> For the complete documentation index, see [llms.txt](https://cianciustyles.gitbook.io/everything-i-know/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cianciustyles.gitbook.io/everything-i-know/s/security/web.md).

# Web

## Resources

### Articles

* [Brainfuck beware: JavaScript is after you!](https://patriciopalladino.com/blog/2012/08/09/non-alphanumeric-javascript.html) - Patricio Palladino
* [CSRF, CORS, and HTTP Security headers Demystified](https://blog.vnaik.com/posts/web-attacks.html) - Varun Naik
* [Hacking JWT Tokens: The None Algorithm](https://blog.pentesteracademy.com/hacking-jwt-tokens-the-none-algorithm-67c14bb15771) - Shivam Bathla

### GitHub Repositories

* [A practical security guide for web developers](https://github.com/FallibleInc/security-guide-for-developers)
* [Awesome Web Hacking](https://github.com/infoslack/awesome-web-hacking)
* [Damn Vulnerable Web Application](https://github.com/digininja/DVWA)
* [JavaScript Security Cookbook](https://github.com/rajamsrgit/JavaScriptSecurityCookbook)
* [OWASP Web Application Security Testing Checklist](https://github.com/0xRadi/OWASP-Web-Checklist)
* [phpbash](https://github.com/Arrexel/phpbash) - A semi-interactive PHP shell compressed into a single file

### Tools

#### JSON Web Tokens

* [JWT Debugger](https://token.dev/)
* [jwt.io](https://jwt.io/)

#### Online Malware Detection

* [MetaDefender Cloud](https://metadefender.opswat.com/)
* [VirusTotal](https://www.virustotal.com)

### Websites

* [abuse.ch](https://abuse.ch/) - Fighting malware and botnets
  * [Feodo Tracker](https://feodotracker.abuse.ch/) - sharing C\&C servers
  * [MalwareBazaar](https://bazaar.abuse.ch/) - Malware sample exchange
  * [SSL Blacklist](https://sslbl.abuse.ch/) - Detecting malicious SSL connections
  * [ThreatFox ](https://threatfox.abuse.ch/)- Share Indicators of Compromise
  * [URLhaus ](https://urlhaus.abuse.ch/)- Malware URL exchange
  * [YARAify ](https://yaraify.abuse.ch/)- YARA scan engine
* [bWAPP ](http://www.itsecgames.com/index.htm)- a buggy web application
* [Censys Search](https://search.censys.io/) - search engine for Internet hosts
* [Cisco Talos Intelligence](https://talosintelligence.com/) - comprehensive threat intelligence
* [flAWS](http://flaws.cloud/)
* [Hacking-Lab](https://www.hacking-lab.com/)
* [How HTTPS works](https://howhttps.works/)
* [JSFuck](http://www.jsfuck.com/) - Write any JavaScript with 6 Characters: \[]\()!+
* [Open Web Application Security Project (OWASP)](https://owasp.org/)
  * [Cheat Sheets](https://cheatsheetseries.owasp.org/)
  * [Juice Shop](https://owasp.org/www-project-juice-shop/)
  * [Vulnerable Web Applications Directory](https://owasp.org/www-project-vulnerable-web-applications-directory/)
  * [WebGoat](https://owasp.org/www-project-webgoat/)
* [PentesterLab](https://pentesterlab.com/)
* [PhishTool](https://www.phishtool.com/)
* [Shodan](https://www.shodan.io/) - The search engine for Internet of Things
* [The Illustrated TLS Connection](https://tls.ulfheim.net/)
* [urlscan.io](https://urlscan.io/) - URL and website scanner
* [Web Application Exploits and Defenses](https://google-gruyere.appspot.com/)
* [Web Security Academy](https://portswigger.net/web-security) - PortSwigger
* [Webhacking.kr](https://webhacking.kr/)
* [Websec](http://websec.fr/)
* [XSS Game](https://xss-game.appspot.com/)