A curated list of resources for learning and practicing web application security, including tools, books, courses, and vulnerable labs.
Awesome Web Hacking is a curated GitHub repository that compiles resources for learning and practicing web application security. It provides a structured list of books, tools, vulnerable labs, courses, and documentation to help individuals understand common vulnerabilities, attack techniques, and defensive measures. The project aims to be a comprehensive starting point for anyone entering the field of web security.
Security enthusiasts, penetration testers, web developers looking to secure their applications, and students learning about ethical hacking and web vulnerabilities. It's particularly useful for those who want a hands-on approach with practical labs and tools.
Unlike scattered blog posts or commercial training, this list is community-maintained, free, and covers the entire spectrum of web security—from theory to practice. It saves time by aggregating the most relevant and trusted resources in one place, with a focus on open-source tools and reproducible labs.
A list of web application security
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Curates books, tools, labs, and courses from across the web security landscape, saving significant research time by providing a one-stop repository, as seen in sections like Tools and Vulnerabilities with links to sqlmap, Burp Suite, and exploit databases.
Emphasizes practical application with vulnerable applications (e.g., DVWA, WebGoat) and Dockerized environments, allowing users to safely practice exploits and defenses without complex setup, highlighted in the Docker and Labs sections.
Encourages contributions via pull requests, ensuring the list evolves with new tools and research, which is evident from the active GitHub repository and inclusion of recent resources like VulnCheck and Columbus Project.
Lists diverse penetration testing tools, cheat sheets, and methodologies (e.g., OWASP, PTES), offering a broad view of offensive and defensive techniques, from reconnaissance with Shodan to exploitation frameworks.
The list is a massive collection without guided progression or difficulty ratings, making it overwhelming for beginners to navigate effectively, as resources are simply categorized without prioritization or sequencing.
As a community-maintained list, some links may become outdated or broken over time without consistent curation, and there's no stated process for pruning or validating resource relevance.
While tools are listed, it lacks advice on how to choose between them (e.g., Burp Suite vs. OWASP ZAP) or integrate into development workflows, leaving users to figure out implementation details on their own.
Heavily skewed towards attack tools and exploits, with fewer resources on secure coding practices or defensive architectures, which might limit its utility for developers primarily focused on building robust applications.