This repository is a comprehensive knowledge base for web security, covering vulnerability exploitation, penetration testing, and code audit techniques. It is organized into three main directories: 'exp/' for exploit techniques, 'vul/' for vulnerability principles, and 'penetration/' for penetration testing procedures. The content is detailed, well-structured, and includes practical payloads, detection methods, and defense strategies. It also features an AI/Wiki index for efficient retrieval. While not a software application, it serves as an invaluable reference for security professionals, CTF players, and red teamers. The only executable component is a Python script for log tampering.
Loofah is a Ruby library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. In production it functions primarily as the HTML sanitization engine behind Rails (via rails-html-sanitizer) and countless other Ruby web applications: it parses untrusted user-supplied HTML and scrubs out unsafe tags, attributes, URLs, CSS properties, and protocols while preserving safe markup. The library combines a general-purpose transformation framework (custom 'scrubbers') with a specific html5lib-derived sanitizer safelist covering HTML, MathML, and SVG elements, ARIA attributes, CSS properties/functions, and URI protocols. The codebase deliberately supports both HTML4 (libxml2) and HTML5 (gumbo) parsing paths, and is the de facto standard for server-side HTML sanitization in the Ruby ecosystem.
Liffy is a comprehensive Local File Inclusion (LFI) exploitation tool designed for security testing and penetration testing. It provides a modular command-line interface that supports multiple LFI techniques including data://, expect://, input://, filter:// wrappers, log poisoning, null byte attacks, ZIP wrapper exploitation, and blind LFI detection. The tool features advanced capabilities such as WAF bypass techniques, encoding layers, multi-threading with rate limiting, custom headers, POST request support, and rich terminal output. Architecture follows a modular design with core techniques isolated in separate modules, coordinated by a main orchestrator (liffy.py) that handles argument parsing, configuration loading, and execution management.
The OWASP Web Security Testing Guide (WSTG) is a comprehensive, community-maintained documentation project defining standard test cases for web application security assessments. It is primarily a structured knowledge base written in Markdown, organized by testing categories including Information Gathering, Authentication, Injection, and API Testing. The repository also serves as the source for multiple derived artifacts: a Jekyll static website (wstg.owasp.org), downloadable PDF/EPUB ebooks via a Pandoc+Typst pipeline, and machine-readable test checklists in JSON, XLSX, and Markdown formats. The build infrastructure includes Python scripts for site generation and navigation, GitHub Actions for CI/CD (linting, link checking, deployment), and a versioned release process that supports multiple channels (latest, stable, past versions). Although the primary content is documentation, the repository functions as a publication platform with significant automation and is actively maintained by a community of contributors. It is not a software application in the traditional sense, but the build tooling and CI/CD pipelines qualify it as an application-focused project with strong data engineering characteristics in its checklist generation and structured content management.
SiteEncrypt is an Elixir library that provides automated SSL/TLS certificate management for web applications through integration with Let's Encrypt. It handles the complete certificate lifecycle including automatic obtainment, renewal, and configuration of web servers to use the certificates. The library supports both the official Certbot client and a native Elixir ACME protocol implementation, with automatic renewal scheduling designed to prevent thundering herd problems on certificate authorities. It integrates specifically with the Phoenix web framework but can work with other Erlang-based web servers through its adapter pattern.
PayloadsAllTheThings is a curated knowledge base of web application security payloads, bypass techniques, and exploitation methodologies. It is organized by vulnerability type (e.g., SQL Injection, XSS, SSRF, SSTI, File Inclusion) with each category containing a README.md explaining the technique, references to original research, and subdirectories for payload wordlists (Intruder/), exploit scripts (Files/), and diagrams (Images/). The repository also includes methodology guides for Active Directory, cloud pentesting, and privilege escalation. While primarily a static reference, it contains hundreds of standalone exploit scripts (Python, PHP, Ruby, shell) and configuration files (e.g., .htaccess, web.config) that can be directly reused in penetration testing engagements. The content is actively maintained with recent commits and CI/CD workflows, though some payloads reference older CVEs and may require adaptation for modern environments. This is a hybrid resource: a research-oriented payload collection with embedded executable components.
