Skip to content

awesome-appsec-learning-resources.md

Latest commit

 

History

History
150 lines (137 loc) · 9.67 KB

awesome-appsec-learning-resources.md

File metadata and controls

150 lines (137 loc) · 9.67 KB
Raw

Awesome Application Security Learning Resources

Awesome AppSec Learning Resources

AppSec is all about protecting your application from the adversaries such as SAST, SCA, Secure Code Review, Security Architecture etc. Attacking an app can fall under web or app pentest

ToC

  1. Books
  2. Videos
  3. Free/Paid Courses
  4. Free/Paid Labs
  5. Security Tools
  6. Certifications
  7. Blogs/Articles

Books

  1. Agile Application Security - Highly Recommended
  2. The Web Application Hacker's Handbook
  3. Threat Modeling: Designing for Security or
  4. Threat Modeling: A practical guide for development teams
  5. The Tangled Web
  6. Web Security for Developers: Real Threats, Practical Defense
  7. Web Application Security: Exploitation and Countermeasures for Modern Web Applications
  8. Application Security Program Handbook: A Guide for Software Engineers and Team Leaders
  9. Enterprise Security Architect

Videos

  1. Youtube video on semgrep's taint mode
  2. OWASP Global AppSec conference talks
  3. LocoMoco Security Conf - AppSec deep dives
  4. Clint Gibler (tl;dr sec) talks on scaling AppSec
  5. LiveOverflow - deep web/binary exploitation
  6. PwnFunction - web vuln concepts
  7. IppSec - HackTheBox walkthroughs

Free/Paid Courses

  1. PortSwigger Web Security Academy (free)
  2. OWASP Juice Shop Companion Guide (free)
  3. SANS SEC540: Cloud Security and DevSecOps Automation
  4. SANS SEC522: Defending Web Applications Security Essentials
  5. SANS SEC540 / SEC542 / SEC642
  6. Practical DevSecOps - Certified Application Security Practitioner
  7. AppSec Engineer by We Hack Purple / Tanya Janca
  8. Pentester Academy - AppSec paths
  9. Coursera - Software Security (University of Maryland)

Free/Paid Labs

  1. application.security - free gamified challenges on API, Web, Cloud, front-end.
  2. Secure Code Warrior - Commercial developer training.
  3. Security Journey (formerly HackEDU)
  4. OWASP Juice Shop - Most popular intentionally vulnerable web app.
  5. PentesterLab - Hands-on exercises.
  6. GitHub Security Lab CTF
  7. Google Gruyere
  8. Django.nv
  9. DVWA - Damn Vulnerable Web App
  10. WebGoat - OWASP's legacy but still useful Java learning app.
  11. OWASP Security Shepherd
  12. HackMyVM - Free boot2root style VMs.
  13. Root-Me - Large CTF-style challenges repository.
  14. Vulnerable Web Applications Directory by OWASP

Security tools

It will include tools for SAST, SCA, OAST, Threat Modeling, Secure Code Review, secrets management etc

SAST

Open source

  1. SonarQube
  2. Bandit (Python)
  3. Brakeman (Ruby on Rails)
  4. FindSecBugs / SpotBugs (Java)
  5. Semgrep (multi-language, customizable rules)
  6. CodeQL (semantic, free for OSS)
  7. gosec (Go)
  8. njsscan (Node.js)

Paid 9. Checkmarx One 10. Veracode 11. Snyk Code 12. Coverity (Black Duck) 13. Fortify by OpenText

SCA

  1. OWASP Dependency-Check
  2. OWASP Dependency-Track - SBOM-centric continuous monitoring.
  3. Retire.js
  4. CycloneDX CLI - SBOM generation/manipulation.
  5. Syft - SBOM generator.
  6. Trivy - Scans dependencies across many ecosystems.
  7. Snyk Open Source
  8. Checkmarx SCA
  9. JFrog Xray
  10. Socket.dev - Supply-chain / malicious package detection for npm, PyPI.

Secrets

  1. gitleaks
  2. TruffleHog
  3. Talisman
  4. detect-secrets (Yelp)
  5. git-secrets (AWS)
  6. Repo-supervisor - (maintenance mode)
  7. HashiCorp Vault
  8. CyberArk Conjur
  9. GitGuardian - commercial scanning.

Threat Modeling

  1. OWASP ThreatDragon
  2. SDElements
  3. IriusRisk
  4. Threagile
  5. ThreatModeler
  6. Microsoft Threat Modeling tool
  7. STRIDE GPT
  8. ThreatSpec
  9. PyTM

Certifications

  1. CISSP - Certified Information Systems Security Professional
  2. CSSLP Certified Secure Software Lifecycle Professional
  3. ISSAP – Information Systems Security Architecture Professional
  4. CASE (Certified Application Security Engineer) Java or CASE .Net
  5. CompTIA SecurityX (formerly CASP+) - Rebranded Dec 2024; exam CAS-005.

Blogs/Articles

  1. Scaling your AppSec Program with semgrep
  2. TOP 10 THINGS TO KNOW ABOUT SECURITY AS A SOFTWARE ARCHITECT
  3. System Design for Security
  4. Top 25 software security errors
  5. Security prioritization
  6. CWE top 25 2023 list
  7. Open Policy Agent (OPA) documentation
  8. semgrep documentation
  9. MITRE ATT&CK and Defender (MAD) Program
  10. A dive into web application authentication
  11. Taint Analysis or Taint Checking
  12. log4j vulnerability walkthrough
  13. Zero day exploitation of confluence
  14. Python cryptography library (pyca/cryptography) - use this instead of the deprecated PyCrypto
  15. Secure Coding with Python
  16. OWASP Python Security Project (archived but still referenced)
  17. Hacking Python Application
  18. Secure Design Principles
  19. OWASP ASVS (Application Security Verification Standard)
  20. OWASP SAMM (Software Assurance Maturity Model)
  21. OWASP Cheat Sheet Series
  22. OWASP Proactive Controls
  23. tl;dr sec newsletter by Clint Gibler
  24. We Hack Purple AppSec Podcast
  25. CWE Top 25 Most Dangerous Software Weaknesses (latest)
  26. OWASP Top 10 2025 - Updated Jan 2026; Security Misconfiguration at #2, Supply Chain Failures at #3 (new), SSRF merged into Broken Access Control.