OWASP ORG

The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.

A large collection of short, practical security guides for developers, one cheat sheet per topic, covering things like safe password handling, preventing SQL injection, and securing authentication.

The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.

The OWASP Mobile Application Security Testing Guide is a free, comprehensive reference manual for testing the security of Android and iOS apps, covering step-by-step procedures and reverse engineering techniques.

The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.

The official OWASP Web Security Testing Guide, a comprehensive reference for penetration testers and security teams describing structured tests for finding common web application vulnerabilities.

Official OWASP Top 10 Document Repository

Golang Secure Coding Practices guide

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management

Application Security Verification Standard

The OWASP MASVS (Mobile Application Security Verification Standard) is the industry standard for mobile app security.

OWASP API Security Project

The OWASP Developer Guide

The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.

QRLJacking or Quick Response Code Login Jacking is a simple-but-nasty attack vector affecting all the applications that relays on “Login with QR code” feature as a secure way to login into accounts which aims for hijacking users session by attackers.

completely ridiculous API (crAPI)

An open source threat modeling tool from OWASP

Web and mobile application security training platform

Vulnerable app with examples showing how to not use secrets

OWASP Foundation Web Respository

OWASP Community Pages are a place where OWASP can accept community contributions for security-related content.

OWASP Top 10 for Large Language Model Apps (Part of the GenAI Security Project)

OWASP Joomla Vulnerability Scanner Project https://www.secologist.com/

A Pythonic framework for threat modeling

The OWASP DevSecOps Guideline can help us to embedding security as a part of the development pipeline.

Takes third-party HTML and produces HTML that is safe to embed in your web application. Fast and easy to configure.

A vulnerable version of Rails that follows the OWASP Top 10

IoTGoat is a deliberately insecure firmware created to educate software developers and security professionals with testing commonly found vulnerabilities in IoT devices.

:warning: This repo is no longer in use. Please refer to https://github.com/OWASP/www-project-vulnerable-web-applications-directory

OWASP Foundation web repository

No description.

Getting a handle on container security

OWASP Autonomous Penetration Testing Standard

The OWASP OFFAT tool autonomously assesses your API for prevalent vulnerabilities, though full compatibility with OAS v3 is pending. The project remains a work in progress, continuously evolving towards completion.

OWASP Foundation main site repository

OWASP Foundation Web Respository

OWASP WebScarab

The Secure Coding Dojo is a platform for delivering secure coding knowledge.

The Web Security Testing Guide (WSTG) Project produces the premier cybersecurity testing resource for web application developers and security professionals.

Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practical remediation guidance.

a Damn Vulnerable Serverless Application

The OWASP Java Encoder is a Java 1.5+ simple-to-use drop-in high-performance encoder class with no dependencies and little baggage. This project will help Java web developers defend against Cross Site Scripting!

OWASP Honeypot, Automated Deception Framework.

OWASP iGoat - A Learning Tool for iOS App Pentesting and Security by Swaroop Yermalkar

OWASP iGoat (Swift) - A Damn Vulnerable Swift Application for iOS

AI-powered Docker security scanner that explains vulnerabilities in plain English. An OWASP Lab Project.

OWASP Vulnerable Web Application Project https://github.com/hummingbirdscyber

Your gateway to OWASP. Discover, engage, and help shape the future!

OWASP Foundation Web Respository

The OWASP SecureTea Project provides a one-stop security solution for various devices (personal computers / servers / IoT devices)

The Secure Coding Framework

pysap is an open source Python library that provides modules for crafting and sending packets using SAP's NI, Diag, Enqueue, Router, MS, SNC, IGS, RFC and HDB protocols.

OWASP Foundation Web Respository

Given JSON-like content, The JSON Sanitizer converts it to valid JSON.

The OWASP Secure Headers Project

OWASP ASST (Automated Software Security Toolkit) | A Novel Open Source Web Security Scanner.

The AI Security Verification Standard (AISVS) focuses on providing developers, architects, and security professionals with a structured checklist to verify the security of AI-driven applications.

OWASP Foundation Web Respository

Software Component Verification Standard (SCVS)

No description.

A deliberately vulnerable web application for learning web application security.

OWASP IoT Security Verification Standard (ISVS)

The source files and tools needed to build the OWASP Cornucopia decks in various languages

The IoT Security Testing Guide (ISTG) provides a comprehensive methodology for penetration tests in the IoT field, offering flexibility to adapt innovations, and developments in the IoT market while still ensuring comparability of test results.

No description.

OWASP Project Developer Guide - Document and Project Web pages

OWASP Testing Guide

OWASP Zed Attack Proxy project landing page.

OWASP Kubernetes security and compliance tool [WIP]

No description.

OWASP Foundation Web Respository

OWASP Foundation web repository

OWASP ThreatAtlas is a collaborative platform for community-driven threat modeling.

OWASP Foundation Web Respository

OWASP Secure Agent Playbook Project

The OWASP AppSec Browser Bundle is an open source Linux based penetration testing browser bundle built over Mozilla Firefox. It comes pre-configured with security tools for spidering, advanced web searching, fingerprinting, anonymous browsing, web server scanning, fuzzing, report generating and more.

OWASP Foundation Threat Dragon Project Web Repository

OWASP Foundation Web Respository

The OWASP Vulnerable Web Applications Directory Project (VWAD) is a comprehensive and well maintained registry of all known vulnerable web applications currently available.

OWASP Foundation Web Respository

The OWASP DevSecOps Guideline explains how we can implement a secure pipeline and use best practices and introduce tools that we can use in this matter. Also, the project is trying to help us promote the shift-left security culture in our development process.

