Latest additions
RSS feed Submit a resource All recent additions →- RCEScriptBlock Smuggling - AMSI Evasionipurple.team
- AuthNfast-jwt incomplete patch re-enables RSA to HS256 algorithm confusion (CVE-2026-107722)advisories.gitlab.com
- AuthNJWT vulnerabilities: how weak token validation still slips through in 2026djava.cc
- JWTMultiple vulnerabilities in lua-resty-jwtcybersecurity-help.cz
- AIAntiFox Targeting AWS Credentials: The Latest Wave of AI Agent Attacksblog.gitguardian.com
- AIA Clean Refusal Can Still Leak the Deploy Tokenmedium.com
- MobileThe Dead Keybox Economy: I Traced a “Pixel 10” Keybox Back to Its Sourceproandroiddev.com
- RCEGit fixes six vulnerabilities, including code execution during recursive cloneshelpnetsecurity.com
In-depth guides
All 25 guides →Browse by topic
Explore the graph →Access Control
Insecure Direct Object Reference (IDOR)
152 resources+31 this week
Occurs when an application exposes a reference to an internal implementation object, revealing the real identifier and format/pattern used of the element in the storage backend side.
via OWASPInjection
Cross-Site Scripting (XSS)
445 resources+35 this week
Attacks in which malicious scripts are injected into otherwise benign and trusted websites. Occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.
via OWASPEmerging
AI Security
838 resources+84 this week
Protecting AI systems from threats such as data poisoning, model inversion, and adversarial attacks. Also covers using AI to enhance cybersecurity by identifying malicious patterns and automating responses.
Injection
XML External Entity Processing (XXE)
129 resources+35 this week
An attack against applications that parse XML input. When XML containing an external entity reference is processed by a weakly configured parser, it can lead to data disclosure, SSRF, DoS, and more.
via OWASPInjection
Server-Side Request Forgery (SSRF)
1146 resources+33 this week
An attacker abuses server functionality to read or update internal resources by supplying or modifying URLs, potentially accessing AWS metadata, internal services, or databases not meant to be exposed.
via OWASPInjection
SQL Injection (SQLi)
210 resources+38 this week
Insertion or "injection" of a SQL query via client-supplied input. A successful exploit can read sensitive data, modify database data, execute admin operations, or in some cases issue OS commands.
via OWASPClient-Side
Cross-Site Request Forgery (CSRF)
118 resources+27 this week
Forces an authenticated end user to execute unwanted actions on a web application. Targets state-changing requests rather than data theft, typically executed via social engineering.
via OWASPReconnaissance
Open-Source Intelligence (OSINT)
177 resources+29 this week
Data collected from publicly available sources for use in an intelligence context. "Open" refers to overt, publicly available sources — not open-source software or collective intelligence.
via WikipediaLanguage
Python Security
301 resources+55 this week
Security-focused Python resources covering common vulnerabilities, secure coding patterns, dangerous modules, deserialization risks, and tooling for building security automation. Possible other cool Python topics, too.
via Python.orgTooling
Burp Suite
232 resources+34 this week
The industry-standard web proxy and vulnerability scanner from PortSwigger. Essential for manual web application testing, with an extensive extension ecosystem for custom workflows.
via PortSwiggerExploitation
Remote Code Execution (RCE)
959 resources+78 this week
An attacker's ability to execute arbitrary commands or code on a target machine or in a target process. Often the end goal of chained vulnerability exploits in web applications.
via WikipediaPrograms
Bug Bounty Programs
511 resources+69 this week
Programs offered by organizations by which individuals receive recognition and compensation for reporting bugs, especially those pertaining to exploits and vulnerabilities.
via WikipediaLearning
Security Talks & Presentations
130 resources+32 this week
Curated conference talks and presentations from DEF CON, Black Hat, OWASP AppSec, BSides events, and other security conferences worth watching.
Reconnaissance
Reconnaissance (Recon)
284 resources+35 this week
Techniques and tools for security reconnaissance — asset discovery, subdomain enumeration, port scanning, fingerprinting, and building a comprehensive attack surface map.
Testing
Fuzzing
165 resources+31 this week
An automated software testing technique that injects invalid, malformed, or unexpected inputs into a system to reveal software defects and vulnerabilities not caught by conventional testing.
API Security
GraphQL Security
158 resources+35 this week
GraphQL's flexible query model introduces unique attack surface — introspection abuse, batching attacks, deep query DoS, and authorization bypass via nested resolvers.
via graphql.orgAccess Control
Authorization / Broken Access Control
362 resources+59 this week
Missing or flawed authorization checks that allow users to escalate privileges, access other accounts, or perform restricted actions through parameter tampering, forced browsing, or JWT manipulation.
via OWASPAPI Security
API Security
397 resources+57 this week
Securing REST, GraphQL, gRPC, and WebSocket APIs against BOLA, mass assignment, excessive data exposure, and the OWASP API Security Top 10 risks that plague modern API-first architectures.
via OWASPMobile
Mobile Security
221 resources+33 this week
iOS and Android application security — insecure data storage, certificate pinning bypass, binary reverse engineering, dynamic instrumentation with Frida, and the OWASP Mobile Top 10.
via OWASPSupply Chain
Supply Chain Security
851 resources+35 this week
Threats targeting dependencies, build systems, and distribution channels — dependency confusion, typosquatting, compromised packages, and defenses like SBOMs, SLSA, and dependency scanning.
Credential Security
Secrets & Credential Leaks
344 resources+45 this week
Detecting and preventing exposed API keys, database passwords, and cloud credentials in source code, CI/CD configs, and container images using TruffleHog, GitLeaks, and vault solutions.
Exploitation
Insecure Deserialization
146 resources+32 this week
Exploiting unsafe object deserialization in Java, PHP, Python, .NET, and Ruby — gadget chains, ysoserial payloads, and the path from serialized data to remote code execution.
via OWASPIdentity
Authentication
349 resources+66 this week
Verifying user identity through passwords, tokens, certificates, and federated protocols — covering OAuth, SAML, MFA bypasses, session handling, and the move toward passkeys.
via OWASPTokens
JSON Web Tokens (JWT)
165 resources+36 this week
Stateless tokens widely used for authentication, with a long history of implementation flaws including algorithm confusion, kid injection, weak HMAC secrets, and the infamous "none" algorithm bypass.
via OWASPInjection
Server-Side Template Injection (SSTI)
144 resources+32 this week
Injection into server-rendered templates — Jinja2, Twig, Freemarker, Velocity — that frequently escalates to remote code execution through expression evaluation and sandbox escapes.
via PortSwiggerWeekly AppSec Digest
Get new resources delivered every Monday.