Skip to main content

​
Overview

This page curates high-quality resources for deepening your understanding of web application security, ethical hacking, and secure development practices.

Documentation

Official security standards and guidelines

Practice Labs

Hands-on vulnerability testing environments

Tools

Security testing and analysis tools

​
Official Security Standards

​
OWASP Resources

OWASP Top 10Testing & VerificationDevelopment Resources
Security Testing ToolsVulnerable Applications for Practice
  • WebGoat - Deliberately insecure application
  • Juice Shop - Modern vulnerable web app
  • DVWA - Damn Vulnerable Web Application
  • NodeGoat - Vulnerable Node.js application

​
MITRE Resources

CWE

Common Weakness EnumerationComprehensive dictionary of software weaknesses
  • 900+ weakness types
  • Hierarchical categorization
  • Mitigation strategies

CAPEC

Common Attack PatternsDatabase of attack patterns and techniques
  • Attack execution flows
  • Prerequisites and indicators
  • Mitigation approaches

CVE

Common VulnerabilitiesPublic database of security vulnerabilities
  • Real-world CVE examples
  • Vendor advisories
  • Patch information

ATT&CK

Adversarial TacticsKnowledge base of attacker techniques
  • Enterprise, Mobile, ICS matrices
  • Threat actor profiles
  • Detection strategies

​
Industry Standards

StandardOrganizationFocus AreaLink
PCI DSSPCI Security Standards CouncilPayment card securitypcisecuritystandards.org
NIST CSFNISTCybersecurity frameworknist.gov/cyberframework
ISO 27001ISOInformation security managementiso.org
CIS ControlsCenter for Internet SecuritySecurity best practicescisecurity.org
GDPREuropean UnionData protectiongdpr.eu

​
Practice Platforms & CTF

​
Vulnerable Applications

OWASP ProjectsClassic Vulnerable Apps
  • DVWA - Three difficulty levels
  • bWAPP - 100+ web vulnerabilities
  • Mutillidae - OWASP Top 10 coverage
Modern Stacks
Capture The Flag (CTF) PlatformsBug Bounty PracticeCloud Security
  • flAWS - AWS security challenges
  • flAWS2 - Advanced AWS scenarios
  • CloudGoat - Vulnerable AWS environments

​
Security Tools

​
Web Application Scanners

OWASP ZAP

Free & Open Source
  • Automated vulnerability scanning
  • Manual testing proxy
  • API testing support
  • Browser integration
Download ZAP

Burp Suite

Industry Standard
  • Intercepting proxy
  • Advanced scanner (Pro)
  • Extensive extensions
  • Collaboration features
Get Burp

Nikto

Web Server Scanner
  • 6,700+ dangerous files/CGIs
  • Server configuration issues
  • Outdated software detection
  • Command-line interface
GitHub

sqlmap

SQL Injection Tool
  • Automated SQL injection
  • Database fingerprinting
  • Data extraction
  • Out-of-band techniques
sqlmap.org

​
Specialized Testing Tools

SQL InjectionCross-Site Scripting (XSS)Command Injection
  • Commix - Command injection exploitation
Template Injection
  • tplmap - Server-side template injection
Password AttacksSession ManagementJWT Testing
API TestingMobile Application Security
  • MobSF - Mobile security framework
  • Frida - Dynamic instrumentation
  • Objection - Runtime mobile exploration
  • APKTool - Android APK reverse engineering

​
Learning Resources

​
Books

Web Application Security
  • The Web Application Hacker’s Handbook (2nd Ed) - Stuttard & Pinto
  • Real-World Bug Hunting - Peter Yaworski
  • Breaking into Information Security - Bryson Payne
  • Web Security for Developers - Malcolm McDonald
Secure Development
  • The Tangled Web - Michal Zalewski
  • Secure by Design - Johnsson, Deogun, Sawano
  • Iron-Clad Java - Manico & Detlefsen
  • Defensive Security Handbook - Jacobs & Rudis
Penetration Testing
  • The Hacker Playbook 3 - Peter Kim
  • Penetration Testing - Georgia Weidman
  • Metasploit: The Penetration Tester’s Guide - Kennedy et al.
  • RTFM: Red Team Field Manual - Ben Clark
Cryptography
  • Serious Cryptography - Jean-Philippe Aumasson
  • Cryptography Engineering - Ferguson, Schneier, Kohno

​
Online Courses

Free CoursesPaid PlatformsUniversity Courses (Free)

​
Video Content

YouTube ChannelsSecurity Conferences

​
Communities & Forums

Reddit

Subreddits
  • r/netsec - Network security news
  • r/websecurity - Web app security
  • r/AskNetsec - Security questions
  • r/bugbounty - Bug bounty hunters

Discord & Slack

Communities
  • OWASP Slack
  • Bug Bounty Forum Discord
  • HackTheBox Discord
  • TryHackMe Discord

Twitter/X

Security Researchers
  • @OWASP
  • @naglinagli
  • @hakluke
  • @bugcrowd

Forums

Discussion Boards

​
Blogs & News

​
Security Blogs

​
News Aggregators

ResourceDescriptionLink
The Hacker NewsLatest cybersecurity newsthehackernews.com
Dark ReadingEnterprise security newsdarkreading.com
ThreatpostSecurity news and analysisthreatpost.com
Bleeping ComputerTech news and securitybleepingcomputer.com
/r/netsecCommunity-curated securityreddit.com/r/netsec

​
Python Security Libraries

​
Relevant to This Project

# Authentication & Password Management
from werkzeug.security import generate_password_hash, check_password_hash
import bcrypt
import argon2

# Input Validation & Sanitization
from markupsafe import escape, Markup
import bleach
import validators

# CSRF Protection
from flask_wtf.csrf import CSRFProtect

# Security Headers
from flask_talisman import Talisman
from flask_seasurf import SeaSurf

# Rate Limiting
from flask_limiter import Limiter

# SQL Safety
import sqlalchemy  # ORM with parameterized queries
from psycopg2 import sql  # PostgreSQL parameterization
Documentation:

​
Certifications

Vendor-Neutral
  • CompTIA Security+ - Foundation security concepts
  • CEH (Certified Ethical Hacker) - EC-Council
  • GIAC GSEC - SANS Security Essentials
Web-Focused
  • eWPT (eLearnSecurity Web Penetration Tester)
  • GWAPT (GIAC Web Application Penetration Tester)
Offensive Security
  • OSCP (Offensive Security Certified Professional) - Highly respected
  • OSWE (Offensive Security Web Expert) - Advanced web testing
  • OSCE (Offensive Security Certified Expert)
Defensive & Architecture
  • CISSP (Certified Information Systems Security Professional)
  • CSSLP (Certified Secure Software Lifecycle Professional)
  • GIAC GWAPT - Advanced web app penetration testing

​
Security Newsletters

Stay updated with weekly/monthly digests:

​
Responsible Disclosure

Always follow responsible disclosure practices:
  1. Only test on systems you own or have explicit permission to test
  2. Report vulnerabilities to the vendor/owner before public disclosure
  3. Allow reasonable time for patching (typically 90 days)
  4. Respect bug bounty program rules and scope
  5. Never exploit vulnerabilities for personal gain
  6. Comply with local laws and regulations (CFAA, Computer Misuse Act, etc.)
Disclosure Resources:

OWASP Top 10

See how this project maps to OWASP categories

CWE References

Detailed CWE mappings for each vulnerability

Vulnerabilities

Start learning with SQL Injection
This resource list is continuously updated. Bookmark this page and check back regularly for new tools, platforms, and learning materials.

Build docs developers (and LLMs) love

Get started for freeTalk to us