Skip to content

Latest commit

 

History

History
73 lines (65 loc) · 4.47 KB

awesome-pentest-learning-resources.md

File metadata and controls

73 lines (65 loc) · 4.47 KB

Awesome Penetration Testing Learning Resources (Web Security)

It covers web security majorly

ToC

  1. Books
  2. Videos
  3. Free/Paid Courses
  4. Free/Paid Labs
  5. Web Security Tools
  6. Certifications
  7. Blogs/Articles

Books

  1. The Web Application Hacker's Handbook
  2. Web Security Testing Guide
  3. OWASP Testing guide v4 in pdf

Videos

  1. Web Security Tutorials for Beginners
  2. Web Security Fundamentals for Beginners
  3. CS 253 Web Security form Stanford

Free/Paid Courses/Tutorials

  1. CS253: Web Security from Stanford University
  2. CS253: Reading materials
  3. WebApp Security bootcamp
  4. Web Security Academy

Free/Paid Labs

  1. OWASP WebGoat
  2. OWASP Juice Shop
  3. This is Legal app
  4. Hack This Site
  5. Google Gruyere
  6. Damn Vulnerable Web Application (DVWA)

Web Security Tools

  1. Nikto: Web server scanner
  2. fierce: DNS reconnaissance tool for discovering subdomains and potential attack vectors
  3. owaspZAP (OWASP Zed Attack Proxy): Open-source web application scanner for finding vulnerabilities and testing app security.
  4. BurpSuite: Comprehensive web security testing tool for performing vulnerability scans, manual testing, and exploitation.
  5. sqlmap: Open-source tool that automates the detection and exploitation of SQL injection vulnerabilities.
  6. w3af: Web application attack and audit framework that helps identify and exploit vulnerabilities.
  7. BeEF (Browser Exploitation Framework): Tool for targeting and exploiting vulnerabilities in web browsers.
  8. Pentest Tools
  9. Acunetix: Automated web application security testing tool - paid tool by invicti (formerly NetSparker)
  10. Wfuzz: Web application security bruteforcing tool. Great for fuzzing
  11. Amass: Subdomain enumeration and attack surface mapping.
  12. Dirb: Web content discovery scanner using a directory file
  13. WhatWeb: Web application fingerprinting tool
  14. WPScan: WordPress vulnerability scanner for installed plugins
  15. XSStrike: XSS vulnerability scanner by Somdev Sangwan
  16. HTTrack: Website copier tool or an offline browser utility
  17. nmap: Network discovery and security auditing tool.

Certifications

  1. OSCP by Offensive Security
  2. OSWE by Offensive Security
  3. GWEB by SANS
  4. GWAPT by SANS
  5. eWPT by eLearnSecurity
  6. CEWPT by Mile2
  7. WAPT by 7Safe

Blogs/Articles

  1. OWASP Cheatsheet Series
  2. OWASP Top 10 related cheatsheet
  3. Implementation of CSP
  4. Prototype Pollution
  5. Hackerone’s hacktivity
  6. Awesome Bug bounty writeup
  7. log4j pentesting