Explore @OWASP Open Source projects

The Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes the technical processes for verifying the controls listed in the OWASP Mobile Application Security Verification Standard (MASVS).

26,254

owasp-mastg

In-depth Attack Surface Mapping and Asset Discovery

11,279

Amass

7,941

wstg

The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.

Dockerfile

6,561

Go-SCP

Golang Secure Coding Practices guide

4,708

Top10

Official OWASP Top 10 Document Repository

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management

4,026

Nettacker

Application Security Verification Standard

2,924

ASVS

DevGuide

API-Security

OWASP API Security Project

Dockerfile

1,933

owasp-masvs

The OWASP MASVS (Mobile Application Security Verification Standard) is the industry standard for mobile app security.

The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.

1,930

NodeGoat

QRLJacking or Quick Response Code Login Jacking is a simple-but-nasty attack vector affecting all the applications that relays on “Login with QR code” feature as a secure way to login into accounts which aims for hijacking users session by attackers.

1,809

QRLJacking

Web and mobile application security training platform

1,308

SecurityShepherd

Vulnerable app with examples showing how to not use secrets

1,272

wrongsecrets

1,071

www-project-top-ten

OWASP Joomla Vulnerability Scanner Project https://www.secologist.com/

1,022

joomscan

Raku

1,009

crAPI

completely ridiculous API (crAPI)

OWASP Community Pages are a place where OWASP can accept community contributions for security-related content.

955

www-community

A vulnerable version of Rails that follows the OWASP Top 10

888

railsgoat

An open source threat modeling tool from OWASP

852

threat-dragon

Takes third-party HTML and produces HTML that is safe to embed in your web application. Fast and easy to configure.

810

java-html-sanitizer

The OWASP Vulnerable Web Applications Directory project (VWAD) is a comprehensive and well maintained registry of all known vulnerable web applications currently available.

788

OWASP-VWAD

749

DevSecOpsGuideline

The OWASP DevSecOps Guideline can help us to embedding security as a part of the development pipeline.

OWASP ZSC - Shellcode/Obfuscate Code Generator https://www.secologist.com/

705

ZSC

IoTGoat is a deliberately insecure firmware created to educate software developers and security professionals with testing commonly found vulnerabilities in IoT devices.

635

IoTGoat

622

Docker-Security

Getting a handle on container security

OWASP-WebScarab

MASTG-Hacking-Playground

549

www-project-kubernetes-top-ten

a Damn Vulnerable Serverless Application

549

DVSA

Application Security Automation

515

glue

Ruby

513

owasp-java-encoder

The OWASP Java Encoder is a Java 1.5+ simple-to-use drop-in high-performance encoder class with no dependencies and little baggage. This project will help Java web developers defend against Cross Site Scripting!

The Secure Coding Dojo is a platform for delivering secure coding knowledge.

473

SecureCodingDojo

PHP-RBAC is an authorization library for PHP. It provides developers with NIST Level 2 Standard Role Based Access Control and more, in the fastest implementation yet.

441

rbac

OWASP Foundation main site repository

423

owasp.github.io

OWASP Honeypot, Automated Deception Framework.

423

Python-Honeypot

SAMM stands for Software Assurance Maturity Model.

404

samm

OWASP iGoat (Swift) - A Damn Vulnerable Swift Application for iOS

395

iGoat-Swift

391

www-project-web-security-testing-guide

The Web Security Testing Guide (WSTG) Project produces the premier cybersecurity testing resource for web application developers and security professionals.

376

www-project-top-10-for-large-language-model-applications

This project is about creating and publishing threat model examples.

TeX

374

threat-model-cookbook

OWASP iGoat - A Learning Tool for iOS App Pentesting and Security by Swaroop Yermalkar

373

igoat

368

O-Saft

O-Saft - OWASP SSL advanced forensic tool

Perl

344

Vulnerable-Web-Application

OWASP Vulnerable Web Application Project https://github.com/hummingbirdscyber

OWASP VBScan is a Black Box vBulletin Vulnerability Scanner

324

vbscan

Perl

322

Serverless-Goat

OWASP ServerlessGoat: a serverless application demonstrating common serverless security flaws

The OWASP SecureTea Project provides a one-stop security solution for various devices (personal computers / servers / IoT devices)

302

SecureTea-Project

The Secure Coding Framework

271

RiskAssessmentFramework

TypeScript

245

pysap

pysap is an open source Python library that provides modules for crafting and sending packets using SAP's NI, Diag, Enqueue, Router, MS, SNC, IGS, RFC and HDB protocols.

