Projects

Projects

Projects for Good

We are a community of developers, technologists and evangelists improving the security of software. The OWASP Foundation gives aspiring open source projects a platform to improve the security of software with:

  • Visibility: Our website gets more than six million visitors a year
  • Credibility: OWASP is well known in the AppSec community
  • Resources: Funding and Project Summits are available for qualifying Programs
  • Community: Our Conferences and Local Chapters connect Projects with users

OWASP Projects are a collection of related tasks that have a defined roadmap and team members. Our projects are open source and are built by our community of volunteers - people just like you! OWASP project leaders are responsible for defining the vision, roadmap, and tasks for the project. The project leader also promotes the project and builds the team. OWASP currently has over 100 active projects, and new project applications are submitted every week.

Code, software, reference material, documentation, and community all working to secure the world's software.

Projects gives members an opportunity to freely test theories and ideas with the professional advice and support of the OWASP community. Every project minimally has their own webpage, mailing list, and Slack Channel. Most projects maintain their content in ourGitHub organization.

Who Should Start an OWASP Project?

  • Application Developers
  • Software Architects
  • Information Security Authors
  • Those who would like the support of a world wide professional community to develop or test an idea.

Project Guidance

You can find more information about project levels, promotion criteria, and best practices at theProject Committee pages.

OWASP Projects, the SDLC, and the Security Wayfinder

Thanks to the OWASP Integration Standards Project for mapping OWASP projects in a diagram of the Software Development LifeCycle. This resource should help you determine which projects fit into your SDLC.

OWASP Project Inventory (370)

All OWASP tools, document, and code library projects are organized into the following categories:

Flagship Projects: The OWASP Flagship designation is given to projects that have demonstrated strategic value to OWASP and application security as a whole.
Production Projects: OWASP Production projects are production-ready projects.
Other Projects: The Lab and Incubator projects can be foundhere.

List of Projects byLevel orType

Flagship Projects

  • OWASP Amass

    An open source framework that helps information security professionals perform network mapping of attack surfaces and external asset discovery using open source intelligence gathering and reconnaissance techniques!

  • OWASP Application Security Verification Standard (ASVS)

    The OWASP Application Security Verification Standard (ASVS) Project is a framework of security requirements that focus on defining the security controls required when designing, developing and testing modern web applications and web services.

  • OWASP Cheat Sheet Series

    The OWASP Cheat Sheet Series project provides a set of concise good practice guides for application developers and defenders to follow.

  • OWASP CycloneDX (ECMA-424)

    OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction.

  • OWASP Defectdojo

    The leading open source application vulnerability management tool built for DevOps and continuous security integration.

  • OWASP Dependency-Check

    Dependency-Check is a Software Composition Analysis (SCA) tool suite that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities.

  • OWASP Dependency-Track

    Intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

  • OWASP Juice Shop

    Probably the most modern and sophisticated insecure web application for security trainings, awareness demos and CTFs. Also great voluntary guinea pig for your security tools and DevSecOps pipelines!

  • OWASP Mobile Application Security

    The OWASP Mobile Application Security (MAS) project consists of a series of documents that establish a security standard for mobile apps and a comprehensive testing guide that covers the processes, techniques, and tools used during a mobile application security assessment, as well as an exhaustive set of test cases that enables testers to deliver consistent and complete results.

  • OWASP CRS

    The OWASP CRS is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls. The CRS aims to protect web applications from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts.

  • OWASP OWTF

    Offensive Web Testing Framework (OWTF), is an OWASP+PTES focused try to unite great tools and make pen testing more efficient, written mostly in Python.

  • OWASP SAMM

    A Software Assurance Maturity Model (SAMM) that provides an effective and measurable way for all types of organizations to analyse and improve their software security posture.

  • OWASP Security Shepherd

    OWASP Security Shepherd is a web and mobile application security training platform. Security Shepherd has been designed to foster and improve security awareness among a varied skill-set demographic. The aim of this project is to take AppSec novices or experienced engineers and sharpen their penetration testing skillset to security expert status.

  • OWASP Top Ten

    The OWASP Top 10 is the reference standard for the most critical web application security risks. Adopting the OWASP Top 10 is perhaps the most effective first step towards changing your software development culture focused on producing secure code.

