awesome-web-security

/awesome-web-security

Curated lookup over qazbnm456/awesome-web-security. Always fetches the latest index from raw.githubusercontent.com — no stale snapshot.

When to use

A user asks for resources, references, learning paths, or tools related to web security topics: XSS, SQLi, CSRF, SSRF, XXE, OAuth/JWT, prototype pollution, deserialization, SAML, file upload, web cache poisoning, WAF / CSP evasion, browser exploitation, recon (subdomain enumeration, OSINT), DNS rebinding, CTF write-ups, bug bounty methodology, defensive tooling, payload lists, cheatsheets, or related blogs.

When NOT to use

• The user wants to attack a target they do not own and have not been authorized to test. Decline and ask for scope: own system, CTF, authorized pentest, academic research, or defensive analysis.
• The user is asking for malware authoring, mass scanning of unowned infrastructure, or detection-evasion guidance for offensive purposes.
• The question has no security framing — it's general programming or framework usage. Hand off to a non-security skill.

How

1. Fetch the index with WebFetch: https://raw.githubusercontent.com/qazbnm456/awesome-web-security/master/data/index.json
2. Parse the JSON. Schema:

   {
     "schema_version": "1",
     "categories": [{"key": "xss", "title": "...", "h_level": 3, "parent": "intro", "anchor": "xss"}],
     "entries": [{
       "id": "xss-google-app-security",
       "url": "...",
       "title": "...",
       "author": {"name": "...", "url": "..."},
       "category": "xss",
       "type": "article|tool|cheatsheet|video|book|community|payload-list",
       "languages": ["en", "zh", "jp"],
       "difficulty": "intro|intermediate|advanced",
       "date_added": "YYYY-MM-DD",
       "archive_url": "...|null",
       "last_checked": "YYYY-MM-DD|null",
       "status": "active|dead|archived-only|quarantined"
     }]
   }
   

3. Filter by:
   • category matching the user's topic (a topic may map to several categories — for "XSS" check xss, tools-xss, tricks-xss, practices-xss, evasions-csp as relevant).
   • languages: default to the user's language; fall back to en.
   • difficulty: include all unless the user asked for "intro" or "deep".
   • type: filter by what the user wants — articles, tools, cheatsheets, payload lists, etc.
4. Rank by:
   • "Latest" requests → date_added DESC.
   • "Deep dive" requests → p