infoslack/awesome-web-hacking

This repository is a curated list of resources for anyone who wants to learn about web application security. It covers a broad range of material from introductory to advanced, organized into sections including books, documentation, tools, cheat sheets, practice labs, online courses, and Docker images set up for security testing work. The books section includes titles on SQL injection, cross-site scripting, penetration testing with specific tools, and general web application security for beginners through experienced practitioners. The documentation section links to standards and frameworks including OWASP, the Open Web Application Security Project, which publishes widely referenced guidance on application security risks and defenses. The tools section lists both free open-source tools and commercial options used in penetration testing and vulnerability scanning. These include scanners that probe web servers for known weaknesses, proxy tools that intercept and manipulate browser traffic, frameworks for running structured attack tests, and tools targeting specific platforms such as WordPress. Many of the linked tools are actively maintained separate projects. The labs and online hacking demonstration sites section points to intentionally vulnerable applications you can practice against legally. These are environments built to be broken into as a way of learning attack techniques and how defenses work. The list is community-maintained, meaning anyone can submit a pull request to add a new resource. There is no code in this repository, the entire content is links and brief descriptions. It is primarily aimed at people starting out in security or looking to fill gaps in a specific topic area, rather than at experienced professionals who would already know most of the listed resources.