Awesome GitHub RepositoriesSecurity References

This project is a comprehensive, community-sourced knowledge base designed for security professionals and researchers. It functions as a centralized repository of offensive security techniques, providing a structured collection of exploit payloads, attack vectors, and methodologies for conducting vulnerability assessments and penetration testing. The repository distinguishes itself through a cross-platform payload taxonomy that categorizes exploitation methods by vulnerability type and target environment, enabling rapid lookup during security assessments. It maintains high standards of data i

The OWASP Cheat Sheet Series is a comprehensive, community-driven repository of concise security best practices and defensive coding patterns. It serves as a centralized knowledge base for developers and security professionals, providing actionable guidance to secure applications across the entire software development lifecycle. The project covers a vast array of security domains, ranging from fundamental web application hardening and authentication protocols to specialized controls for modern infrastructure and artificial intelligence systems. What distinguishes this project is its decentral

A collection of awesome penetration testing resources, tools and other shiny things

The Mobile Application Security Testing Guide is a comprehensive manual and compliance framework for verifying the security of mobile applications. It provides a standardized reference for identifying and validating common software security weaknesses and performing reverse engineering based on industry standards. The project provides a structured set of technical processes and checklists used to audit applications against established security weakness enumerations. It encompasses guidance for analyzing application binaries and runtime behavior to identify hidden functionality and security ga

A list of public penetration test reports published by several consulting firms and academic security groups.

AllAboutBugBounty is a curated collection of bug bounty techniques and payloads for web application security testing. It serves as a reference resource covering common web vulnerabilities and exploitation methods for security researchers, providing a structured approach to identifying and exploiting web application security flaws in bug bounty programs. The repository covers a wide range of attack categories including authentication bypass, cross-site scripting injection, server-side request forgery, web cache poisoning, and business logic abuse. It includes techniques for bypassing access co

This project is a bug bounty resource directory, vulnerability research cheatsheet, and web security payload library. It serves as a centralized collection of curated payloads and common attack vectors used to identify security vulnerabilities in web applications. The repository provides a directory of platforms, books, and tools to support vulnerability discovery skills. It includes a reference for tested payloads and techniques used to trigger bugs and identify vulnerabilities during security audits. The content covers web application pentesting, security vulnerability testing, and general

DefaultCreds-cheat-sheet is a searchable reference database of default usernames and passwords for thousands of hardware and software products, designed for use during security assessments. It functions as a curated directory that maps vendor products to their known factory-set login credentials, enabling rapid lookup during penetration testing and security preparation workflows. The tool is delivered as a single-file client application with no backend dependencies, serving static content from any web server or local file system for offline use. It stores credential mappings in a flat JSON da

Keyhacks is a command-line tool that tests whether API keys and tokens for dozens of cloud services are valid and active. It automates the verification of discovered credentials during security auditing and penetration testing, confirming if leaked or harvested API keys, tokens, and secrets are still operational. The tool validates credentials by sending lightweight, service-specific HTTP requests to each platform's API endpoint and inspecting the response status or body. Each validation runs independently without storing state between requests, using pre-defined request templates with the co

CUPP is a suite of tools for extracting default credentials from aggregated databases, generating password dictionaries from personal data, profiling targets interactively, and expanding wordlists from dictionary sources. It functions as a password dictionary generator and target profiling tool that collects personal details through interactive questions to build custom password lists for security testing. The project distinguishes itself through a modular command pipeline architecture that chains independent subcommands for downloading remote wordlists, parsing structured credential database

A comprehensive curated list of available Bug Bounty & Disclosure Programs and Write-ups.

Go-SCP este un ghid de codare securizată și un framework de prevenire a vulnerabilităților pentru limbajul de programare Go. Servește drept manual tehnic pentru implementarea tiparelor de programare defensivă și a benchmark-urilor de securitate pentru a preveni vulnerabilitățile software comune. Proiectul funcționează ca o referință de securitate statică, mapând slăbiciunile software cunoscute la tipare specifice de remediere în Go. Oferă un repository curatoriat de standarde de codare securizată și practici de implementare verificate, axate în mod specific pe securitatea aplicațiilor web. Framework-ul acoperă auditarea securității prin compararea codului sursă cu benchmark-urile stabilite și utilizează maparea vulnerabilităților bazată pe tipare pentru a identifica defectele de programare. Ghidul este distribuit printr-o arhitectură de referință structurată și este disponibil în formate portabile precum PDF și ePub pentru referință offline.

research