awesome-web3-security

Eine kuratierte Liste von Web3-Sicherheitsmaterialien und -ressourcen für Pentester und Bug Hunter.

If you find that some links are not working, you can simply replace the username with gmh5225. 
Or you can send an issue for me.

Zollt allen unten aufgeführten Projekten Respekt, perfekte Kunstwerke 🫡

Wie kann man beitragen?

• https://github.com/HyunCafe/contribute-practice
• https://docs.github.com/en/get-started/quickstart/contributing-to-projects

Skills für KI-Agenten

Dieses Repository bietet Skills, die mit KI-Agenten und Coding-Assistenten wie Cursor, OpenClaw, Claude Code, Codex CLI und anderen kompatiblen Tools verwendet werden können. Installiere Skills, um spezialisiertes Wissen über Web3-Sicherheitsthemen zu erhalten.

Auf learn-skills.dev ansehen

Installation:

npx skills add https://github.com/gmh5225/awesome-web3-security --skill <skill-name>

Verfügbare Skills:

Skill	Beschreibung
mev-security	MEV-Konzepte, gängige Angriffe und Gegenmaßnahmen
awesome-web3-security-overview	Diese Ressourcenliste verstehen und zu ihr beitragen
smart-contract-security	EVM/Solidity Smart-Contract-Sicherheit
solana-security	Solana/Sealevel Sicherheitsforschung
web3-security-tooling	Sicherheits-Tooling (Analyzer, Fuzzer, Decompiler)
wallet-security	Wallet-Sicherheit (MPC/TSS, Schlüsselverwaltung, Phishing)

Beispiel:

# Install smart contract security skill
npx skills add https://github.com/gmh5225/awesome-web3-security --skill smart-contract-security

# Install multiple skills
npx skills add https://github.com/gmh5225/awesome-web3-security --skill solana-security --skill wallet-security

Security Starter Pack

• CTFs / Übung

  • https://capturetheether.com/ [Capture the Ether]
  • https://ethernaut.openzeppelin.com/ [The Ethernaut]
  • https://www.damnvulnerabledefi.xyz/ [Damn Vulnerable DeFi]
  • https://blockchain-ctf.securityinnovation.com/#/ [Security Innovation Blockchain CTF]
  • https://github.com/nccgroup/GOATCasino [GOAT Casino]
  • https://github.com/paradigm-operations/paradigm-ctf-2021 [Paradigm CTF]
  • https://github.com/blockthreat/blocksec-ctfs [Blocksec CTFs]
  • https://ciphershastra.com/ [ciphershastra CTF]
  • https://github.com/SunWeb3Sec/DeFiVulnLabs [DeFiVulnLabs]
  • https://quillctf.super.site/ [QuillCTF]
  • https://www.vulnmachines.com/ [Vulnmachines]
  • https://www.web3pwn.com/ [Web3Pwn]

• Testnets / Faucets

  • https://sepolia.dev/ [Sepolia Resources]
  • https://faucet.circle.com/ [Circle Faucet (Sepolia USDC)]

• Mindmaps

  • https://www.xmind.net/m/2zbPP7/ [Common Vulnerabilities MindMap]
  • https://coggle.it/diagram/YqLzaiSABzXD4UnZ/t/smart-contract-auditor [Auditor MindMap]
  • https://xmind.works/share/zfdeD07U [Tools MindMap]

• Starter-Tools

  • https://github.com/Quillhash/Web3-Security-Tools [Web3-Security-Tools]
  • https://remix-project.org/ [Remix]

• Blogs / Postmortems

  • https://medium.com/immunefi [Immunefi]
  • https://blog.openzeppelin.com/security-audits/ [OpenZeppelin]
  • https://quillaudits.medium.com/ [QuillAudits]
  • https://blog.solidityscan.com/ [SolidityScan]
  • https://medium.com/@Beosin_com [Beosin]
  • https://neptunemutual.medium.com/ [Neptune Mutual]
  • https://blocksecteam.medium.com/ [BlockSec]
  • https://www.certik.com/resources/blog [CertiK]
  • https://mouse-run.beehiiv.com [mouse-run]

• Bug Bounties

  • https://immunefi.com/ [Immunefi]
  • https://hackenproof.com/programs [HackenProof]
  • https://code4rena.com/ [Code4rena]
  • https://gitcoin.co/explorer [Gitcoin]
  • https://hackerone.com [HackerOne]
  • https://spearbit.com/ [Spearbit]
  • https://app.sherlock.xyz/ [Sherlock]
  • https://audits.sherlock.xyz/contests [Sherlock Contests]
  • https://saloon.finance/ [The Saloon]
  • https://hats.finance/ [Hats Finance]
  • https://secure3.io/ [Secure3]
  • https://app.secure3.io/ [Secure3 Contests]
  • https://securr.tech/ [Securr]
  • https://r.xyz/ [Remedy]
  • https://hunt.r.xyz/ [Remedy Hunt]
  • https://www.vigilseek.com/bug-bounty [Vigilseek (Bug Bounty Aggregator)]
  • https://cantina.xyz/ [Cantina]

• Newsletter / Sammlungen

  • https://newsletter.blockthreat.io/ [BlockThreat]
  • https://rekt.news/ [REKT]
  • https://weekinethereumnews.com/ [Week in Ethereum News]
  • https://quillaudits.substack.com/ [HashingBits]
  • https://web3sec.news [Web3sec.news]

• Vorträge / Videos

  • https://www.youtube.com/watch?v=lJQwuyW4t-k [IWCON-S22]
  • http://www.youtube.com/watch?v=P8LXLoTUJ5g [LiveOverflow]
  • https://www.youtube.com/watch?v=zcJmWr5_GOc [Web3 Security Mindset]
  • https://www.youtube.com/watch?v=QSmtVR0aniI [Security and Vulnerabilities in Web3]
  • https://www.youtube.com/playlist?list=PLox242_JhiuEe64LzW1M8XpiQ2-N5bZsX [Playlist]
  • https://www.youtube.com/watch?v=A5s9aez43Co&list=PLO5VPQH6OWdXKPThrch6U0imGdD3pHLXi [Damn Vulnerable DeFi CTF]
  • https://www.youtube.com/watch?v=cOP9z9XWjwc [Attacking Authorization]
  • https://www.youtube.com/watch?v=TmZ8gH-toX0 [Audit a Smart Contract]
  • https://www.youtube.com/watch?v=gyMwXuJrbJQ [32-Hour Course]

• Solidity lernen

  • https://cryptozombies.io/ [CryptoZombies]
  • https://www.learnweb3.io/ [LearnWeb3]
  • https://www.smartcontract.engineer/ [Smart Contract Engineer]
  • https://solidity-by-example.org/ [Solidity by Example]
  • https://www.web3.university/ [Web3 University]
  • https://www.useweb3.xyz/ [useWeb3]

• Audit-Berichte

  • https://github.com/chainsulting/Smart-Contract-Security-Audits [Chainsulting]
  • https://code4rena.com/reports [Code4rena Reports]
  • https://consensys.net/diligence/audits/ [Consensys]
  • https://github.com/Quillhash/QuillAudit_Reports [QuillAudits]
  • https://github.com/spearbit/portfolio/tree/master/pdfs [Spearbit]
  • https://github.com/sherlock-protocol/sherlock-reports [Sherlock]
  • https://github.com/0xNazgul/Blockchain-Security-Audit-List [Audit List]
  • https://github.com/shieldify-security/audits-portfolio [Shieldify]

• Zertifizierungen

  • https://secops.group/certified-blockchain-practitioner [CBP]
  • https://blockchaintrainingalliance.com/products/cbsp [CBSP]