awesome-web-hacking - A list of web application security

项目说明

awesome-web-hacking

This list is for anyone wishing to learn about web application security but do not have a starting point.

You can help by sending Pull Requests to add more information.

If you're not inclined to make PRs you can tweet me at

Table of Contents
=================

* Books
* Documentation
* Tools
* Cheat Sheets
* Docker
*
* Courses
* Online Hacking Demonstration Sites
* Labs
* SSL
* Security Ruby on Rails

Books

* The Web Application Hacker’s Handbook: Finding and Exploiting Security Flaws
* Hacking Web Apps: Detecting and Pre Web Application Security Problems
* Hacking Exposed Web Applications
* SQL Injection Attacks and Defense
* The Tangled WEB: A Guide to Securing Modern Web Applications
* Web Application Obfuscation: '-/WAFs..E..Filters//alert(/Obfuscation/)-'
* XSS Attacks: Cross Site Scripting Exploits and Defense
* The Browser Hacker’s Handbook
* The Basics of Web Hacking: Tools and Techniques to Attack the Web
* Web Penetration Testing with Kali Linux
* Web Application Security, A Beginner's Guide
* Hacking: The Art of Exploitation
* - Crypto 101 is an introductory course on cryptography
* - Metasploit Unleashed
* - Security Engineering
* - OpenSSL Cookbook
* - Learn and apply cryptographic techniques.
* - A guide to the key concepts, terminology, and technologies of cybersecurity perfect for anyone planning or implementing a security strategy.
* - Kickstart a career in cyber security by learning how to adapt your existing technical and non-technical skills.
* - A book about cryptographic techniques and Secret Key methods.
* - This practical book is a one-stop guide to implementing a robust application security program.
* - Practical guide to cyber threat hunting.
* - Bug Bounty Bootcamp
* - Hacking APIs
* - A book about building web apps that are ready for and resilient to any attack.

Documentation

* - Open Web Application Security Project
* - Penetration Testing Execution Standard
* - Dr. Thorsten Schneider’s Binary Auditing
* - Application Security Wiki is an initiative to provide all Application security related resources to Security Researchers and de at one place.
* AppSec Santa - Independent comparison of 129+ web application security tools across SAST, DAST, SCA, and more.

Tools

* - NullSec Linux - Security distribution with pre-configured web application testing tools
* - NullSec WebFuzz - Web application fuzzing 框架
* - Dependency-free Next.js security headers starter with CSP, HSTS, and a production for CI.

