## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-DHOTREY-AWESOME-CYBERSEC
# awesome-web-hacking
This list is for anyone wishing to learn about web application security but do not have a starting point.
You can help by sending Pull Requests to add more information.
If you're not inclined to make PRs you can tweet me at `@infoslack`
# Table of Contents
* Books
* Documentation
* Tools
* Cheat Sheets
* Docker
* Vulnerabilities
* Courses
* Online Hacking Demonstration Sites
* Labs
* SSL
* Security Ruby on Rails
## Books
* http://www.amazon.com/The-Web-Application-Hackers-Handbook/dp/8126533404/ The Web Application Hacker’s Handbook: Finding and Exploiting Security Flaws
* http://www.amazon.com/Hacking-Web-Apps-Preventing-Application/dp/159749951X/ Hacking Web Apps: Detecting and Preventing Web Application Security Problems
* http://www.amazon.com/Hacking-Exposed-Web-Applications-Third/dp/0071740643/ Hacking Exposed Web Applications
* http://www.amazon.com/SQL-Injection-Attacks-Defense-Second/dp/1597499633/ SQL Injection Attacks and Defense
* http://www.amazon.com/Tangled-Web-Securing-Modern-Applications/dp/1593273886/ The Tangled WEB: A Guide to Securing Modern Web Applications
* http://www.amazon.com/Web-Application-Obfuscation-Evasion-Filters/dp/1597496049/ Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'
* http://www.amazon.com/XSS-Attacks-Scripting-Exploits-Defense/dp/1597491543/ XSS Attacks: Cross Site Scripting Exploits and Defense
* http://www.amazon.com/Browser-Hackers-Handbook-Wade-Alcorn/dp/1118662091/ The Browser Hacker’s Handbook
* http://www.amazon.com/Basics-Web-Hacking-Techniques-Attack/dp/0124166008/ The Basics of Web Hacking: Tools and Techniques to Attack the Web
* http://www.amazon.com/Web-Penetration-Testing-Kali-Linux/dp/1782163166/ Web Penetration Testing with Kali Linux
* http://www.amazon.com/Web-Application-Security-Beginners-Guide/dp/0071776168/ Web Application Security, A Beginner's Guide
* https://www.amazon.com/Hacking-Art-Exploitation-Jon-Erickson/dp/1593271441/ Hacking: The Art of Exploitation
* https://www.crypto101.io/ \- Crypto 101 is an introductory course on cryptography
* http://www.offensive-security.com/metasploit-unleashed/ \- Metasploit Unleashed
* http://www.cl.cam.ac.uk/~rja14/book.html \- Security Engineering
* https://www.feistyduck.com/library/openssl-cookbook/ \- OpenSSL Cookbook
* https://www.manning.com/books/real-world-cryptography \- Learn and apply cryptographic techniques.
* https://www.manning.com/books/making-sense-of-cyber-security \- A guide to the key concepts, terminology, and technologies of cybersecurity perfect for anyone planning or implementing a security strategy.
* https://www.manning.com/books/cyber-security-career-guide \- Kickstart a career in cyber security by learning how to adapt your existing technical and non-technical skills.
* https://www.manning.com/books/secret-key-cryptography \- A book about cryptographic techniques and Secret Key methods.
* https://www.manning.com/books/application-security-program-handbook \- This practical book is a one-stop guide to implementing a robust application security program.
* https://www.manning.com/books/cyber-threat-hunting \- Practical guide to cyber threat hunting.
* https://nostarch.com/bug-bounty-bootcamp \- Bug Bounty Bootcamp
* https://nostarch.com/hacking-apis \- Hacking APIs
* https://www.manning.com/books/grokking-web-application-security \- A book about building web apps that are ready for and resilient to any attack.
## Documentation
* https://www.owasp.org/ \- Open Web Application Security Project
* http://www.pentest-standard.org/ \- Penetration Testing Execution Standard
* http://www.binary-auditing.com/ \- Dr. Thorsten Schneider’s Binary Auditing
* https://appsecwiki.com/ \- Application Security Wiki is an initiative to provide all Application security related resources to Security Researchers and developers at one place.
* AppSec Santa \- Independent comparison of 129+ web application security tools across SAST, DAST, SCA, and more.
## Tools
* https://github.com/bad-antics/nullsec-linux \- NullSec Linux - Security distribution with pre-configured web application testing tools
* https://github.com/bad-antics/nullsec-webfuzz \- NullSec WebFuzz - Web application fuzzing framework
* https://github.com/poszothebuilder/nextjs-security-headers-starter \- Dependency-free Next.js security headers starter with CSP, HSTS, and a production verifier for CI.
* https://www.deepinfo.com/ \- Deepinfo Attack Surface Platform discovers all your digital assets, monitors them 24/7, detects any issues, and notifies you quickly so you can take immediate action.
* https://github.com/bountyyfi/lonkero \- Enterprise-grade web vulnerability scanner with 60+ attack modules, built in Rust for penetration testing and security assessments.
