Track Awesome Appsec Updates Daily

A curated list of resources for learning about application security

🏠 Home · 🔍 Search · 🔥 Feed · 📮 Subscribe · ❤️ Sponsor · 😺 paragonie/awesome-appsec · ⭐ 5.3K · 🏷️ Miscellaneous

OWASP ServerlessGoat is a deliberately insecure realistic AWS Lambda serverless application, maintained by OWASP and created by PureSec. You can install WebGoat, learn about the vulnerabilities, how to exploit them, and how to remediate each issue. The project also includes documentation explaining the issues and how they should be remediated with best-practices.

Tools

Qualys SSL Labs

The infamous suite of SSL and TLS tools.

securityheaders.io

Quickly and easily assess the security of your HTTP response headers.

report-uri.io

A free CSP and HPKP reporting service.

clickjacker.io

Test and learn Clickjacking. Make clickjacking PoC, take screenshot and share link. You can test HTTPS, HTTP, intranet & internal sites.

Books and ebooks

PureSec FunctionShield

FunctionShield is a 100% free AWS Lambda security and Google Cloud Functions security library that equips developers with the ability to easily enforce strict security controls on serverless runtimes.

Awesome Electron.js hacking & pentesting resources (⭐408) (2020)

Released: June 17, 2020

A curated list of resources to secure Electron.js-based applications.

Articles

Clojure OWASP (⭐19) (2020)

Released: May 5, 2020

Repository with Clojure examples of OWASP top 10 vulnerabilities.

Jul 30, 2018

Websites

Blogs

Crypto Fails

Showcasing bad cryptography

NCC Group - Blog

The blog of NCC Group, formerly Matasano, iSEC Partners, and NGS Secure.

Scott Helme

Learn about security and performance.

Cossack Labs blog (2018)

Released: July 30, 2018

Blog of cryptographic company that makes open-source libraries and tools, and describes practical data security approaches for applications and infrastructures.

Mar 10, 2018

Books

Securing DevOps (2018)

Released: March 1, 2018

Securing DevOps explores how the techniques of DevOps and Security should be applied together to make cloud services safer. This introductory book reviews state of the art practices used in securing web applications and their infrastructure, and teaches you techniques to integrate security directly into your product.

Holistic Info-Sec for Web Developers (Fascicle 0) (2016)

Released: September 17, 2016

The first part of a three part book series providing broad and in-depth coverage on what web developers and architects need to know in order to create robust, reliable, maintainable and secure software, networks and other, that are delivered continuously, on time, with no nasty surprises.

Classes

Holistic Info-Sec for Web Developers (Fascicle 1)

The second part of a three part book series providing broad and in-depth coverage on what web developers and architects need to know in order to create robust, reliable, maintainable and secure software, VPS, networks, cloud and web applications, that are delivered continuously, on time, with no nasty surprises.

Websites

OWASP NodeGoat (⭐1.6k)

Purposly vulnerable to the OWASP Top 10 Node.JS web application, with tutorials, security regression testing with the OWASP Zap API (⭐1.6k), docker image (⭐1.6k). With several options to get up and running fast.

Books and ebooks

Memory Security in Go - spacetime.dev (2017)

Released: August 3, 2017

A guide to managing sensitive data in memory.

The 2018 Guide to Building Secure PHP Software (2017)

Released: December 12, 2017

This guide should serve as a complement to the e-book, PHP: The Right Way, with a strong emphasis on security and not general PHP programmer topics (e.g. code style).

Black Hat Python: Python Programming for Hackers and Pentesters

Black Hat Python by Justin Seitz from NoStarch Press is a great book for the offensive security minds

Training

Essential Node.js Security (2017)

Released: July 19, 2017

Hands-on and abundant with source code for a practical guide to Securing Node.js web applications.

Articles

Security Training from BinaryMist

We run many types of info-sec security training, covering Physical, People, VPS, Networs, Cloud, Web Applications. Most of the content is sourced from the book series Kim has been working on for several years. More info can be found here

Sep 28, 2016

Books

Bulletproof SSL and TLS (2014)

Released: August 1, 2014

Websites

Supercar Showdown

How to go on the offence before online attackers do.

openwall/phpass

A portable public domain password hashing framework for use in PHP applications.

Apr 09, 2016

Books

Be wary of one-time pads and other crypto unicorns (2015)

Released: March 25, 2015

A must-read for anyone looking to build their own cryptography features.

Feb 29, 2016

Websites

Violent Python

Violent Python shows you how to move from a theoretical understanding of offensive computing concepts to a practical implementation.

Nov 19, 2015

Websites

Enigma Group

Where hackers and security experts come to train.

Oct 21, 2015

Articles

Node.js Security Checklist - Rising Stack Blog (2015)

Released: October 13, 2015

Covers a lot of useful information for developing secure Node.js applications.

Oct 07, 2015

Books

Security Engineering - Second Edition (2008)

Released: April 14, 2008

Sep 18, 2015

Useful libraries

Using Libsodium in PHP Projects

You shouldn't need a Ph.D in Applied Cryptography to build a secure web application. Enter libsodium, which allows developers to develop fast, secure, and reliable applications without needing to know what a stream cipher even is.

Aug 11, 2015

Articles

Why Invest in Application Security? (2015)

Released: June 21, 2015

Running a business requires being cost-conscious and minimizing unnecessary spending. The benefits of ensuring in the security of your application are invisible to most companies, so often times they neglect to invest in secure software development as a cost-saving measure. What these companies don't realize is the potential cost (both financial and to brand reputation) a preventable data compromise can incur.

The average data breach costs millions of dollars in damage.

