@harrisonqian / Awesome › wiki / security / application-security
Public View

Application Security

repo: paragonie/awesome-appsec
category: Security related: CTF · Hacking · Malware Analysis

Awesome AppSec Awesome

A curated list of resources for learning about application security. Contains books, websites, blog posts, and self-assessment quizzes.

Maintained by Paragon Initiative Enterprises with contributions from the application security and developer communities. We also have other community projects which might be useful for tomorrow's application security experts.

If you are an absolute beginner to the topic of software security, you may benefit from reading A Gentle Introduction to Application Security.

Contributing

Please refer to the contributing guide for details.

Application Security Learning Resources

General

Articles

How to Safely Generate a Random Number (2014)

Released: February 25, 2014

Advice on cryptographically secure pseudo-random number generators.

Salted Password Hashing - Doing it Right (2014)

Released: August 6, 2014

A post on Crackstation, a project by Defuse Security

A good idea with bad usage: /dev/urandom (2014)

Released: May 3, 2014

Mentions many ways to make /dev/urandom fail on Linux/BSD.

Why Invest in Application Security? (2015)

Released: June 21, 2015

Running a business requires being cost-conscious and minimizing unnecessary spending. The benefits of ensuring in the security of your application are invisible to most companies, so often times they neglect to invest in secure software development as a cost-saving measure. What these companies don't realize is the potential cost (both financial and to brand reputation) a preventable data compromise can incur.

The average data breach costs millions of dollars in damage.

Investing more time and personnel to develop secure software is, for most companies, worth it to minimize this unnecessary risk to their bottom line.

Be wary of one-time pads and other crypto unicorns (2015)

Released: March 25, 2015

A must-read for anyone looking to build their own cryptography features.

Books

nonfree Web Application Hacker's Handbook (2011)

Released: September 27, 2011

Great introduction to Web Application Security; though slightly dated.

nonfree Cryptography Engineering (2010)

Released: March 15, 2010

Develops a sense of professional paranoia while presenting crypto design techniques.

nonfree Securing DevOps (2018)

Released: March 1, 2018

Securing DevOps explores how the techniques of DevOps and Security should be applied together to make cloud services safer. This introductory book reviews state of the art practices used in securing web applications and their infrastructure, and teaches you techniques to integrate security directly into your product.

nonfree Gray Hat Python: Programming for Hackers and Reverse Engineers (2009)

Released: May 3, 2009

nonfree The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities (2006)

Released: November 30, 2006

nonfree C Interfaces and Implementations: Techniques for Creating Reusable Software (1996)

Released: August 30, 1996

nonfree Reversing: Secrets of Reverse Engineering (2005)

Released: April 15, 2005

nonfree JavaScript: The Good parts (2008)

Released: May 1, 2008

nonfree Windows Internals: Including Windows Server 2008 and Windows Vista, Fifth Edition (2007)

Released: June 17, 2007

nonfree The Mac Hacker's Handbook (2009)

Released: March 3, 2009

Released: August 22, 2008

nonfree Internetworking with TCP/IP Vol. II: ANSI C Version: Design, Implementation, and Internals (3rd Edition) (1998)

Released: June 25, 1998

nonfree Network Algorithmics,: An Interdisciplinary Approach to Designing Fast Networked Devices (2004)

Released: December 29, 2004

nonfree Computation Structures (MIT Electrical Engineering and Computer Science) (1989)

Released: December 13, 1989

nonfree Surreptitious Software: Obfuscation, Watermarking, and Tamperproofing for Software Protection (2009)

Released: August 3, 2009

Secure Programming HOWTO (2015)

Released: March 1, 2015

Security Engineering - Third Edition (2020)

Released: November 1, 2020

nonfree Bulletproof SSL and TLS (2014)

Released: August 1, 2014

Holistic Info-Sec for Web Developers (Fascicle 0) (2016)

Released: September 17, 2016

The first part of a three part book series providing broad and in-depth coverage on what web developers and architects need to know in order to create robust, reliable, maintainable and secure software, networks and other, that are delivered continuously, on time, with no nasty surprises.

Holistic Info-Sec for Web Developers (Fascicle 1)

The second part of a three part book series providing broad and in-depth coverage on what web developers and architects need to know in order to create robust, reliable, maintainable and secure software, VPS, networks, cloud and web applications, that are delivered continuously, on time, with no nasty surprises.

Classes

Offensive Computer Security (CIS 4930) FSU

A vulnerability research and exploit development class by Owen Redwood of Florida State University.

Be sure to check out the lectures!

Hack Night

Developed from the materials of NYU Poly's old Penetration Testing and Vulnerability Analysis course, Hack Night is a sobering introduction to offensive security. A lot of complex technical content is covered very quickly as students are introduced to a wide variety of complex and immersive topics over thirteen weeks.

