Intro

The Application Security Engineer Guide is just a helper for all appsec engineers to find useful information to help them in the day-to-day work.

Content

Security Champions

• How to implement a Security Champions Program?

CTF

• CTF Challenges
• CTF Platform CTFD
• CTF Platform FBCTF
• Challenges_2021_Public

Security Testing

Security Scanners

• BrokenLinkHijacker

Thread Modeling

• threatspec - Thread Modeling as code

Secret Detection

• truffleHog
• detect-secrets
• Gitlab Secret Detection
• Secret Finder
• Gitleaks

SAST

• semgrep - several languages
• Shift-left scan
• Bandit - Python
• Gitlab Sast Containers

DAST

• Jaeves
• Nuclei
• Nettacker

SCA / Software Suply Chain Security

• OpenSSF Scorecard
• Dependency Check
• Dependency Track

IaC (Infrastructure as code)

• Trivy
• Grype
• Anchore
• kubesec
• KubiScan
• kubeletctl
• Kube Hunter
• Kube Bench

Cloud Security Scanners

• Checkov

Infrastructure Security

• linuxkit

Manual security testing tools

• XSS Hunter
• Canary Tokens
• DNS Log
• GCP Bucket Brute

Vulnerability Management and Security Orchestration

• Defect Dojo
• Reconmap

Software Security Compliance

• Choose a License - Open Source license compliance
• Information Security Policy templates SANS
• goSdl - Web app for AppSec Checklists

OSINT Recon Tools

• owasp amass
• Reconftw

OSINT Engine Database

• Abuse SH
• CommonCrawl
• Archive Web
• Alienvault
• Grayhatwarfare - S3 Buckets
• Phishstats

Security Automation

• n8n Workflow Automation
• Dracon

Endpoint Visibility/Protection

• Osquery
• fail2ban - ssh protection

Configurations

• SSL

MISC

• KeyHacks - Where to test a key that I found?
• Web Cache Vulnerability Scanner
• Sherlockeys - Discovery valid keys in Saas Apps
• Draw.io devsecops library