Other Projects
Lab Projects: OWASP Labs projects represent projects that have produced an OWASP reviewed deliverable of value.
Incubator Projects: OWASP Incubator projects represent the experimental playground where projects are still being fleshed out, ideas are still being proven, and development is still underway.
Lab Projects
- OWASP AntiSamy
- OWASP Attack Surface Detector
- OWASP Automated Threats to Web Applications
- OWASP Benchmark
- OWASP Code Pulse
- OWASP Code Review Guide
- OWASP Cornucopia
- OWASP Developer Guide
- OWASP Devsecops Maturity Model
- OWASP Enterprise Security API (ESAPI)
- OWASP Find Security Bugs
- OWASP Integration Standards
- OWASP Internet of Things
- OWASP Java HTML Sanitizer
- OWASP Machine Learning Security Top Ten
- OWASP Mobile Top 10
- OWASP Mutillidae II
- OWASP Nettacker
- OWASP Podcast
- OWASP pytm
- OWASP Secure Coding Dojo
- OWASP secureCodeBox
- OWASP SecureTea Project
- OWASP Riyadh
- OWASP Security Pins
- OWASP Snakes And Ladders
- OWASP Software Component Verification Standard
- OWASP Threat Dragon
- OWASP Top 10 CI/CD Security Risks
- OWASP Top 10 for Large Language Model Applications
- OWASP Low-Code/No-Code Top 10
- OWASP Top 10 Privacy Risks
- OWASP TorBot
- OWASP Vulnerable Web Applications Directory
- OWASP WebGoat
Incubator Projects
- OWASP aegis4j
- OWASP AI Maturity Assessment
- OWASP AI Security and Privacy Guide
- OWASP AI Top Ten
- OWASP AIBOM
- OWASP Antiforensics Project
- OWASP API Governance
- OWASP API Security Testing Framework
- OWASP Application Gateway
- OWASP Application Security Awareness Campaigns
- OWASP Application Security Curriculum
- OWASP Appsec Discovery
- OWASP AppSensor
- OWASP ASVS-Graph
- OWASP Authoritative Privacy Reference Project
- OWASP Auto DevSecOps
- OWASP Automotive EMB 60
- OWASP AWScanner
- OWASP Bullet-proof React
- OWASP Certified Secure Developer
- OWASP Cervantes
- OWASP Chirps
- OWASP Cloud-Native Application Security Top 10
- OWASP Cloud Tenant Isolation
- OWASP Consigliere - Your SAST Fixing Advisor
- OWASP Continuous Penetration Testing Framework
- OWASP Core Business Application Security
- OWASP crAPI
- OWASP Cumulus
- OWASP CWE Toolkit
- OWASP Cyber Defense Framework
- OWASP Damn Vulnerable Web Sockets
- OWASP Data Security Top 10
- OWASP DeepSecrets
- OWASP dep-scan
- OWASP Desktop App Security Top 10
- OWASP AppSec Days Developer Outreach Program
- OWASP DevSecOps Guideline
- OWASP DevSecOps Top 10
- OWASP DevSecOps Verification Standard
- OWASP DevSlop
- OWASP Docker Top 10
- OWASP Dojo Shield
- OWASP Domain Protect
- OWASP DPD (DDOS Prevention using DPI)
- OWASP Dragon-GPT
- OWASP Dungeons and Daemons
- OWASP eBPFShield
- OWASP EKS Goat
- OWASP Enterprise DevSecOps
- OWASP Faction
- OWASP Forensics Testing Guide
- OWASP GameSec Framework
- OWASP Go Secure Coding Practices Guide
- OWASP HACTU8
- OWASP Honeypot
- OWASP How to Get Into AppSec
- OWASP IDE-VulScanner
- OWASP Infrastructure Security Testing Guide
- OWASP Intelligent Intrusion Detection System
- OWASP IoT Security Testing Guide
- OWASP IoT Security Verification Standard
- OWASP-js
- OWASP KubeFIM
- OWASP KubeLight
- OWASP Kubernetes Security Testing Guide
- OWASP Kubernetes Top Ten
- OWASP LLM Security Verification Standard
- OWASP Maryam
- OWASP Mimosa
- OWASP Machine Learning Security Verification Standard
- OWASP Mobile Audit
- OWASP Nest
- OWASP Netryx
- OWASP Nightingale
- OWASP Node.js Goat
- OWASP Noir
- OWASP Non-Human Identities Top 10
- OWASP O-Saft
- OWASP Ontology Driven Threat Modeling Framework
- OWASP Open SAMMY
- OWASP Open Security Information Base
- OWASP Open Source Security Applications Platform
- OWASP Operational Technology Top 10
- OWASP OT Top Ten
- OWASP PCI DSS Toolkit
- OWASP Penetration Test Reporting Standard (OPTRS)
- OWASP Penetration Testing Kit
- OWASP Pentest Best Practices
- OWASP PenText
- OWASP Privacy Toolkit
- OWASP ProdSecMan
- OWASP Product Security Capability Framework
- OWASP PSIRT
- OWASP PurpleTeam
- Pygoat
- OWASP Raider
- OWASP RBTM
- OWASP Risk Assessment Framework
- OWASP safetypes
- OWASP SAMMwise
- OWASP SAP Threat Modeling Builder
- OWASP Sasori
- OWASP SBOM Forum
- OWASP Scan IT
- OWASP ScrapPy
- OWASP Secure Coding Practices-Quick Reference Guide
- OWASP Secure Logging Benchmark
- OWASP SecureBank
- OWASP Security Bridge
- OWASP Security-C4PO
- OWASP Security Champions Guide
- OWASP Security Culture
- OWASP SecurityRAT
- OWASP Serverless Top 10
- OWASP Software Pre-Execution Security Review
- OWASP Software Security 5D Framework
- OWASP Project Spotlight Series
- Secure Pipeline Verification Standard (SPVS)
- OWASP State of AppSec Survey
- OWASP Testability Patterns for Web Applications
- OWASP Thick Client Top 10 Project
- OWASP Threat and Safeguard Matrix (TaSM)
- OWASP Threat Modeling Project
- OWASP Threat Model Library
- OWASP Threat Model Vault
- OWASP Threat Modeling Playbook (OTMP)
- OWASP Top 10 Client-Side Security Risks
- OWASP Top 10 Drone Security Risks
- OWASP Top 10 for Business Logic Abuse
- OWASP Top 10 for Maritime Security
- OWASP Top 10 in XR
- OWASP Top 25 Parameters
- OWASP untrust
- OWASP Vulnerability Management Center
