18 commits
- Star growth, last 7 days
- 0 0.0%
- Commit velocity, last 7 days
- 0 0.0%
ReversecLabs/dref
DNS Rebinding Exploitation Framework
Stack
GitHub topics
- Updated
- 2021-04-27
- Lists
- 1 list mention
- First commit
- 2018-06-23
- License
- Unknown
- Issues
- 2 open
494
stars
- Forks
- 70
- Commits
- 108 commits
- Star growth, last 7 days
- 0 0.0%
- Commit velocity, last 7 days
- 0 0.0%
HynekPetrak/malware-jail
Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js
Stack
GitHub topics
- Updated
- 2023-06-16
- Lists
- 1 list mention
- First commit
- 2016-01-10
- License
- MIT
- Issues
- 5 open
480
stars
- Forks
- 97
- Commits
- 226 commits
- Star growth, last 7 days
- 0 0.0%
- Commit velocity, last 7 days
- 0 0.0%
WebDecoy/FCaptcha
Self-hosted, invisible CAPTCHA that detects AI agents driving real browsers. GDPR, WCAG 2.2 AA, and EAA: no cookies, no third-party data sharing, and no visual or audio puzzle. With a false-positive budget enforced in CI. Proof of work, drop-in for Turnstile and reCAPTCHA.
- Updated
- 2026-10-16
- Lists
- 3 list mentions
- First commit
- 2025-12-29
- License
- MIT
- Issues
- 10 open
221
stars
- Forks
- 24
- Commits
- 207 commits
- Star growth, last 7 days
- 0 0.0%
- Commit velocity, last 7 days
- 0 0.0%
SecureSkyTechnology/BadLibrary
vulnerable web application for training
Archived
Stack
- Updated
- 2024-01-14
- Lists
- 1 list mention
- First commit
- 2017-12-13
- License
- MIT
- Issues
- 1 open
- Forks
- 7
- Commits
- 11 commits
- Star growth, last 7 days
- 0 0.0%
- Commit velocity, last 7 days
- 0 0.0%
bad-antics/marshall-extensions
🔌 OSINT & Security Extensions for Marshall Browser - Installable plugins for enhanced reconnaissance and security testing
Stack
GitHub topics
- Updated
- 2026-02-27
- Lists
- 1 list mention
- First commit
- 2026-01-25
- License
- Unknown
- Issues
- 0 open
- Forks
- 0
- Commits
- 12 commits
- Star growth, last 7 days
- 0 0.0%
- Commit velocity, last 7 days
- 0 0.0%