Application Security

A lightweight web security auditing toolkit that simplifies security tasks and enhances productivity.

Helm plugin for cryptographically signing and verifying charts with GnuPG integration.

ZAP is an open-source web application security scanner that helps identify vulnerabilities through automated scanning and manual testing capabilities.

Lint lockfiles for improved security and trust policies.

A brute-force protection middleware for express routes that rate-limits incoming requests.

A tool to prevent prototype poisoning in JSON parsing.

drozer is an open source Android security testing framework that identifies vulnerabilities in mobile apps and devices through Android Runtime and IPC endpoint interaction.

Package verification tool for npm with various verification and testing capabilities.

StaDynA is a system supporting security app analysis in the presence of dynamic code update features.

MARA is a Mobile Application Reverse engineering and Analysis Framework with various features for testing mobile applications against OWASP mobile security threats.

Gitleaks is a SAST tool for detecting and preventing hardcoded secrets in git repos.

A CLI tool that performs security assessments on Joi validator schemas by testing them against various attack vectors including XSS, SQL injection, RCE, and SSRF.

Web-application vulnerability scanner with extensive coverage of security testing modules.

A Java based HTTP/HTTPS proxy for assessing web application vulnerability with various useful features.

Fuzzapi is a Rails application with a user-friendly UI for API_Fuzzer gem and Docker setup.

Androwarn performs static analysis of Android applications using Dalvik bytecode examination to detect and report potentially malicious behaviors.

Runtime Mobile Security (RMS) is a powerful web interface powered by FRIDA for manipulating Android and iOS Apps at Runtime.

JAADAS is a powerful tool for static analysis of Android applications, providing features like API misuse analysis and inter-procedure dataflow analysis.

A community website for API security news, vulnerabilities, and best practices

Gamma Ray is a software that helps developers to look for vulnerabilities on their Node.js applications with a pluggable infrastructure for integration with vulnerabilities databases.

A command line tool that automates vulnerability scanning of Ruby gems and Rails stack components by identifying CVE vulnerabilities in detected technology versions.

Checkov is a static analysis tool that scans infrastructure as code and performs software composition analysis to detect security misconfigurations and vulnerabilities in cloud infrastructure and dependencies.

DVHMA is an intentionally vulnerable Android hybrid mobile app built with Apache Cordova for security testing and educational purposes.

Python tool for monitoring user-select APIs in Android apps using Frida.