- OWASP Vulnerability Management Guide
- OWASP Vulnerable Container Hub
- OWASP Vulnerable Flask App
- OWASP VulnerableApp
- OWASP VulnerableApp-Facade
- OWASP WAF-A-MoLE
- OWASP WAF Advanced Ruleset Management
- OWASP Web Application Firewall Evaluation Criteria Project (WAFEC)
- OWASP Web Hacking Incident Database
- OWASP Web Mapper
- OWASP Wi-Fi Security Testing Guide
- OWASP WinFIM.NET
Projects Needing Website Update
- OWASP Access Log Parser
- OWASP Application Security Monitoring Standard
- OWASP Application Security Playbook
- OWASP AppSec Contract Builder
- OWASP ASVS Security Evaluation Templates with Nuclei
- OWASP BlockChain AppSec Standard
- OWASP ChainGoat
- OWASP Cognito Catastrophe
- OWASP Common Lifecycle Enumeration
- OWASP Cybersecurity Certification Course
- OWASP Data Analysis Visualization and Ingestion Domain (DAVID)
- OWASP De-addiction
- OWASP DevGuard
- OWASP DevSecOps
- OWASP DevSecOps Automation Matrix
- OWASP Ende
- OWASP Four Clover
- OWASP Glue Tool
- OWASP hacking-lab
- OWASP iGoat Tool
- OWASP internet of things top 10
- OWASP Java Security Toolkit
- OWASP LLM Prompt Hacking
- OWASP Machine Learning Minefield
- OWASP Memory Safety Project
- OWASP NaiveSystems Analyze
- OWASP Top 10 Risks for Open Source Software
- OWASP Product Security Guide
- OWASP Pryingdeep
- OWASP Qraclib
- OWASP Qrljacker
- OWASP Reverse Engineering And Code Modification Prevention
- OWASP SAPKiln
- OWASP Secure Development and Release Framework
- OWASP SEDATED®
- OWASP SkyShield
- OWASP SCSTG
- OWASP Smart Contract Security Verification Standard
- OWASP Smart Contract Top 10
- OWASP Solana Top 10
- OWASP SupplyChainGoat
- OWASP Thick Client Application Security Verification Standard
- OWASP TOCTOURex
- OWASP Top 10 Infrastructure Security Risks
- OWASP Watiqay
Flagship Projects
Projects that have demonstrated strategic value to OWASP and application security as a whole
Standards Projects
OWASP Application Security Verification Standard (ASVS)
The OWASP Application Security Verification Standard (ASVS) Project is a framework of security requirements that focus on defining the security controls required when designing, developing and testing modern web applications and web services.
OWASP CycloneDX (ECMA-424)
OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction.
Tool Projects
Documentation Projects
OWASP Cheat Sheet Series
The OWASP Cheat Sheet Series project provides a set of concise good practice guides for application developers and defenders to follow.
OWASP Mobile Application Security
The OWASP Mobile Application Security (MAS) project consists of a series of documents that establish a security standard for mobile apps and a comprehensive testing guide that covers the processes, techniques, and tools used during a mobile application security assessment, as well as an exhaustive set of test cases that enables testers to deliver consistent and complete results.
OWASP SAMM
A Software Assurance Maturity Model (SAMM) that provides an effective and measurable way for all types of organizations to analyse and improve their software security posture.
OWASP Top Ten
The OWASP Top 10 is the reference standard for the most critical web application security risks. Adopting the OWASP Top 10 is perhaps the most effective first step towards changing your software development culture focused on producing secure code.
OWASP Web Security Testing Guide
The Web Security Testing Guide (WSTG) Project produces the premier cybersecurity testing resource for web application developers and security professionals.
Code Projects
OWASP Amass
An open source framework that helps information security professionals perform network mapping of attack surfaces and external asset discovery using open source intelligence gathering and reconnaissance techniques!
OWASP Defectdojo
The leading open source application vulnerability management tool built for DevOps and continuous security integration.
OWASP Dependency-Check
Dependency-Check is a Software Composition Analysis (SCA) tool suite that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities.
OWASP Dependency-Track
Intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.
OWASP Juice Shop
Probably the most modern and sophisticated insecure web application for security trainings, awareness demos and CTFs. Also great voluntary guinea pig for your security tools and DevSecOps pipelines!
OWASP CRS
The OWASP CRS is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls. The CRS aims to protect web applications from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts.
OWASP OWTF
Offensive Web Testing Framework (OWTF), is an OWASP+PTES focused try to unite great tools and make pen testing more efficient, written mostly in Python.
OWASP Security Shepherd
OWASP Security Shepherd is a web and mobile application security training platform. Security Shepherd has been designed to foster and improve security awareness among a varied skill-set demographic. The aim of this project is to take AppSec novices or experienced engineers and sharpen their penetration testing skillset to security expert status.