A collection of ZAP scripts and tips provided by the community - pull requests very welcome!

njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js applications.

Penetration Testing For - Web | Mobile | API | Thick Client | Source Code Review | DevSecOps | Wireless | Network Pentesting, etc...

Simple tool to scan a website for (DOM-based) XSS vulnerabilities and Open Redirects.

Session Hijacking Visual Exploitation

OWASP SecurityRAT (version 1.x) - Tool for handling security requirements in development

Documentation for Essential Node.js Security

A Tool for Domain Flyovers

Presentations, training modules, and other education materials from Duo Security's Application Security team.

Additional Resources For Securing The Stack Tutorials

Web Browser Hooking Framework. Manage, execute and assess web browser vulnerabilities

Checkmarx Scan Github Action

CodeBreakers: From Dev to Hacker - Teaching developers to how become a app sec ninja !

A JavaScript-based SDK for delivering secure browser-based web applications over a Ziti Network

Akamai CLI for Application Security

A hands-on AppSec fundamentals workshop where we explore protecting API's and Web apps

A simple web app software supply chain monitoring toolkit

Core componentry for the Ziti browZer ecosystem (used internally by ziti-browzer-runtime and ziti-sdk-browzer)

Fortify Software Security JavaScript sandbox

Dependency Frost is an educational platform game to promote awareness of security in open source dependencies