`awesome-web3-security`

Кураторский список материалов и ресурсов по безопасности Web3 для пентестеров и баг-хантеров.

If you find that some links are not working, you can simply replace the username with gmh5225. 
Or you can send an issue for me.

Относитесь с уважением ко всем проектам ниже, совершенным произведениям искусства 🫡

Как внести вклад?

Навыки для AI-агентов

Этот репозиторий предоставляет навыки, которые можно использовать с AI-агентами и ассистентами по программированию, такими как Cursor, OpenClaw, Claude Code, Codex CLI, и другими совместимыми инструментами. Установите навыки, чтобы получить специализированные знания по темам безопасности Web3.

Посмотреть на learn-skills.dev

Установка:

npx skills add https://github.com/gmh5225/awesome-web3-security --skill <skill-name>

Доступные навыки:

Навык	Описание
`mev-security`	Концепции MEV, распространённые атаки и методы защиты
`awesome-web3-security-overview`	Понимание и участие в этом списке ресурсов
`smart-contract-security`	Безопасность смарт-контрактов EVM/Solidity
`solana-security`	Исследование безопасности Solana/Sealevel
`web3-security-tooling`	Инструменты безопасности (анализаторы, фаззеры, декомпиляторы)
`wallet-security`	Безопасность кошельков (MPC/TSS, управление ключами, фишинг)

Пример:

# Install smart contract security skill
npx skills add https://github.com/gmh5225/awesome-web3-security --skill smart-contract-security

# Install multiple skills
npx skills add https://github.com/gmh5225/awesome-web3-security --skill solana-security --skill wallet-security

Security Starter Pack

CTF / Практика
- https://capturetheether.com/ [Capture the Ether]
- https://ethernaut.openzeppelin.com/ [The Ethernaut]
- https://www.damnvulnerabledefi.xyz/ [Damn Vulnerable DeFi]
- https://blockchain-ctf.securityinnovation.com/#/ [Security Innovation Blockchain CTF]
- https://github.com/nccgroup/GOATCasino [GOAT Casino]
- https://github.com/paradigm-operations/paradigm-ctf-2021 [Paradigm CTF]
- https://github.com/blockthreat/blocksec-ctfs [Blocksec CTFs]
- https://ciphershastra.com/ [ciphershastra CTF]
- https://github.com/SunWeb3Sec/DeFiVulnLabs [DeFiVulnLabs]
- https://quillctf.super.site/ [QuillCTF]
- https://www.vulnmachines.com/ [Vulnmachines]
- https://www.web3pwn.com/ [Web3Pwn]
Тестовые сети / Краны
- https://sepolia.dev/ [Sepolia Resources]
- https://faucet.circle.com/ [Circle Faucet (Sepolia USDC)]
Интеллект-карты
- https://www.xmind.net/m/2zbPP7/ [Common Vulnerabilities MindMap]
- https://coggle.it/diagram/YqLzaiSABzXD4UnZ/t/smart-contract-auditor [Auditor MindMap]
- https://xmind.works/share/zfdeD07U [Tools MindMap]
Начальные инструменты
- https://github.com/Quillhash/Web3-Security-Tools [Web3-Security-Tools]
- https://remix-project.org/ [Remix]
Блоги / Разборы инцидентов
- https://medium.com/immunefi [Immunefi]
- https://blog.openzeppelin.com/security-audits/ [OpenZeppelin]
- https://quillaudits.medium.com/ [QuillAudits]
- https://blog.solidityscan.com/ [SolidityScan]
- https://medium.com/@Beosin_com [Beosin]
- https://neptunemutual.medium.com/ [Neptune Mutual]
- https://blocksecteam.medium.com/ [BlockSec]
- https://www.certik.com/resources/blog [CertiK]
- https://mouse-run.beehiiv.com [mouse-run]
Bug Bounty
- https://immunefi.com/ [Immunefi]
- https://hackenproof.com/programs [HackenProof]
- https://code4rena.com/ [Code4rena]
- https://gitcoin.co/explorer [Gitcoin]
- https://hackerone.com [HackerOne]
- https://spearbit.com/ [Spearbit]
- https://app.sherlock.xyz/ [Sherlock]
- https://audits.sherlock.xyz/contests [Sherlock Contests]
- https://saloon.finance/ [The Saloon]
- https://hats.finance/ [Hats Finance]
- https://secure3.io/ [Secure3]
- https://app.secure3.io/ [Secure3 Contests]
- https://securr.tech/ [Securr]
- https://r.xyz/ [Remedy]
- https://hunt.r.xyz/ [Remedy Hunt]
- https://www.vigilseek.com/bug-bounty [Vigilseek (Bug Bounty Aggregator)]
- https://cantina.xyz/ [Cantina]
Рассылки / Коллекции
- https://newsletter.blockthreat.io/ [BlockThreat]
- https://rekt.news/ [REKT]
- https://weekinethereumnews.com/ [Week in Ethereum News]
- https://quillaudits.substack.com/ [HashingBits]
- https://web3sec.news [Web3sec.news]
Доклады / Видео
- https://www.youtube.com/watch?v=lJQwuyW4t-k [IWCON-S22]
- http://www.youtube.com/watch?v=P8LXLoTUJ5g [LiveOverflow]
- https://www.youtube.com/watch?v=zcJmWr5_GOc [Web3 Security Mindset]
- https://www.youtube.com/watch?v=QSmtVR0aniI [Security and Vulnerabilities in Web3]
- https://www.youtube.com/playlist?list=PLox242_JhiuEe64LzW1M8XpiQ2-N5bZsX [Playlist]
- https://www.youtube.com/watch?v=A5s9aez43Co&list=PLO5VPQH6OWdXKPThrch6U0imGdD3pHLXi [Damn Vulnerable DeFi CTF]
- https://www.youtube.com/watch?v=cOP9z9XWjwc [Attacking Authorization]
- https://www.youtube.com/watch?v=TmZ8gH-toX0 [Audit a Smart Contract]
- https://www.youtube.com/watch?v=gyMwXuJrbJQ [32-Hour Course]
Изучение Solidity
- https://cryptozombies.io/ [CryptoZombies]
- https://www.learnweb3.io/ [LearnWeb3]
- https://www.smartcontract.engineer/ [Smart Contract Engineer]
- https://solidity-by-example.org/ [Solidity by Example]
- https://www.web3.university/ [Web3 University]
- https://www.useweb3.xyz/ [useWeb3]
Отчёты об аудите
- https://github.com/chainsulting/Smart-Contract-Security-Audits [Chainsulting]
- https://code4rena.com/reports [Code4rena Reports]
- https://consensys.net/diligence/audits/ [Consensys]
- https://github.com/Quillhash/QuillAudit_Reports [QuillAudits]
- https://github.com/spearbit/portfolio/tree/master/pdfs [Spearbit]
- https://github.com/sherlock-protocol/sherlock-reports [Sherlock]
- https://github.com/0xNazgul/Blockchain-Security-Audit-List [Audit List]
- https://github.com/shieldify-security/audits-portfolio [Shieldify]
Сертификации
- https://secops.group/certified-blockchain-practitioner [CBP]
- https://blockchaintrainingalliance.com/products/cbsp [CBSP]

awesome-web3-security

Популярное

awesome-web3-security

Как внести вклад?

Навыки для AI-агентов

Security Starter Pack

`awesome-web3-security`