Latest additions
RSS feed Submit a resource All recent additions →- AuthZThe Green Agent POV: Formulating the Fix for an Exposed Container with Sensitive Data Accesswiz.io
- Bug BountyChoosing the best Bug Bounty platform for financial institutions to support DORA complianceyeswehack.com
- AuthNA Valid Signature Isn’t Enough: Attributing and Validating Leaked JWTsblog.gitguardian.com
- Secretswfx-loot: A CI Secret Stealer Pushed With Stolen GitHub Credentialsblog.gitguardian.com
- SecretsWFX Phantom: The GitHub Actions Secret Stealer That Deletes Its Tracksstepsecurity.io
- MobileMobShield: open-source RASP for Android and iOSappsecnews.com
- Supply ChainMCP Server Version Pinning: Why a Pinned MCP Server Can Still Run New Codemedium.com
- Supply ChainPin your GitHub Actions by commit SHA and lock workflow permissionsmedium.com
In-depth guides
All 25 guides →Browse by topic
Explore the graph →Access Control
Insecure Direct Object Reference (IDOR)
161 resources+30 this week
Occurs when an application exposes a reference to an internal implementation object, revealing the real identifier and format/pattern used of the element in the storage backend side.
via OWASPInjection
Cross-Site Scripting (XSS)
456 resources+37 this week
Attacks in which malicious scripts are injected into otherwise benign and trusted websites. Occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.
via OWASPEmerging
AI Security
853 resources+70 this week
Protecting AI systems from threats such as data poisoning, model inversion, and adversarial attacks. Also covers using AI to enhance cybersecurity by identifying malicious patterns and automating responses.
Injection
XML External Entity Processing (XXE)
139 resources+33 this week
An attack against applications that parse XML input. When XML containing an external entity reference is processed by a weakly configured parser, it can lead to data disclosure, SSRF, DoS, and more.
via OWASPInjection
Server-Side Request Forgery (SSRF)
1158 resources+36 this week
An attacker abuses server functionality to read or update internal resources by supplying or modifying URLs, potentially accessing AWS metadata, internal services, or databases not meant to be exposed.
via OWASPInjection
SQL Injection (SQLi)
221 resources+37 this week
Insertion or "injection" of a SQL query via client-supplied input. A successful exploit can read sensitive data, modify database data, execute admin operations, or in some cases issue OS commands.
via OWASPClient-Side
Cross-Site Request Forgery (CSRF)
128 resources+30 this week
Forces an authenticated end user to execute unwanted actions on a web application. Targets state-changing requests rather than data theft, typically executed via social engineering.
via OWASPReconnaissance
Open-Source Intelligence (OSINT)
186 resources+31 this week
Data collected from publicly available sources for use in an intelligence context. "Open" refers to overt, publicly available sources — not open-source software or collective intelligence.
via WikipediaLanguage
Python Security
314 resources+50 this week
Security-focused Python resources covering common vulnerabilities, secure coding patterns, dangerous modules, deserialization risks, and tooling for building security automation. Possible other cool Python topics, too.
via Python.orgTooling
Burp Suite
240 resources+34 this week
The industry-standard web proxy and vulnerability scanner from PortSwigger. Essential for manual web application testing, with an extensive extension ecosystem for custom workflows.
via PortSwiggerExploitation
Remote Code Execution (RCE)
976 resources+68 this week
An attacker's ability to execute arbitrary commands or code on a target machine or in a target process. Often the end goal of chained vulnerability exploits in web applications.
via WikipediaPrograms
Bug Bounty Programs
528 resources+57 this week
Programs offered by organizations by which individuals receive recognition and compensation for reporting bugs, especially those pertaining to exploits and vulnerabilities.
via WikipediaLearning
Security Talks & Presentations
135 resources+27 this week
Curated conference talks and presentations from DEF CON, Black Hat, OWASP AppSec, BSides events, and other security conferences worth watching.
Reconnaissance
Reconnaissance (Recon)
291 resources+33 this week
Techniques and tools for security reconnaissance — asset discovery, subdomain enumeration, port scanning, fingerprinting, and building a comprehensive attack surface map.
Testing
Fuzzing
173 resources+31 this week
An automated software testing technique that injects invalid, malformed, or unexpected inputs into a system to reveal software defects and vulnerabilities not caught by conventional testing.
API Security
GraphQL Security
166 resources+32 this week
GraphQL's flexible query model introduces unique attack surface — introspection abuse, batching attacks, deep query DoS, and authorization bypass via nested resolvers.
via graphql.orgAccess Control
Authorization / Broken Access Control
377 resources+59 this week
Missing or flawed authorization checks that allow users to escalate privileges, access other accounts, or perform restricted actions through parameter tampering, forced browsing, or JWT manipulation.
via OWASPAPI Security
API Security
412 resources+55 this week
Securing REST, GraphQL, gRPC, and WebSocket APIs against BOLA, mass assignment, excessive data exposure, and the OWASP API Security Top 10 risks that plague modern API-first architectures.
via OWASPMobile
Mobile Security
230 resources+34 this week
iOS and Android application security — insecure data storage, certificate pinning bypass, binary reverse engineering, dynamic instrumentation with Frida, and the OWASP Mobile Top 10.
via OWASPSupply Chain
Supply Chain Security
864 resources+38 this week
Threats targeting dependencies, build systems, and distribution channels — dependency confusion, typosquatting, compromised packages, and defenses like SBOMs, SLSA, and dependency scanning.
Credential Security
Secrets & Credential Leaks
356 resources+47 this week
Detecting and preventing exposed API keys, database passwords, and cloud credentials in source code, CI/CD configs, and container images using TruffleHog, GitLeaks, and vault solutions.
Exploitation
Insecure Deserialization
156 resources+31 this week
Exploiting unsafe object deserialization in Java, PHP, Python, .NET, and Ruby — gadget chains, ysoserial payloads, and the path from serialized data to remote code execution.
via OWASPIdentity
Authentication
364 resources+65 this week
Verifying user identity through passwords, tokens, certificates, and federated protocols — covering OAuth, SAML, MFA bypasses, session handling, and the move toward passkeys.
via OWASPTokens
JSON Web Tokens (JWT)
176 resources+37 this week
Stateless tokens widely used for authentication, with a long history of implementation flaws including algorithm confusion, kid injection, weak HMAC secrets, and the infamous "none" algorithm bypass.
via OWASPInjection
Server-Side Template Injection (SSTI)
148 resources+27 this week
Injection into server-rendered templates — Jinja2, Twig, Freemarker, Velocity — that frequently escalates to remote code execution through expression evaluation and sandbox escapes.
via PortSwiggerWeekly AppSec Digest
Get new resources delivered every Monday.