Investing more time and personnel to develop secure software is, for most companies, worth it to minimize this unnecessary risk to their bottom line.

A Guide to Secure Data Encryption in PHP Applications (2015)

Released: August 2, 2015

Discusses the importance of end-to-end network-layer encryption (HTTPS) as well as secure encryption for data at rest, then introduces the specific cryptography tools that developers should use for specific use cases, whether they use libsodium, Defuse Security's secure PHP encryption library (⭐3.5k), or OpenSSL.

Books and ebooks

SEI CERT Android Secure Coding Standard (2015)

Released: February 24, 2015

A community-maintained Wiki detailing secure coding standards for Android development.

SEI CERT C Coding Standard (2006)

Released: May 24, 2006

A community-maintained Wiki detailing secure coding standards for C programming.

SEI CERT Java Coding Standard (2007)

Released: January 12, 2007

A community-maintained Wiki detailing secure coding standards for Java programming.

Useful libraries

paragonie/random_compat (⭐8k)

PHP 7 offers a new set of CSPRNG functions: random_bytes() and random_int(). This is a community effort to expose the same API in PHP 5 projects (forward compatibility layer). Permissively MIT licensed.

psecio/gatekeeper (⭐365)

A secure authentication and authorization library that implements Role-Based Access Controls and Paragon Initiative Enterprises' recommendaitons for secure "remember me" checkboxes.

Aug 09, 2015

Articles

Salted Password Hashing - Doing it Right (2014)

Released: August 6, 2014

A post on Crackstation, a project by Defuse Security

You Wouldn't Base64 a Password - Cryptography Decoded (2015)

Released: August 7, 2015

A human-readable overview of commonly misused cryptography terms and fundamental concepts, with example code in PHP.

If you're confused about cryptography terms, start here.

Repositories

Security Driven .NET (2015)

Released: July 14, 2015

An introduction to developing secure applications targeting version 4.5 of the .NET Framework, specifically covering cryptography and security engineering topics.

Jul 01, 2015

Websites

Juice Shop

An intentionally insecure Javascript Web Application.

Books and ebooks

Defensive Coding: A Guide to Improving Software Security by the Fedora Security Team (2022)

Released: May 23, 2022

Provides guidelines for improving software security through secure coding. Covers common programming languages and libraries, and focuses on concrete recommendations.

SEI CERT C++ Coding Standard (2006)

Released: July 18, 2006

A community-maintained Wiki detailing secure coding standards for C++ programming.

SEI CERT Perl Coding Standard (2011)

Released: January 10, 2011

A community-maintained Wiki detailing secure coding standards for Perl programming.

Python chapter of Fedora Defensive Coding Guide

Lists standard library features that should be avoided, and references sections of other chapters that are Python-specific.

OWASP Python Security Wiki (⭐395) (2014)

Released: June 21, 2014

A wiki maintained by the OWASP Python Security project.

Secure Ruby Development Guide (2014)

Released: March 10, 2014

A guide to secure Ruby development by the Fedora Security Team. Also available on Github (⭐8).

Articles

Secure Coding Guidelines for Java SE (2014)

Released: April 2, 2014

Secure Java programming guidelines straight from Oracle.

Training

Security Training by ^Lift Security

Learn from the team that spearheaded the Node Security Project

Jun 11, 2015

Websites

Hack Night (⭐1.1k)

Developed from the materials of NYU Poly's old Penetration Testing and Vulnerability Analysis course, Hack Night is a sobering introduction to offensive security. A lot of complex technical content is covered very quickly as students are introduced to a wide variety of complex and immersive topics over thirteen weeks.

Jun 08, 2015

Books

Secure Programming HOWTO (2015)

Released: March 1, 2015

May 26, 2015

Websites

MicroCorruption

Capture The Flag - Learn Assembly and Embedded Device Security

The Matasano Crypto Challenges

A series of programming exercises for teaching oneself cryptography by Matasano Security. The introduction by Maciej Ceglowski explains it well.

PentesterLab

PentesterLab provides free Hands-On exercises and a bootcamp to get started.

Articles

Preventing SQL Injection in PHP Applications - the Easy and Definitive Guide (2014)

Released: May 26, 2014

TL;DR - don't escape, use prepared statements instead!

May 12, 2015

Books

Gray Hat Python: Programming for Hackers and Reverse Engineers (2009)

Released: May 3, 2009

The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities (2006)

Released: November 30, 2006

C Interfaces and Implementations: Techniques for Creating Reusable Software (1996)

Released: August 30, 1996

Reversing: Secrets of Reverse Engineering (2005)

Released: April 15, 2005

JavaScript: The Good parts (2008)

Released: May 1, 2008

Windows Internals: Including Windows Server 2008 and Windows Vista, Fifth Edition (2007)

Released: June 17, 2007

The Mac Hacker's Handbook (2009)

Released: March 3, 2009

The IDA Pro Book: The Unofficial Guide to the World's Most Popular Disassembler (2008)

Released: August 22, 2008

Internetworking with TCP/IP Vol. II: ANSI C Version: Design, Implementation, and Internals (3rd Edition) (1998)

Released: June 25, 1998

Network Algorithmics,: An Interdisciplinary Approach to Designing Fast Networked Devices (2004)

Released: December 29, 2004

Computation Structures (MIT Electrical Engineering and Computer Science) (1989)

Released: December 13, 1989

Surreptitious Software: Obfuscation, Watermarking, and Tamperproofing for Software Protection (2009)

Released: August 3, 2009

Websites

websec.io

websec.io is dedicated to educating developers about security with topics relating to general security fundamentals, emerging technologies and PHP-specific information