* - Deepinfo Attack Surface Platform discovers all your digital assets, monitors them 24/7, detects any issues, and notifies you quickly so you can take immediate action.
* - Enterprise-grade web scanner with 60+ attack modules, built in Rust for penetration testing and security assessments.
* - OSINT search 引擎 that provides fresh data about the entire web, storing all data in its own DB, interconnect finding data and has some cool features.
* - World's most used penetration testing software
* - Online subdomains scanner service with lots of additional data. works using OSINT.
* - Free online toolkit for WHOIS, RDAP, DNS, IP WHOIS, SSL certificate lookup, name ser, 网络 diagnostics (ping/traceroute/MTR), and domain monitoring. No sign-up required.
* - Free RDAP domain watchlist: scheduled checks + domains.
* - Cloud-native Web deception 服务端 and anti-crawler.
* HTTP Basic Authentication honeyPot.
* - Web Application Security Scanner 框架
* - Darkmoon is an open 源码 (GPL-3.0) autonomous AI penetration testing platform that orchestrates 80+ tools over MCP with dedicated per-technology offensi (GraphQL, Spring Boot, ASP.NET, Node.js, Flask, PHP, Ruby) and keeps a per-finding e trail.
* - BugTraceAI is an open-源码 multi-agent platform for authorized web application security testing with , e capture, and reporting.
* - HeaderProof is a de, low-noise acti for authorized testing of header-driven web security leads such as CORS misconfiguration, response splitting, cache poisoning candidates, and reflection paths, with explicit e gates and false-positi.
* - Autonomous AI security engineer & bug bounty platform in Kali Linux featuring stateful Hermes reasoning, OpenClaw Chromium browser sidecar, and Qdrant strategy RAG. 🇮🇳
* - Nikto web ser
* - Nessus Scanner
* - Burp Intruder is a 工具 for automating customized attacks against web apps.
* - The world's most ad Open 源码 scanner and manager.
* - Security auditing tool for AWS en
* - Is a multi threaded ja designed to brute force directories and files names on web/application servers.
* - The Zed Attack Proxy is an easy to use integrated penetration testing 工具 for finding in web applications.
* - High-fidelity web & API scanner fusing agentic AI with a fast nati; 250+ detection modules co the OWASP Top 10, authenticated IDOR/BOLA & out-of-band testing, and OpenAPI/Postman/Burp/cURL inputs. Open-源码, AGPL-3.0.
* - dsniff is a collection of tools for 网络 auditing and penetration testing.
* - Manage your webshell .
* - DNS spoofer. Drops DNS responses from the router and replaces it with the spoofed DNS response
* - The Social-Engineer Toolkit (SET) repository from TrustedSec
* - Automatic SQL injection and 数据库 takeover 工具
* - The Browser Exploitation 框架 Project
* - w3af is a Web Application Attack and Audit 框架
* - WPSploit, Exploiting Wordpress With Metasploit
* - secures software by detecting in open-源码 dependencies—without accessing your 代码. It supports Js, PHP, Ja, and more.
* - Reverse shell manager .
* - WS-Attacker is a modular 框架 for web services penetration testing
* - WPScan is a black box WordPress scanner
* - Blackbox, non-intrusi for the wp2shell pre-auth RCE chain in WordPress core (C / C); fingerprints the core from public sources and flags installs without exploiting them
* Paros proxy
* Web Scarab proxy
* Skipfish, an active web application security reconnaissance 工具
* Acunetix Web Scanner
* CyStack Web Security Platform
* IBM Security AppScan
* Netsparker web scanner
* HP Web Inspect
* Wikto - Nikto for Windows with some extra features
* Samurai Web Testing Framework
* Ratproxy
* Websecurify
* Grendel-scan
* Directory/file and DNS busting 工具 written in Go
* Wfuzz
* wapiti
* Grabber
* Vega
* Watcher passive web scanner
* x5s XSS and Unicode transformations security testing assistant
* A Assessment and Management
* Golismero
* IKare
* N-Stalker X
* Nexpose
* App Spider
* ParosPro
* Qualys Web Application Scanning
* Retina
* Xenotix XSS Exploit Framework
* scanner for Linux, agentless, written in golang.
* A Ruby 框架 for de and using modules which aid in the penetration testing of WordPress powered websites and systems.
* XSS Payloads to le XSS , build custom payloads, practice penetration testing skills.
* JBoss (and others Ja ) and EXploitation 工具
* Automated All-in-One OS command injection and exploitation 工具
* A Burp Suite content discovery plugin that add the smart into the Buster!
* Burp and ZAP plugin to analyze CSP headers
* Perform timing attacks against web applications
* Fuzzapi is a 工具 used for REST API pentesting
* Offensive Web Testing Framework (OWTF)
* Application for capturing, modifying and sending custom WebSocket data from 客户端 to 服务端 and vice versa.
* 工具 suite for WebSocket discovery, fingerprinting, and detection
* Automated 客户端-side template injection (sandbox escape/bypass) detection for AngularJS (ACSTIS).
* A 源码 代码 analysis 工具 for detecting and managing Ja .
* Web app for transforming binary data and strings, including hashes and encodings. GPLv3 offline a.
* A "Cyber Swiss Army Knife" for carrying out encodings and transformations of binary data and strings.
* WhatWeb - Next generation web scanner
* Shodan - The search 引擎 for find servers
* A webshell manager
* PhpSploit - Full-featured C2 框架 which silently persists on webserver via evil PHP oneliner
* - webhint - webhint is a customizable linting 工具 that helps you improve your site's accessibility, speed, cross-browser compatibility, and more by checking your 代码 for best practices and common errors.
* - gtfobins - GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems.
* git-scanner - A 工具 for bug hunting or pentesting for targeting websites that have open .git repositories a in public
* Web Application Exploitation @ Rawsec In - Complete list of Web pentesting tools
* Cyclops is a no that can detect automatically - Cyclops is a web browser with XSS detection feature
* - Web proxy
* - API discovery
* - domain recon
* - Columbus Project is an ad subdomain discovery service with fast, powerful and easy to use API.
* BadUSB Script To Exfiltrate Passwords - Extracts all sa from Chrome, Firefox, and Edge to be saved onto secondary USB for further analysis.
* - Brute-force HS256, HS384 or HS512 JWT Token from your browser (fully 客户端-side).
* jwt-auditor - Offline CLI to decode and audit JWTs for alg:none, weak HMAC secrets, and RS256 to HS256 confusion.
* - Easy to remember reverse shell that should work on most Unix-like systems.
* - Chrome extension that passively scans web pages for leaked API keys, tokens, and secrets using 80+ detection patterns and Shannon entropy across 10 attack surfaces.
* - Browser-based scanner for bug bounty and pentesting workflows, combining DAST, SAST, IAST, and SCA capabilities to detect runtime, 源码-level, interactive, and dependency-related security issues.

