awesome-web-hacking

Independent comparison of 129+ web application security tools across SAST, DAST, SCA, and more.

Application Security Wiki is an initiative to provide all Application security related resources to Security Researchers and developers at one place.

Open Web Application Security Project

Dr. Thorsten Schneider’s Binary Auditing

Offline-first, searchable arsenal: ~1500 payloads, command generator, GTFOBins, wordlists, embedded CyberChef, reverse shells and 70 checklists.

Extracts all saved passwords from Chrome, Firefox, and Edge to be saved onto secondary USB for further analysis.

Cyclops is a web browser with XSS detection feature

open-source, local-first HTTP attack detector: Rust CLI with 76 detections across 62 behavior families (injection, traversal, request smuggling, SSRF, XXE, deserialization, and more), plus a local MCP server for agent-driven triage

Web proxy

Crack Me Bank

Altoro Mutual

Firing Range is a test bed for automated web application security scanners.

Inj3ct0r is the ultimate database of exploits and vulnerabilities and a great resource for vulnerability researchers and security professionals.

Common Vulnerabilities and Exposures. The Standard for Information Security Vulnerability Names

Global Security Resource

CVE PoC Search provides CVE-to-GitHub proof-of-concept lookup to quickly pivot from a web vulnerability to public exploit code.

Vulnerability DB, Detailed information and remediation guidance for known vulnerabilities.

Database of hundreds of TLS cipher suites and their security status.

Free live fire Capture the Flag, blue team, red team Cyber Warfare Range for beginners through advanced users. Must use a cell phone to send a text message requesting access to the range.

Code Review Lab is a hands-on code review training platform.

WackoPicko is a vulnerable web application used to test web application vulnerability scanners.

SQLI labs to test error based, Blind boolean based, Time based.

A static analysis security vulnerability scanner for Ruby on Rails applications.

This page lists many query methods and options in ActiveRecord which do not sanitize raw SQL arguments and are not intended to be called with unsafe user input.

A ruby script that scans for vulnerable & exploitable 3rd-party web applications on a network

Hakiri Toolbelt is a command line interface for the Hakiri platform.

Patch-level verification for Bundler

A database of vulnerable Ruby Gems

XSS cheatsheet

LFI Cheat Sheet

Reverse Shell Cheat Sheet

Path Traversal Cheat Sheet: Windows

SQL Injection Cheat Sheet