OWASP PHP Security Project - THIS PROJECT IS INACTIVE AND MAY CONTAIN SECURITY FLAWS

205

Serverless-Top-10-Project

OWASP Serverless Top 10

199

phpsec

197

json-sanitizer

Given JSON-like content, The JSON Sanitizer converts it to valid JSON.

OWASP D4N155 - Intelligent and dynamic wordlist using OSINT

190

D4N155

Shell

186

www-chapter-japan

Node application to help managing Maturity Models like the ones created by BSIMM and OpenSAMM

181

Maturity-Models

OWASP Passfault evaluates passwords and enforces password policy in a completely different way.

176

passfault

169

www-project-ai-security-and-privacy-guide

OWASP ASST (Automated Software Security Toolkit) | A Novel Open Source Web Security Scanner.

153

ASST

OWASP IoT Security Verification Standard (ISVS)

147

IoT-Security-Verification-Standard-ISVS

TeX

129

Software-Component-Verification-Standard

Software Component Verification Standard (SCVS)

Content for OWASP Summit 2017 site

127

owasp-summit-2017

CSS

126

BLT

OWASP BLT is a bug logging tool to report issues and get points, companies are held accountable.

The OWASP Secure Headers Project

124

www-project-secure-headers

SEDATED® Project (Sensitive Enterprise Data Analyzer To Eliminate Disclosure)

114

SEDATED

Shell

109

sonarqube

OWASP SonarQube Project

Dockerfile

107

www-project-code-review-guide

OWASP Code Review Guide Web Repository

106

www-project-proactive-controls

OWASP Raider: a novel framework for manipulating the HTTP processes of persistent sessions

Shell

104

raider

OWASP-Testing-Guide

OWASPWebGoatPHP

A deliberately vulnerable web application for learning web application security.

Repo to hold mapping of user-security-stories

user-security-stories

KubeLight

OWASP Kubernetes security and compliance tool [WIP]

www-project-webgoat

Honeypot-Project

NINJA-PingU

Desktop variant of OWASP Threat Dragon

threat-dragon-desktop

www-project-mobile-top-10

OWASP Single Sign-On allows a secure-by-default self-hosted SSO experience, including phishing-proof two-factor authentication, using state-of-the-art security mechanisms.

SSO_Project

The aim of this project is to protect Java applications against CSRF attacks with the use of Synchronizer Tokens

www-project-csrfguard

OWASP Zed Attack Proxy project landing page.

www-project-zap

Migrated from code.google.com to a more active public repository.

PHP-ESAPI

www-project-security-knowledge-framework

wpBullet

OWASP Foundation Threat Dragon Project Web Repository

www-project-threat-dragon

www-project-top-10-ci-cd-security-risks

www-project-application-security-verification-standard

OWASP Machine Learning Security Top 10 Project

www-project-machine-learning-security-top-10

Container Security Verification Standard

Container-Security-Verification-Standard

OWASP Low-Code/No-Code Top 10

www-project-top-10-low-code-no-code-security-risks

Project repository for the IoT Security Testing Guide

OpenCRE

CSS

owasp-istg

OWASP Project Developer Guide - Document and Project Web pages

www-project-developer-guide

OWASP Foundation Project Web Repository for Secure Coding Practices Quick-reference Guide

www-project-secure-coding-practices-quick-reference-guide

The OWASP DevSecOps Guideline explains how we can implement a secure pipeline and use best practices and introduce tools that we can use in this matter. Also, the project is trying to help us promote the shift-left security culture in our development process.

www-project-devsecops-guideline

www-project-devsecops-maturity-model

www-project-juice-shop

A documentation and tracking project with the goal of making package management systems more secure.

packman

www-project-api-security

OWASP Foundation Web Repository

This is a defunct code base. The project is located at: https://github.com/WebGoat

100

WebGoat