owasp-top-10 开源项目推荐（878 个）

juice-shop /juice-shop

OWASP Juice Shop：可能是最现代、最复杂的不安全 Web 应用

xalgord /Massive-Web-Application-Penetration-Testing-Bug-Bounty-Notes

A comprehensive guide for web application penetration testing and bug bounty hunting, covering methodologies, tools, and resources for identifying and exploiting vulnerabilities.

webpwnized /mutillidae

OWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security training. This is an easy-to-use web hacking environment designed for labs, security enthusiasts, classrooms, CTF, and vulnerability assessment tool targets.

roottusk /vapi

vAPI 是 Vulnerable Adversely Programmed Interface，一种可自托管的 API，通过练习模拟 OWASP API Top 10 场景。

Zeyad-Azima /Offensive-Resources

A Huge Learning Resources with Labs For Offensive Security Players

globocom /secDevLabs

A laboratory for learning secure web and mobile development in a practical manner.

appsecco /dvna

Damn Vulnerable NodeJS Application

bmarsh9 /gapps

安全合规平台——SOC2、CMMC、ASVS、ISO27001、HIPAA、NIST CSF、NIST 800-53、CSC CIS 18、PCI DSS、SSF 跟踪

ossamayasserr /WebAppPentestRoadmap

Roadmap for Web Application Penetration Testing | FREE Resources (Not Pirated)

OWASP /iGoat-Swift

OWASP iGoat (Swift) - A Damn Vulnerable Swift Application for iOS

ghostery /local-sheriff

Think of Local sheriff as a recon tool in your browser (WebExtension). While you normally browse the internet, Local Sheriff works in the background to empower you in identifying what data points (PII) are being shared / leaked to which all third-parties.

cerberauth /vulnapi

API Security Vulnerability Scanner designed to help you secure your APIs.

globaldatanet /aws-firewall-factory

Enhance the security of your web applications effortlessly with AWS Firewall Factory. Safeguard your valuable assets through seamless WAF deployment, updates, and staging, all centrally managed with AWS Firewall Manager.

ivan-sincek /forbidden

Bypass 4xx HTTP response status codes and more. The tool is based on Python Requests, PycURL, and HTTP Client.

errorfiathck /IDOR-Forge

IDOR Forge is an advanced and versatile tool designed to detect Insecure Direct Object Reference (IDOR) vulnerabilities in web applications.

akto-api-security /30-API-security-tests

🚀 Join us for 30days of daily API security tests. #30days30tests We've spent last 120days building amazing API security tests for the community. Next 30 days we will post test tutorials here.

precize /Agentic-AI-Top10-Vulnerability

Top 10 for Agentic AI (AI Agent Security) serves as the core for OWASP and CSA Red teaming work

OWASP /ASST

OWASP ASST (Automated Software Security Toolkit) | A Novel Open Source Web Security Scanner.

yevh /VulnPlanet

Vulnerable code snippets with fixes for Web2, Web3, API, iOS, Android and Infrastructure-as-Code (IaC)

moeinfatehi /Backup-Finder

Burp Suite extension (BApp Store) that finds backup, old, temporary and unreferenced files leaking sensitive data on web servers. OWASP WSTG-CONF-04.