* https://spyse.com/ \- OSINT search engine that provides fresh data about the entire web, storing all data in its own DB, interconnect finding data and has some cool features.
* http://www.metasploit.com/ \- World's most used penetration testing software
* https://findsubdomains.com \- Online subdomains scanner service with lots of additional data. works using OSINT.
* https://github.com/BlessedRebuS/Krawl \- Cloud-native Web deception server and anti-crawler.
* https://github.com/bjeborn/basic-auth-pot HTTP Basic Authentication honeyPot.
* http://www.arachni-scanner.com/ \- Web Application Security Scanner Framework
* https://github.com/ASCIT31/Dark-Moon \- Darkmoon is an open source (GPL-3.0) autonomous AI penetration testing platform that orchestrates 80+ tools over MCP with dedicated per-technology offensive sub-agents (GraphQL, Spring Boot, ASP.NET, Node.js, Flask, PHP, Ruby) and keeps a per-finding evidence trail.
* SaaSFort \- Free 60-second external NIS2 / security posture scan, A-F grade, no signup required.
* ARS3NAL \- Offline-first, searchable arsenal: ~1500 payloads, command generator, GTFOBins, wordlists, embedded CyberChef, reverse shells and 70 checklists.
## Cheat Sheets
* http://n0p.net/penguicon/php_app_sec/mirror/xss.html \- XSS cheatsheet
* https://highon.coffee/blog/lfi-cheat-sheet/ \- LFI Cheat Sheet
* https://highon.coffee/blog/reverse-shell-cheat-sheet/ \- Reverse Shell Cheat Sheet
* https://www.netsparker.com/blog/web-security/sql-injection-cheat-sheet/ \- SQL Injection Cheat Sheet
* https://www.gracefulsecurity.com/path-traversal-cheat-sheet-windows/ \- Path Traversal Cheat Sheet: Windows
* Pentest Mindmap \- Interactive mindmap with 11,600+ pentesting commands across 32 categories. Searchable with one-click copy.
## Docker images for Penetration Testing
* `docker pull kalilinux/kali-linux-docker` official Kali Linux
* `docker pull blackarchlinux/blackarch` official BlackArch Linux
* `docker pull owasp/zap2docker-stable` \- official OWASP ZAP
* `docker pull wpscanteam/wpscan` \- official WPScan
* `docker pull metasploitframework/metasploit-framework` \- docker-metasploit
* `docker pull citizenstig/dvwa` \- Damn Vulnerable Web Application (DVWA)
* `docker pull bkimminich/juice-shop` OWASP Juice Shop
* `docker pull wpscanteam/vulnerablewordpress` \- Vulnerable WordPress Installation
## Vulnerabilities
* http://cve.mitre.org/ \- Common Vulnerabilities and Exposures. The Standard for Information Security Vulnerability Names
* https://www.exploit-db.com/ \- The Exploit Database – ultimate archive of Exploits, Shellcode, and Security Papers.
* http://0day.today/ \- Inj3ct0r is the ultimate database of exploits and vulnerabilities and a great resource for vulnerability researchers and security professionals.
* http://www.securityfocus.com/ \- Since its inception in 1999, SecurityFocus has been a mainstay in the security community.
* http://packetstormsecurity.com/ \- Global Security Resource
* https://wpvulndb.com/ \- WPScan Vulnerability Database
* https://snyk.io/vuln/ \- Vulnerability DB, Detailed information and remediation guidance for known vulnerabilities.
* https://stellastra.com/cipher-suite \- Database of hundreds of TLS cipher suites and their security status.
* https://vulert.com/vuln-db \- Vulert helps developers secure their software by monitoring and alerting them to vulnerabilities in open-source dependencies—without requiring access to their code. It supports dependencies from Js, PHP, Java, Python, and many more.
* https://vulncheck.com/xdb/ \- An index of exploit proof-of-concept code in Git repositories.
* https://labs.jamessawyer.co.uk/cves/ \- CVE PoC Search provides CVE-to-GitHub proof-of-concept lookup to quickly pivot from a web vulnerability to public exploit code.
## Courses
* https://pwn.guide/ \- Cybersecurity learning platform, with about 100 tutorials, approximately 25 of them are about web hacking & defending websites.
* https://www.offensive-security.com/information-security-training/advanced-web-attack-and-exploitation/ Offensive Security Advanced Web Attacks and Exploitation (live)
* https://www.sans.org/course/web-app-penetration-testing-ethical-hacking Sans SEC542: Web App Penetration Testing and Ethical Hacking
* https://www.sans.org/course/advanced-web-app-penetration-testing-ethical-hacking Sans SEC642: Advanced Web App Penetration Testing and Ethical Hacking
* http://opensecuritytraining.info/ \- Open Security Training
* http://securitytrainings.net/security-trainings/ \- Security Exploded Training
* http://www.securitytube.net/ \- World’s largest Infosec and Hacking Portal.
