awesome-web-hacking

Independent comparison of 129+ web application security tools across SAST, DAST, SCA, and more.

Application Security Wiki is an initiative to provide all Application security related resources to Security Researchers and developers at one place.

Open Web Application Security Project

Dr. Thorsten Schneider’s Binary Auditing

Penetration Testing Execution Standard

Extracts all saved passwords from Chrome, Firefox, and Edge to be saved onto secondary USB for further analysis.

Cyclops is a web browser with XSS detection feature

Web proxy

Crack Me Bank

Altoro Mutual

Firing Range is a test bed for automated web application security scanners.

Inj3ct0r is the ultimate database of exploits and vulnerabilities and a great resource for vulnerability researchers and security professionals.

Common Vulnerabilities and Exposures. The Standard for Information Security Vulnerability Names

Global Security Resource

CVE PoC Search provides CVE-to-GitHub proof-of-concept lookup to quickly pivot from a web vulnerability to public exploit code.

Vulnerability DB, Detailed information and remediation guidance for known vulnerabilities.

Database of hundreds of TLS cipher suites and their security status.

Free live fire Capture the Flag, blue team, red team Cyber Warfare Range for beginners through advanced users. Must use a cell phone to send a text message requesting access to the range.

Code Review Lab is a hands-on code review training platform.

WackoPicko is a vulnerable web application used to test web application vulnerability scanners.

SQLI labs to test error based, Blind boolean based, Time based.

A static analysis security vulnerability scanner for Ruby on Rails applications.

This page lists many query methods and options in ActiveRecord which do not sanitize raw SQL arguments and are not intended to be called with unsafe user input.

A ruby script that scans for vulnerable & exploitable 3rd-party web applications on a network

Hakiri Toolbelt is a command line interface for the Hakiri platform.

Patch-level verification for Bundler

A database of vulnerable Ruby Gems

SSL/TLS data provider service. Collect the data about digital certificates - issuers, organisation, whois, expiration dates, etc... Plus, has handy filters for convenience.

A checker (site and tool) for CVE-2014-0160 (Heartbleed).

Let’s Encrypt is a new Certificate Authority: It’s free, automated, and open.

Strong SSL Security on nginx

A command line tool which checks a website's TLS/SSL ciphers, protocols and cryptographic flaws.

Weak Diffie-Hellman and the Logjam Attack