SaaSFort - Free 60-second external NIS2 / security posture scan, A-F grade, no signup required.

ARS3NAL - Offline-first, searchable arsenal: ~1500 payloads, command generator, GTFOBins, wordlists, embedded CyberChef, reverse shells and 70 checklists.

Mozilla - HTTP Obser - De by Mozilla, the HTTP Obser performs an in-depth assessment of a site’s HTTP headers and other key security configurations.

HTTP Security Report - Get an instant report of how your website measures up to the best practices.

ImmuniWeb CyberScore - free cybersecurity, privacy and AI security rating of your company, partners or suppliers

ImmuniWeb - Website Security Test - Checks for web security , AI bot protection, HTTP security and privacy headers, DNSSEC configuration, CSP, and compliance with GDPR and PCI DSS. 10 free tests per month (without account)

Pentest Tools - Website Scanner - detects SQLi, XSS, command injection, XXE, and 75+ more web app

Pentest Tools - 网络 Scanner - an online security 工具 designed to identify , misconfigurations, outdated services, and exposed ports in 网络 infrastructure

UpClaw - AI-driven web pentest CLI; single zero-dependency Python file (29 built-in checks + 16 external 工具 adapters + e reports).

HTTP Detection Agent - open-源码, local-first HTTP attack detector: Rust CLI with 76 detections across 62 behavior families (injection, tra, request smuggling, SSRF, XXE, deserialization, and more), plus a local MCP 服务端 for agent-dri

Cheat Sheets

* - XSS cheatsheet
* - LFI Cheat Sheet
* - Reverse Shell Cheat Sheet
* - SQL Injection Cheat Sheet
* - Path Tra Cheat Sheet: Windows
* Pentest Mindmap - Interacti with 11,600+ pentesting commands across 32 categories. Searchable with one-click copy.

Docker images for Penetration Testing

* docker pull kalilinux/kali-linux-docker official Kali Linux
* docker pull blackarchlinux/blackarch official BlackArch Linux
* docker pull owasp/zap2docker-stable - official OWASP ZAP
* docker pull wpscanteam/wpscan - official WPScan
* docker pull metasploitframework/metasploit-framework - docker-metasploit
* docker pull citizenstig/dvwa - Damn Web Application (DVWA)
* docker pull bkimminich/juice-shop OWASP Juice Shop
* docker pull wpscanteam/ - WordPress Installation
* docker pull hmlio/ - as a service: Shellshock
* docker pull hmlio/ - as a service: Heartbleed
* docker pull opendns/security-ninjas - Security Ninjas
* docker pull noncetonic/archlinux-pentest-lxde:1.0 - Arch Linux Penetration Tester
* docker pull diogomonica/docker-bench-security - Docker Bench for Security
* docker pull ismisepaul/securityshepherd - OWASP Security Shepherd
* docker pull danmx/docker-owasp-webgoat - OWASP WebGoat Project docker image
* docker pull docker pull jeroenwillemsen/wrongsecrets - OWASP WrongSecrets Project docker image
* docker pull citizenstig/nowasp - OWASP Mutillidae II Web Pen-Test Practice Application
* docker pull aaaguirre/pentest - Docker for pentest
* docker pull rustscan/rustscan:2.0.0 - The Modern Port Scanner

* - Common and Exposures. The Standard for Information Security Names
* - The Exploit Database – ultimate archive of Exploits, Shellcode, and Security Papers.
* - Inj3ct0r is the ultimate 数据库 of exploits and and a great resource for researchers and security professionals.
* - Since its inception in 1999, SecurityFocus has been a mainstay in the security community.
* - Global Security Resource
* - WPScan Database
* - DB, Detailed information and remediation guidance for known .
* - 数据库 of hundreds of TLS cipher suites and their security status.
* - helps de secure their software by monitoring and alerting them to in open-源码 dependencies—without requiring access to their 代码. It supports dependencies from Js, PHP, Ja, and many more.
* - An index of exploit proof-of-concept 代码 in Git repositories.
* - CVE PoC Search provides C proof-of-concept lookup to quickly pivot from a web to public exploit 代码.