  • OWASP Web Security Testing Guide

    The Web Security Testing Guide (WSTG) Project produces the premier cybersecurity testing resource for web application developers and security professionals.

Production Projects

  • OWASP API Security Project

    More info soon...

  • OWASP Bug Logging Tool

    OWASP BLT is a tool enabling internet users to report all kinds of issues they encounter, thereby improving internet security, with a unique feature of rewarding users for bug reporting and allowing companies to launch their own bug hunting programs, promoting responsible disclosure and fostering a safer online environment.

  • OWASP Coraza Web Application Firewall

    OWASP Coraza is a golang enterprise-grade WAF framework compatible with Modsecurity and OWASP Core Ruleset.

  • OWASP CSRFGuard

    OWASP CSRFGuard is a library that implements a variant of the synchronizer token pattern to mitigate the risk of Cross-Site Request Forgery (CSRF) attacks.

  • OWASP ModSecurity

    ModSecurity is the standard open-source web application firewall (WAF) engine.

  • OWASP SamuraiWTF

    SamuraiWTF (Web Training Framework) is a collection of tools and training bundled into a platform to provide a lab environment and training on web application testing.

  • OWASP Secure Headers Project

    Provides technical information about HTTP security headers.

  • OWASP WrongSecrets

    Examples with how to not use secrets

Code Projects

Documentation Projects

Other Projects

Flagship Projects

Projects that have demonstrated strategic value to OWASP and application security as a whole

Standards Projects

OWASP Application Security Verification Standard (ASVS)

The OWASP Application Security Verification Standard (ASVS) Project is a framework of security requirements that focus on defining the security controls required when designing, developing and testing modern web applications and web services.

OWASP CycloneDX (ECMA-424)

OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction.

Tool Projects

Documentation Projects

OWASP Cheat Sheet Series

The OWASP Cheat Sheet Series project provides a set of concise good practice guides for application developers and defenders to follow.

OWASP Mobile Application Security

The OWASP Mobile Application Security (MAS) project consists of a series of documents that establish a security standard for mobile apps and a comprehensive testing guide that covers the processes, techniques, and tools used during a mobile application security assessment, as well as an exhaustive set of test cases that enables testers to deliver consistent and complete results.

OWASP SAMM

A Software Assurance Maturity Model (SAMM) that provides an effective and measurable way for all types of organizations to analyse and improve their software security posture.

OWASP Top Ten

The OWASP Top 10 is the reference standard for the most critical web application security risks. Adopting the OWASP Top 10 is perhaps the most effective first step towards changing your software development culture focused on producing secure code.

OWASP Web Security Testing Guide

The Web Security Testing Guide (WSTG) Project produces the premier cybersecurity testing resource for web application developers and security professionals.

Code Projects

OWASP Amass

An open source framework that helps information security professionals perform network mapping of attack surfaces and external asset discovery using open source intelligence gathering and reconnaissance techniques!

OWASP Defectdojo

The leading open source application vulnerability management tool built for DevOps and continuous security integration.

OWASP Dependency-Check

Dependency-Check is a Software Composition Analysis (SCA) tool suite that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities.

OWASP Dependency-Track

Intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

OWASP Juice Shop

Probably the most modern and sophisticated insecure web application for security trainings, awareness demos and CTFs. Also great voluntary guinea pig for your security tools and DevSecOps pipelines!

OWASP CRS

The OWASP CRS is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls. The CRS aims to protect web applications from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts.

OWASP OWTF

Offensive Web Testing Framework (OWTF), is an OWASP+PTES focused try to unite great tools and make pen testing more efficient, written mostly in Python.

OWASP Security Shepherd

OWASP Security Shepherd is a web and mobile application security training platform. Security Shepherd has been designed to foster and improve security awareness among a varied skill-set demographic. The aim of this project is to take AppSec novices or experienced engineers and sharpen their penetration testing skillset to security expert status.

WatchStar
The OWASP® Foundation works to improve the security of software through its community-led open source software projects, hundreds of chapters worldwide, tens of thousands of members, and by hosting local and global conferences.

Important Links

Upcoming OWASP Global Events