* https://www.hacker101.com/ \- Free class for web security by Hackerone
* https://www.darkrelay.com/courses/professional-penetration-tester \- Zero-Hero style Pentesting course by DarkRelay Security Labs
## Online Hacking Demonstration Sites
* http://testasp.vulnweb.com/ \- Acunetix ASP test and demonstration site
* http://testaspnet.vulnweb.com/ \- Acunetix ASP.Net test and demonstration site
* http://testphp.vulnweb.com/ \- Acunetix PHP test and demonstration site
* http://crackme.cenzic.com/kelev/view/home.php \- Crack Me Bank
* http://zero.webappsecurity.com/ \- Zero Bank
* http://demo.testfire.net/ \- Altoro Mutual
* https://public-firing-range.appspot.com/ \- Firing Range is a test bed for automated web application security scanners.
* https://xss-game.appspot.com/ \- XSS challenge
* https://google-gruyere.appspot.com/ Google Gruyere, web application exploits and defenses
* https://ginandjuice.shop/catalog
* https://pentest-ground.com/ Pentest-Ground is a free playground with deliberately vulnerable web applications and network services.
* HackSimulator is a GPT created by MarkCyber in which chatGPT 4 acts as a hacking CTF. This GPT will ask for your experience level and what you would like to improve on, before simulating a machine/application for you to hack into, using the chatbox as the place to input terminal commands. Since this is through AI, it changes and adjust based on your experience level and you can ask for help if you are stuck.
## Labs
* https://portswigger.net/web-security \- Web Security Academy: Free Online Training from PortSwigger
* http://www.cis.syr.edu/~wedu/seed/all_labs.html \- Developing Instructional Laboratories for Computer SEcurity EDucation
* https://www.vulnhub.com/ \- Virtual Machines for Localhost Penetration Testing.
* https://pentesterlab.com/ \- PentesterLab is an easy and great way to learn penetration testing.
* https://codereviewlab.com/ \- Code Review Lab is a hands-on code review training platform.
* https://github.com/jerryhoff/WebGoat.NET \- This web application is a learning platform about common web security flaws.
* http://www.dvwa.co.uk/ \- Damn Vulnerable Web Application (DVWA)
* http://sourceforge.net/projects/lampsecurity/ \- LAMPSecurity Training
* https://github.com/Audi-1/sqli-labs \- SQLI labs to test error based, Blind boolean based, Time based.
* https://github.com/paralax/lfi-labs \- small set of PHP scripts to practice exploiting LFI, RFI and CMD injection vulns
* https://hack.me/ \- Build, host and share vulnerable web apps in a sandboxed environment for free
* http://azcwr.org/az-cyber-warfare-ranges \- Free live fire Capture the Flag, blue team, red team Cyber Warfare Range for beginners through advanced users. Must use a cell phone to send a text message requesting access to the range.
* https://github.com/adamdoupe/WackoPicko \- WackoPicko is a vulnerable web application used to test web application vulnerability scanners.
* https://github.com/rapid7/hackazon \- Hackazon is a free, vulnerable test site that is an online storefront built with the same technologies used in today’s rich client and mobile applications.
* \- Rhino Security Labs' "Vulnerable by Design" AWS infrastructure setup tool
## SSL
* https://www.ssllabs.com/ssltest/index.html \- This service performs a deep analysis of the configuration of any SSL web server on the public Internet.
* http://certdb.com/ \- SSL/TLS data provider service. Collect the data about digital certificates - issuers, organisation, whois, expiration dates, etc... Plus, has handy filters for convenience.
* https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html \- Strong SSL Security on nginx
* https://weakdh.org/ \- Weak Diffie-Hellman and the Logjam Attack
* https://letsencrypt.org/ \- Let’s Encrypt is a new Certificate Authority: It’s free, automated, and open.
* https://filippo.io/Heartbleed/ \- A checker (site and tool) for CVE-2014-0160 (Heartbleed).
* https://testssl.sh/ \- A command line tool which checks a website's TLS/SSL ciphers, protocols and cryptographic flaws.
* Scorifya \- 0–100 security score for any website covering TLS, security headers (CSP, HSTS, X-Frame-Options), cookies, DNS, and email signals (SPF, DKIM, DMARC) with ranked fix steps.
## Security Ruby on Rails
* http://brakemanscanner.org/ \- A static analysis security vulnerability scanner for Ruby on Rails applications.
* https://github.com/rubysec/ruby-advisory-db \- A database of vulnerable Ruby Gems
* https://github.com/rubysec/bundler-audit \- Patch-level verification for Bundler
* https://github.com/hakirisec/hakiri_toolbelt \- Hakiri Toolbelt is a command line interface for the Hakiri platform.
* https://hakiri.io/facets \- Scan Gemfile.lock for vulnerabilities.
* http://rails-sqli.org/ \- This page lists many query methods and options in ActiveRecord which do not sanitize raw SQL arguments and are not intended to be called with unsafe user input.
* https://github.com/0xsauby/yasuo \- A ruby script that scans for vulnerable & exploitable 3rd-party web applications on a network