Live briefing
Everything about OWASP
Computer security organization
OWASP, the Open Worldwide Application Security Project, is an online community that publishes open-source information and resources on IoT, system software and web application security. It is led by a non-profit called The OWASP Foundation. Wikipedia →
🧭 Start here: a 6-step reading path
- Read the overview: OWASPA 5-minute orientation
- Skim a recent paper: SECURING WEB APPLICATIONS WITH OWASP ZAP FOR COMPREHENSIVE SECURITY TESTINGInfluential work since 2022
- Pick up a classic book: OWASP Top 10 for LaymanThe most-reprinted book on the subject
- Read the landmark paper: Vulnerabilities Mapping based on OWASP-SANS: A Survey for Static Application Security Testing (SAST)Cited 70 times
- Go sideways: Security testingA closely related topic
- Go sideways: Web application firewallA closely related topic
🏆 Landmark papers (most cited)
Vulnerabilities Mapping based on OWASP-SANS: A Survey for Static Application Security Testing (SAST)
On Combining Static, Dynamic and Interactive Analysis Security Testing Tools to Improve OWASP Top Ten Security Vulnerability Detection in Web Applications
Mapping the OWASP Top Ten to Blockchain
A quantitative security evaluation and analysis model for web applications based on OWASP application security verification standard
Mobile Application Security Penetration Testing Based on OWASP
Benchmarking Approach to Compare Web Applications Static Analysis Tools Detecting OWASP Top Ten Security Vulnerabilities
Web Vulnerability Through Cross Site Scripting (XSS) Detection with OWASP Security Shepherd
Website Vulnerability Testing and Analysis of Website Application Using OWASP
🆕 Influential since 2022
SECURING WEB APPLICATIONS WITH OWASP ZAP FOR COMPREHENSIVE SECURITY TESTING
Comparative analysis of the effectiveness of OWASP ZAP, Burp Suite, Nikto and Skipfish in testing the security of web applications
Web Application Security Education Platform Based on OWASP API Security Project
Evaluating software security maturity using OWASP SAMM: Different approaches and stakeholders perceptions
Secured web application based on CapsuleNet and OWASP in the cloud
📚 Books worth reading
- 📕OWASP Top 10 for Laymansivasai reddy · 2019
- 📕OWASP Automated Threat HandbookColin Watson, Tin Zaw · 2018
- 📕OWASPGerard Blokdyk · 2017
- 📕CISO Survey and Report 2013Owasp Foundation · 2014
- 📕AppSensor CISO BriefingOwasp Foundation · 2015
- 📕OWASP Top 10 : the Top 10 Most Critical Web Application Security ThreatsOpen Web Open Web Application Security Project, PageKicker Robot PageKicker Robot Phil 73 · 2014
- 📕Sunshine on Secure JavaNatalie "Sunny" Wear · 2013
- 📕SCFM : Secure Coding Field ManualSunny Wear · 2015
Ranked by number of editions on Open Library, a rough measure of how lasting a book is.
🔗 Related topics
- Security testing Security testing is a process intended to detect flaws in the security mechanisms of an information system and as such help enable it to protect data and…
- Web application firewall A Web application firewall (WAF) is a specific form of application firewall that filters, monitors, and blocks HTTP traffic to and from a web service.…
- ZAP (software) ZAP (Zed Attack Proxy) is a dynamic application security testing tool published under the Apache License. When used as a proxy server it allows the user…
- Application security Application security (AppSec) includes all tasks that introduce a secure software development life cycle to development teams. Its final goal is to improve…
- Linux Foundation The Linux Foundation (LF) is a nonprofit organization formed in 2007 to support the development of Linux and open-source software. The foundation provides…
- SQL injection In computing, SQL injection is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into…
- W3af w3af (Web Application Attack and Audit Framework) is an open-source web application security scanner. The project provides a vulnerability scanner and…
- ModSecurity Free and open-source software portal ModSecurity, sometimes called Modsec, is an open-source web application firewall (WAF). Originally designed as a module…