Courses

* - Cybersecurity learning platform, with about 100 tutorials, approximately 25 of them are about web hacking & defending websites.
* Offensi Ad Web Attacks and Exploitation (live)
* Sans SEC542: Web App Penetration Testing and Ethical Hacking
* Sans SEC642: Ad Web App Penetration Testing and Ethical Hacking
* - Open Security Training
* - Security Exploded Training
* - World’s largest Infosec and Hacking Portal.
* - Free class for web security by Hackerone
* - Zero-Hero style Pentesting course by DarkRelay Security Labs

Online Hacking Demonstration Sites

* - Acunetix ASP test and demonstration site
* - Acunetix ASP.Net test and demonstration site
* - Acunetix PHP test and demonstration site
* - Crack Me Bank
* - Zero Bank
* - Altoro Mutual
* - Firing Range is a test bed for automated web application security scanners.
* - XSS challenge
* Google Gruyere, web application exploits and defenses
*
* Pentest-Ground is a free playground with deliberately web applications and 网络 services.
* HackSimulator is a GPT created by MarkCyber in which chatGPT 4 acts as a hacking CTF. This GPT will ask for your experience level and what you would like to improve on, before simulating a machine/application for you to hack into, using the chatbox as the place to input terminal commands. Since this is through AI, it changes and adjust based on your experience level and you can ask for help if you are stuck.

Labs

* - Web Security Academy: Free Online Training from PortSwigger
* - De Instructional Laboratories for Computer SEcurity EDucation
* - Machines for Localhost Penetration Testing.
* - PentesterLab is an easy and great way to learn penetration testing.
* - 代码 Review Lab is a hands-on 代码 review training platform.
* - This web application is a learning platform about common web security flaws.
* - Damn Web Application (DVWA)
* - LAMPSecurity Training
* - SQLI labs to test error based, Blind boolean based, Time based.
* - small set of PHP scripts to practice exploiting LFI, RFI and CMD injection vulns
* - Build, host and share web apps in a sandboxed en for free
* - Free live fire Capture the Flag, blue team, red team Cyber Warfare Range for beginners through ad users. Must use a cell phone to send a text message requesting access to the range.
* - WackoPicko is a web application used to test web application scanners.
* - Hackazon is a free, test site that is an online storefront built with the same technologies used in today’s rich client and mobile applications.
* - Rhino Security Labs' " by Design" AWS infrastructure setup 工具
* - Hack The Box is an online platform allowing you to test and advance your skills in cyber security.
* - 0l4bs is a Cross-site scripting labs for web application security enthusiasts.
* - Local pentest lab le docker compose.
*
*
* - LabEx is an online platform for enhancing your cyber security skills through hands-on labs.
* - CyberPython helps you to make your own research in order to sol, exploit CVEs and make good scripts.
* - OSS – OopsSec Store: An intentionally e-commerce application built with Next.js and React for web security training and CTF practice.
* - HTB Writeups: The most comprehensive Hack The Box writeup collection with 500+ machines, 400+ challenges, ProLabs, Sherlocks, CTF events, and cheatsheets.

SSL

* - This service performs a deep analysis of the configuration of any SSL web 服务端 on the public Internet.
* - Search Certificate Transparency logs for SSL/TLS certificates issued for a domain.
* - Strong SSL Security on nginx
* - Weak Diffie-Hellman and the Logjam Attack
* - Let’s Encrypt is a new Certificate Authority: It’s free, automated, and open.
* - A checker (site and 工具) for C (Heartbleed).
* - A command line 工具 which checks a website's TLS/SSL ciphers, protocols and cryptographic flaws.
* Scorifya - 0–100 security score for any website co TLS, security headers (CSP, HSTS, X-Frame-Options), cookies, DNS, and email signals (SPF, DKIM, DMARC) with ranked fix steps.
* ImmuniWeb SSL Security Test - a free online 工具 that checks the security of a website or email 服务端’s SSL/TLS configuration. Сhecks compliance with security standards such as NIST, HIPAA, PCI DSS, and GDPR. 10 free tests per month (without account)

Security Ruby on Rails

* - A static analysis security scanner for Ruby on Rails applications.
* - A database of Ruby Gems
* - Patch-le for Bundler
* - Hakiri Toolbelt is a command line interface for the Hakiri platform.
* - Scan Gemfile.lock for .
* - This page lists many query methods and options in Acti which do not sanitize raw SQL arguments and are not intended to be called with unsafe user input.
* - A ruby script that scans for & exploitable 3rd-party web applications on a 网络

项目信息

开发语言：未知

Star 数：7286

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A list of web application security展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。