Awesome Web Security

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

Find secrets with Gitleaks 🔑

UNIX-like reverse engineering framework and command-line toolset

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

WPScan WordPress security scanner. Written for security professionals and blog maintainers to test the security of their WordPress websites. Contact us via contact@wpscan.com

Reconnaissance tool for GitHub organizations

A Tool for Domain Flyovers

scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.

🔥Open source RASP solution

Automated Security Testing For REST API's

XRay is a tool for recon, mapping and OSINT gathering from public networks.

Tool to scan for secret files on HTTP servers

Reverse Shell as a Service

Find web directories without bruteforce

Checklist of security precautions for Ruby on Rails applications.

DOM fuzzer

Industry-leading free, high-performance, AI and semantic technology Web Application Firewall and API Security Gateway (WAAP) - UUSEC WAF.

Interactive CTF Exploration Tool

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.

Some public notes

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision

Passive API key and secret discovery browser extension for Chrome and Firefox. 80+ detection patterns, zero config.

🔪Browser logic vulnerabilities :skull_and_crossbones:

ClamAV antivirus scanning for Node.js — scan file uploads with a single function call. Zero dependencies. Typed Symbol verdicts. Local or Docker/clamd.

List DTDs and generate XXE payloads using those local DTDs.

🔐 Tutorial of setting up Security for your API with one way authentication with TLS/SSL and mutual authentication for a java based web server and a client with both Spring Boot. Different clients are provided such as Apache HttpClient, OkHttp, Spring RestTemplate, Spring WebFlux WebClient Jetty and Netty, the old and the new JDK HttpClient, the old and the new Jersey Client, Google HttpClient, Unirest, Retrofit, Feign, Methanol, vertx, Scala client Finagle, Featherbed, Dispatch Reboot, AsyncHttpClient, Sttp, Akka, Requests Scala, Http4s Blaze, Kotlin client Fuel, http4k, Kohttp and ktor. Also other server examples are available such as jersey with grizzly. Also gRPC, WebSocket and ElasticSearch examples are included

Auto Scanning to SSL Vulnerability

bXSS is a utility which can be used by bug hunters and organizations to identify Blind Cross-Site Scripting.

The most comprehensive Hack The Box writeup collection - 500+ machines, 400+ challenges, interactive knowledge graph, skill trees, attack path diagrams, ProLabs, Sherlocks, OSCP/CPTS/CRTO prep. Browse: momenbasel.github.io/htb-writeups

Redefining vulnerability disclosure in the AI era. We mass-produce exploitable 0days and disclose them directly, using event-driven pressure to elevate vendor security standards and advance the field.

Self-hosted, invisible CAPTCHA that detects AI agents driving real browsers. GDPR, WCAG 2.2 AA, and EAA: no cookies, no third-party data sharing, and no visual or audio puzzle. With a false-positive budget enforced in CI. Proof of work, drop-in for Turnstile and reCAPTCHA.

Minimal code to connect to a CEF debugger.

Your users download a 4GB AI model, the connection drops at 3.8GB, verifyfetch resumes from 3.8GB and verifies every byte. Drop-in integrity verification for Transformers.js, WebLLM, and any large file in the browser.

Fetch and normalize parameterized URLs from the Wayback CDX API (OSINT, inspired by ParamSpider).

🔌 OSINT & Security Extensions for Marshall Browser - Installable plugins for enhanced reconnaissance and security testing

Privacy-first Chrome extension for real-time website security analysis using on-device AI. Trust scores (0-100), phishing detection, SSL verification, cookie compliance & AI chatbot powered by WebLLM with zero external data transmission.

Is this app legit? Check before you connect. Free URL security scanner for indie developers and AI builders. Live at trustscanpro.com

WebDecoy Bot Detection — zero-config WordPress plugin for bot protection, spam prevention, and WooCommerce carding defense