OWASP Juice Shop: Probably the most modern and sophisticated insecure web application
- owasp
- javascript
- vulnerable
- hacking
Repository Index
47,133 repositories indexed
1–23 of 23 · Most stars
Zero-ETL, infinite possibilities. Live query APIs, code & more with SQL. No DB required.
- steampipe
- postgresql
- postgresql-fdw
- cloud
A generic, spec-compliant, thorough implementation of the OAuth request-signing logic
- python
- python3
- python-3
- authentication
A php2shell exploit that requires no modifications to the official version, and does not require display_errors or limit_memory.
LunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: https://github.com/marketplace/lunatrace-by-lunasec/
- tokenization
- web-security
- compliance
- security
The Prime Cross Site Request Forgery (CSRF) Audit and Exploitation Toolkit.
- csrf
- crawler
- csrf-attacks
- token-generation
:rocket: An open source alternative to searx which provides a modern-looking :sparkles:, lightning-fast :zap:, privacy respecting :disguised_face:, secure :lock: meta search engine
- meta-search-engine
- rust
- search-engine
- fast
Package gorilla/csrf provides Cross Site Request Forgery (CSRF) prevention middleware for Go web applications & services 🔒
- csrf-protection
- gorilla
- middleware
- golang
🚀 Useful README.md, LICENSE, CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, GitHub Issues, Pull Requests and Actions templates to jumpstart your projects.
- readme
- documentation
- docs
- docs-generator
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
Tool to export Juice Shop challenges and hints in data format compatible with CTFd, RootTheBox or FBCTF
- owasp
- ctf
- ctfd
- application-security
🔓 CLI tool and library to execute padding oracle attacks easily, with support for concurrent network requests and an elegant UI.
- padding-oracle
- aes
- decryption
- encryption
Sockets with pure VB6 impl of TLS encryption
Content discovery and fuzzing with HTTP/3 support (100k requests per second)
Tool to help guess a files 256 byte XOR key by using frequency analysis
- frequency-analysis
- python
- xor
- malware
CTF in a box. Minimal setup required. (not production-ready yet)
Framework agnostic set of sqlalchemy classes that make building applications that require permissions an easy task.
- python
- pyramid
- flask
- sqlalchemy
provides a full user authentication experience for an API. Includes login,logout,register,forgot password, forgot username, confirmation email and all that other good stuff. Includes plug for checking for authenticated users and macro for generating the required routes.
Middleware to Authenticate and Authorize Requests in Vapor
The open-source safety layer for AI agents — block unsafe tool calls, require approval, enforce budgets, audit, replay.
Honeypot that mimics Tomcat manager endpoints. Logs requests and saves attacker's WAR file for later study
- honeypot
- spring-boot
- tomcat
Open-source PocketBase security auditor: detects empty rules, the @request.auth.id != trap, true literals. Active probe confirms leaks live.
An Elixir Plug to verify HTTP requests signed with AWS Signature V4
- elixir-plug
- aws-signature
- authentication