OWASP MCP Top10

OWASP Foundation Project Web Repository for Secure Coding Practices Quick-reference Guide

OWASP Citizen Development Top 10

OWASP Smart Contract Top 10

Desktop variant of OWASP Threat Dragon

OWASP Foundation web repository

OWASP Foundation web repository

No description.

OWASP Foundation Web Respository

OWASP LLM Security Verification Standard

Run Capture the Flags and Security Trainings with OWASP WrongSecrets

OWASP Foundation Web Respository

Agent Observability Standard

OWASP Smart Contract Security (SCS) Project

OWASP Foundation web repository

OWASP Foundation web repository

The Secure Coding Practices Quick-reference Guide from OWASP

OWASP Foundation web repository

Swag for the OWASP projects and chapters

OWASP Foundation Web Respository

OWASP Non-Human Identities Top 10

No description.

No description.

OWASP Foundation Web Respository

No description.

The Mobile Application Security Weakness Enumeration (MASWE) is a list of common security and privacy weaknesses in mobile apps. It is intended to be used as a reference for developers, security researchers, and security professionals. It acts as the bridge between the OWASP MASVS and the MASTG.

OWASP Thick Client Application Security Verification Standard

Cumulus. Threat modeling the Clouds.

OWASP GoatDroid is a fully functional and self-contained training environment for educating developers and testers on Android security. GoatDroid requires minimal dependencies and is ideal for both Android beginners as well as more advanced users. The project currently includes two applications: FourGoats, a location-based social network, and Herd Financial, a mobile banking application. There are also several feature that greatly simplify usage within a training environment or for absolute beginners who want a good introduction to working with the Android platform. Download the built version here: https://github.com/jackMannino/OWASP-GoatDroid-Project/downloads

Executable security regression testing for agentic applications and MCP-integrated systems.

OWASP Foundation Web Respository

OWASP Foundation Web Respository

OWASP Foundation Web Respository

OWASP Foundation web repository

OWASP Certified Secure-Software Developer

PromptMe is an educational project that showcases security vulnerabilities in large language models (LLMs) and their web integrations. It includes 10 hands-on challenges inspired by the OWASP LLM Top 10, demonstrating how these vulnerabilities can be discovered and exploited in real-world scenarios.

Open SAMMY codebase

OWASP Foundation web repository

No description.

German OWASP Day conference site & presentation archive

The OWASP home for the Internet of Things project

OWASP Foundation Web Respository

OWASP Foundation Web Respository

OWASP Foundation Web Respository

OWASP Foundation Web Respository

OWASP Foundation Web Respository

OWASP Foundation Web Respository

OWASP Foundation Web Respository

The OWASP Mobile Application Security Project website is the central hub for industry-leading standards, guides, and resources—helping developers and security professionals build, test, and secure mobile applications.

Source code for the Binaries of OWASP WrongSecrets

OWASP Foundation Web Respository

DonkAI is a hands-on lab for the OWASP Top 10 for LLM Applications (2025) - no real LLM required.

OWASP IoT Security Testing Guide site repository

OWASP Foundation Web Respository

OWASP Foundation Web Respository

Contains owasp site theme specific items (headers, footers, json, menus)

OWASP Foundation web repository

Let's Threat Model is an Agentic AI tool that helps teams identify and manage threats early in the development lifecycle. Built with extensibility and automation in mind, it brings threat modeling into agile workflows by generating actionable threat models.

A Framework for Integrating Application Security into Software Engineering (FIASSE) using the Securable Software Engineering Model (SSEM)

OWASP Foundation Web Respository

OWASP Foundation Web Respository

OWASP Foundation Web Repository

OWASP Foundation web repository

OWASP Foundation web repository

Attack surface detector that identifies endpoints by static analysis

OWASP Foundation Web Respository

OWASP Lisboa Web Repository

This repository contains OWASP Dungeons & Daemons a collection of security games. It's purpose is to promote security awareness and practices.

OWASP Schema

No description.

Intentionally vulnerable LLM

OWASP Foundation Web Respository

OWASP Foundation Web Respository

OWASP Foundation Web Respository

OWASP Foundation Web Repository for the Ottawa Ontario Chapter

OWASP Foundation Web Respository

OWASP Foundation Web Respository

OWASP Foundation web repository

OWASP Foundation Web Respository

OWASP Foundation Web Respository

OWASP Foundation Web Respository

A TypeScript package that provides AI-powered agents for Application Security (AppSec) tasks, built on top of the Claude Agent SDK.

OWASP Foundation web repository

Pin your github actions, from within vscode (and forks)

OWASP Foundation Web Respository

No description.

OWASP Foundation web repository

OWASP Foundation Web Respository

OWASP Foundation Web Respository

OWASP Foundation Web Respository

OWASP Foundation Web Respository

OWASP Foundation web repository

OWASP Foundation Web Respository

OWASP Foundation web repository

OWASP Foundation Web Respository

OWASP Foundation Web Respository

OWASP Foundation Web Respository

OWASP Foundation web repository

OWASP Foundation web repository

No description.

OWASP Foundation Web Respository

OWASP Foundation web repository

OWASP Foundation Web Respository

OWASP Foundation Web Respository

OWASP Foundation Web Respository

No description.

OWASP Foundation web repository

OWASP Foundation Bristol UK chapter

OWASP Foundation web repository

No description.

OWASP Foundation Web Respository

No description.

OWASP Foundation web repository

OWASP Foundation Web Respository

OWASP Foundation Web Respository

No description.

OWASP Foundation web repository

OWASP Foundation web repository

OWASP Foundation Web Respository

OWASP Foundation web repository

No description.

OWASP Foundation web repository