This repository provides a comprehensive Nginx security configuration package to block malicious bots, spam referrers, bad IPs, and vulnerability scanners. It includes curated blocklists (bad user agents, referrers, IPs, fake Googlebots), rate limiting/DDoS protection, and optional fail2ban integration. The core deliverable is a set of modular Nginx include files (bots.d/, conf.d/) and shell scripts (install-ngxblocker, setup-ngxblocker, update-ngxblocker) for automated deployment and daily updates. It also generates Google Analytics ghost spam exclusion lists and a Google Search Console disavow file. The architecture is a collection of configuration templates and deployment tooling, not a standalone application; it is designed to be included into existing Nginx server blocks. The repository is actively maintained with frequent updates to blocklists and CI testing across multiple Linux distributions.
@fastify/cookie is a Fastify plugin that adds cookie handling capabilities to Fastify applications. It provides automatic parsing of incoming cookies via Fastify hooks and methods to set, clear, and sign cookies on responses. The plugin integrates with Fastify's lifecycle through decorators and hooks, supporting various hook points for cookie parsing (onRequest, preParsing, etc.). It includes robust security features like cookie signing with HMAC, key rotation support, and protection against timing attacks. The implementation follows Fastify plugin best practices and provides both high-level convenience methods and low-level utilities for direct use.
This repository is an AI skill/prompt library for coding assistants (Claude, Cursor, GitHub Copilot, etc.). It contains a comprehensive security-focused markdown guide (SKILL.md) that AI assistants reference when generating code to ensure secure coding practices. The skill covers 60+ security vulnerabilities including IDOR, XSS, CSRF, SSRF, SQL injection, JWT misconfigurations, and more. It's designed to be installed in AI assistant skill directories to provide real-time security guidance during code generation. The repository has minimal structure - just three files (LICENSE, README.md, SKILL.md) with no traditional software components like tests, CI/CD, or package management. This is appropriate for its purpose as a static documentation resource for AI assistants. The security guidance is comprehensive and well-organized, covering both prevention strategies and common bypass techniques attackers use. Note: The last commit date (2026-02-17) appears to be in the future, which is unusual. The repository has 0 open issues and 94 forks, suggesting active adoption despite the odd timestamp.
Pikachu is a deliberately vulnerable web application built as a training ground for web penetration testing, covering common security flaws such as SQL injection, XSS, CSRF, RCE, file inclusion, unsafe file upload/download, SSRF, XXE, and deserialization. It is a LAMP stack (PHP + MySQL + Apache) monolith using a legacy Ace Admin template and Bootstrap 3. The codebase is organized into vulnerability categories under `/vul/`, a main application for navigation and configuration, and a separate XSS management backend (`/pkxss/`) for collecting stolen cookies, phishing credentials, and keystrokes. The project intentionally uses insecure coding patterns (e.g., raw SQL concatenation, `eval()`, `unserialize()` on user input) to demonstrate exploitation, and includes some secure alternatives for comparison. The repository is explicitly marked as 'asleep' by its authors, who recommend a successor project. It is not suitable for production deployment but serves as a valuable educational resource for security students and CTF players.
This repository serves as a technical deep-dive into Google's reCAPTCHA system, particularly focusing on its obfuscation techniques, fingerprinting mechanisms, and anti-tampering measures. It includes extracted JavaScript snippets that implement specific browser fingerprinting signals (e.g., storage access checks, window opener properties, WebGL data extraction) and JSON files containing example fingerprint data. The repository also contains analysis of the now-removed BotGuard component, including its obfuscated virtual machine implementations. While the subject matter is largely historical due to the removal of BotGuard in April 2026, the repository provides valuable insights into the techniques used by advanced anti-bot systems.
This repository is a curated cheat sheet for web application security testing, penetration testing, and bug bounty hunting. It aggregates a vast collection of tools, commands, URLs, and references organized by phases: discovering, enumerating, scanning, monitoring, attacking, manual exploitation, and AI-related security. The repo contains no application code; it is a markdown document only. It is a valuable reference for security professionals but lacks any executable software components or data pipelines. The information is comprehensive and well-structured, but the repository itself is not a functional system and does not demonstrate software architecture or engineering craftsmanship beyond content curation.