Websites

Hack This Site!

Learn about application security by attempting to hack this website.

Enigma Group

Where hackers and security experts come to train.

Web App Sec Quiz

Self-assessment quiz for web application security

SecurePasswords.info

Secure passwords in several languages/frameworks.

Security News Feeds Cheat-Sheet

A list of security news sources.

Open Security Training

Video courses on low-level x86 programming, hacking, and forensics.

MicroCorruption

Capture The Flag - Learn Assembly and Embedded Device Security

The Matasano Crypto Challenges

A series of programming exercises for teaching oneself cryptography by Matasano Security. The introduction by Maciej Ceglowski explains it well.

PentesterLab

PentesterLab provides free Hands-On exercises and a bootcamp to get started.

Juice Shop

An intentionally insecure Javascript Web Application.

Supercar Showdown

How to go on the offence before online attackers do.

OWASP NodeGoat

Purposly vulnerable to the OWASP Top 10 Node.JS web application, with tutorials, security regression testing with the OWASP Zap API, docker image. With several options to get up and running fast.

Securing The Stack

Bi-Weekly Appsec Tutorials

OWASP ServerlessGoat

OWASP ServerlessGoat is a deliberately insecure realistic AWS Lambda serverless application, maintained by OWASP and created by PureSec. You can install WebGoat, learn about the vulnerabilities, how to exploit them, and how to remediate each issue. The project also includes documentation explaining the issues and how they should be remediated with best-practices.

SecDim

SecDim is an appsec edutainment platform, Learn appsec with free git based labs. Think you got what it takes to build a secure app? Challenge yourself with appsec games! Fix bugs, get a score and your name on the leaderboards.

Blogs

Crypto Fails

Showcasing bad cryptography

NCC Group - Blog

The blog of NCC Group, formerly Matasano, iSEC Partners, and NGS Secure.

Scott Helme

Learn about security and performance.

Cossack Labs blog (2018)

Released: July 30, 2018

Blog of cryptographic company that makes open-source libraries and tools, and describes practical data security approaches for applications and infrastructures.

Wiki pages

OWASP Top Ten Project

The top ten most common and critical security vulnerabilities found in web applications.

Tools

Qualys SSL Labs

The infamous suite of SSL and TLS tools.

securityheaders.io

Quickly and easily assess the security of your HTTP response headers.

report-uri.io

A free CSP and HPKP reporting service.

clickjacker.io

Test and learn Clickjacking. Make clickjacking PoC, take screenshot and share link. You can test HTTPS, HTTP, intranet & internal sites.

AWS Lambda

Tools

PureSec FunctionShield

FunctionShield is a 100% free AWS Lambda security and Google Cloud Functions security library that equips developers with the ability to easily enforce strict security controls on serverless runtimes.

Android

Books and ebooks

SEI CERT Android Secure Coding Standard (2015)

Released: February 24, 2015

A community-maintained Wiki detailing secure coding standards for Android development.

C

Books and ebooks

SEI CERT C Coding Standard (2006)

Released: May 24, 2006

A community-maintained Wiki detailing secure coding standards for C programming.

Defensive Coding: A Guide to Improving Software Security by the Fedora Security Team (2025)

Released: February 22, 2025

Provides guidelines for improving software security through secure coding. Covers common programming languages and libraries, and focuses on concrete recommendations.

C++

Books and ebooks

SEI CERT C++ Coding Standard (2006)

Released: July 18, 2006

A community-maintained Wiki detailing secure coding standards for C++ programming.

C Sharp

Books and ebooks

nonfree Security Driven .NET (2015)

Released: July 14, 2015

An introduction to developing secure applications targeting version 4.5 of the .NET Framework, specifically covering cryptography and security engineering topics.

Clojure

Repositories

Clojure OWASP (2020)

Released: May 5, 2020

Repository with Clojure examples of OWASP top 10 vulnerabilities.

Go

Articles

Memory Security in Go - spacetime.dev (2017)

Released: August 3, 2017

A guide to managing sensitive data in memory.

Java

Books and ebooks

SEI CERT Java Coding Standard (2007)

Released: January 12, 2007

A community-maintained Wiki detailing secure coding standards for Java programming.

Secure Coding Guidelines for Java SE (2014)

Released: April 2, 2014

Secure Java programming guidelines straight from Oracle.

Node.js

Articles

Node.js Security Checklist - Rising Stack Blog (2015)

Released: October 13, 2015

truncated — full list on GitHub

[[curator]]
I'm the Curator. I can help you navigate, organize, and curate this wiki. What would you like to do?