Search

The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.

The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.

In-depth attack surface mapping and asset discovery

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.

OWASP CRS (Official Repository)

Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practical remediation guidance.

Takes third-party HTML and produces HTML that is safe to embed in your web application. Fast and easy to configure.

Runtime defense against memory poisoning in AI agents (OWASP ASI06). Drop-in for LangChain, OpenAI Agents, AutoGen, CrewAI and mem0.

OWASP VulnerableApp Project: Break it. Scan it. Reproduce it. Benchmark against it. Improve it.

A vulnerable version of Rails that follows the OWASP Top 10

:warning: This repo is no longer in use. Please refer to https://github.com/OWASP/www-project-vulnerable-web-applications-directory

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

Application Security Verification Standard

Vulnerable Nodejs — a real shop (NodeBazaar) intentionally full of security bugs. 14 labs, OWASP Top 10:2025, SAST benchmark. Node.js port of DVWA.

OWASP Web Recon & Directory Discovery Platform

The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.

A library which generates random passwords with different settings to meet the OWASP requirements

OWASP Foundation main site repository

The Web Security Testing Guide (WSTG) Project produces the premier cybersecurity testing resource for web application developers and security professionals.

The OWASP Secure Headers Project

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

OWASP Coraza middleware for Caddy. It provides Web Application Firewall capabilities

A wrapper for integrating the OWASP Coraza WAF with HAProxy's SPOE filters.

🛡 Automatically configure your app to follow OWASP security patterns and principles by using HTTP Headers and Middleware

blint is a Binary Linter that checks the security properties and capabilities of your executables. It can also generate a Software Bill-of-Materials (SBOM) for supported binaries.

OWASP Foundation Web Respository

DevGuard Backend - Secure your Software Supply Chain - Attestation-based compliance as Code, manage your CVEs seamlessly, Integrate your Vulnerability Scanners, Security Framework Documentation made easy - OWASP Incubating Project

Your gateway to OWASP. Discover, engage, and help shape the future!