Tools

xalgord/massive-web-application-penetration-testing-bug-bounty-notes

A comprehensive guide for web application penetration testing and bug bounty hunting, covering methodologies, tools, and resources for identifying…

aktia1/megaquagga_pentesting_report

Web application penetration testing project targeting a WordPress environment. Includes exploitation of CVE-2019-9978, reverse shell execution,…

sobri3195/pegasus-pentest-arsenal

A comprehensive web application security testing toolkit that combines 10 powerful penetration testing features into one tool.

tombstoneghost/tiwap

Deliberately vulnerable Flask web application with 22 security flaws across 3 difficulty levels for hands-on penetration testing and web security…

juice-shop/juice-shop

Intentionally vulnerable web application covering OWASP Top 10 vulnerabilities for security training, CTF competitions, and penetration testing…

effortlessdevsec/ninjasworkout

Deliberately vulnerable Node.js web application containing 19+ security bugs (XSS, SSRF, Prototype Pollution, RCE) for hands-on penetration testing…

arpit-bansal15/cve-2026-48282-pentest-lab

Hands-on penetration testing lab environment for CVE-2026-48282, designed for practicing exploitation and vulnerability analysis in a controlled web…

owasp/vulnerable-web-application

OWASP Vulnerable Web Application Project https://github.com/hummingbirdscyber

pannagkumaar/pentest-lab

Modern cyber range with 50 hands-on challenges across web, API, cloud, AI, and blue-team security tracks. Features guided attack chains, transparent…

tanprathan/mobileapp-pentest-cheatsheet

The Mobile App Pentest cheat sheet was created to provide concise collection of high value information on specific mobile application penetration…

corazawaf/coraza

Go-based Web Application Firewall library compatible with ModSecurity SecLang rules and OWASP Core Rule Set v4, providing real-time HTTP traffic…

payatu/tiredful-api

An intentionally designed broken web application based on REST API.

matank001/moxy

Moxy is an open-source DAST tool designed for modern web application security testing. It provides an easy-to-use interface with agentic capabilities…

rootsecnz/htb-ctf-walkthroughs

Walkthroughs for Capture the Flag challenges on the HTB Cybersecurity Platform.

purpleteam-labs/purpleteam-s2-containers

Stage two containers

warxim/vucsa

Deliberately vulnerable client-server application for learning penetration testing of non-HTTP thick clients. Includes challenges for SQL injection,…

dockersecurityplayground/dsp

A Microservices-based framework for the study of Network Security and Penetration Test techniques

prateek147/dvia-v2

Damn Vulnerable iOS App (DVIA) is an iOS application that is damn vulnerable. Its main goal is to provide a platform to mobile security…