vuln-bank
commando-x/vuln-bankIntentionally vulnerable banking platform for practicing web application, API, and AI/LLM security testing, secure code review, and DevSecOps…
ai-securityapi-securitycode-analysis+5
933
commando-x/vuln-bankIntentionally vulnerable banking platform for practicing web application, API, and AI/LLM security testing, secure code review, and DevSecOps…
siriusscan/siriusOpen-source vulnerability scanner with automated network discovery, CVE-based detection, CVSS scoring, risk dashboards, remote agents via gRPC, and a…
janusec/janusecUnified application gateway providing reverse proxy, WAF, CC defense, OAuth2 authentication, ACME certificate automation, and GSLB for secure,…
jenish-sojitra/jsanalyzerBurp Suite extension for JavaScript static analysis: extracts API endpoints, URLs, secrets, and emails with noise filtering for web security testing.
lumoslab-innovation/openhunteraiLocal-first AI red team for web, API, and LLM application security. Attacker-style reasoning, evidence-backed findings, and skills for AI coding…
trailofbits/not-going-anywhereIntentionally vulnerable Golang programs exposing web, gRPC, and database/sql flaws for security training, vulnerability discovery, and remediation…
s4dhulabs/vimana-frameworkVimana is a modular security framework for auditing Python APIs and Web applications. The plugin-based architecture enables security professionals to…
p0pr0ck5/lua-ffi-libinjectionLuaJIT FFI bindings for libinjection, providing SQL injection and XSS detection with context-specific APIs for web application security.
zaproxy/zap-api-rustRust client library for the OWASP ZAP API, enabling programmatic access to web application security scanning, vulnerability detection, and proxy…
bsdrip/cve-2026-40179-pocMinimal Python PoC for CVE-2026-40179: injects a malicious metric name via unauthenticated Prometheus remote_write to trigger stored XSS in the web…
wadesweaponshed/checkpoint-cve-webscannerA web version of the bash scripts wrote for Check Point CVE-2026-50751 and CVE-2026-50752. This uses a local server to scan and make changes using…
check-risk-waf/check-risk-wafCloud-based Web Application Firewall (WAF) providing L3/L7 protection against SQLi, XSS, DDoS, and bot attacks. Features AI assistant, anti-bot…
roninforge/roninforge-honoCursor plugin for Hono v4 (TypeScript edge web framework). 59 LLM regressions with BAD/CORRECT pairs. Pinned to hono ^4.12.19 (>= 4.9.7 for…
pannagkumaar/pentest-labModern cyber range with 50 hands-on challenges across web, API, cloud, AI, and blue-team security tracks. Features guided attack chains, transparent…
shoucheng3/vert-x3__vertx-web_cve-2018-12542_3-5-3-cr1Exploit for CVE-2018-12542 in Vert.x-Web, a Java web framework. Demonstrates a path traversal vulnerability allowing unauthorized access to static…
shoucheng3/esapi__esapi-java-legacy_cve-2022-23457_2-2-3-1Enterprise Security API library providing security controls for Java web applications, including authentication, access control, input validation,…
shoucheng3/esapi__esapi-java-legacy_cve-2022-24891_2-2-3-1OWASP Enterprise Security API library providing security controls for Java web applications, including authentication, access control, input…
shoucheng3/apache__sling-org-apache-sling-xss_cve-2016-5394_1-0-8Java library providing XSS escaping and filtering services (XSSAPI, XSSFilter) to sanitize user-submitted content and prevent cross-site scripting…