Account security
- magoo/ato-checklist - A checklist of practices for organizations dealing with account takeover (ATO)
Signature database
- pwnsdx/BadCode - a signature database for static source code scanner that identify bad security practices.
- wireghoul/graudit - Grep rough audit - source code auditing tool
- frizb/SourceCodeSniffer - The Source Code Sniffer is a poor man’s static code analysis tool (SCA) that leverages regular expressions
- jas502n/Fortify_Rule - Decode Fortify Rule Bin File Get XML File
Detection of known vulnerability
- deps.dev: Open Source Insights
- RetireJS - Scanner detecting the use of JavaScript libraries with known vulnerabilities
- snyk.io - helps you use open source and stay secure
- nodesecurity.io - Continuous Security monitoring for your node apps
- OWASP Dependency Check - a utility that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities
All-in-one suite
- returntocorp/semgrep - Lightweight static analysis for many languages. Find bug variants with patterns that look like source code - gitlab开发的
- facebook/infer - A static analyzer for Java, C, C++, and Objective-C
- WhaleShark-Team/cobra - Source Code Security Audit - 2.8K star
- LoRexxar/Kunlun-M - Kunlun-Mirror 专注于安全研究员使用的审计辅助工具 - 1.2K star，ISSUE也很有价值
- SonarSource - Continuous Code Quality
- Microsoft/ApplicationInspector - A software characterization source code analyzer that helps you understand what a program does by identifying interesting features and characteristics using static analysis and a customizable json based rules engine
Browser extension
- elevenpaths/neto - A tool to analyse browser extensions
- mandatoryprogrammer/tarnish - A Chrome extension static analysis tool to help aide in security reviews
Joern
- joernio/joern - Open-source code analysis platform for C/C++/Java based on code property graphs
- joernio/workshops
CodeQL
- trailofbits/itergator - CodeQL library and queries for iterator invalidation
- doyensec/graph-ql - GraphQL Security Research Material
- xz: C/C++源码扫描系列- codeql 篇
Teraform
Java
- wh1t3p1g/tabby - TABBY是一款针对Java语言的静态代码分析工具。它使用静态分析框架 Soot 作为语义提取工具，将JAR/WAR/CLASS文件转化为代码属性图。 并使用 Neo4j 图数据库来存储生成的代码属性图CPG
- momosecurity/momo-code-sec-inspector-java - IDEA静态代码安全审计及漏洞一键修复插件
- fergarrui/custom-bytecode-analyzer - Java bytecode analyzer customizable via JSON rule
- GrrrDog/Java-Deserialization-Cheat-Sheet - The cheat sheet about Java Deserialization vulnerabilities
- find-sec-bugs/find-sec-bugs - The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Groovy and Scala projects)
- zsdlove/Hades - 静态代码脆弱性检测系统，基于虚拟执行及污点跟踪技术
- threedr3am/gadgetinspector - 一个通过分析字节码进行污点分析的静态代码审计应用
- noidsirius/SootTutorial - A step-by-step tutorial for Soot (a Java static analysis framework)
- anbai-inc/javaweb-sec - 攻击Java Web应用
- anbai-inc/javaweb-codereview - 演示java代码审计的示例程序，分为多个模块复现各大类常见漏洞的
- longofo/rmi-jndi-ldap-jrmp-jmx-jms - rmi、jndi、ldap、jrmp、jmx、jms一些demo测试
- JoyChou93/java-sec-code - Java web common vulnerabilities and security code which is base on springboot and spring security
- SmithEcon/Java - 代码审计知识点整理-Java
- dschadow/Java-Web-Security - Java-Web-Security - Sichere Webanwendungen mit Java entwickeln
C/C++
- googleprojectzero/weggli - a fast and robust semantic search tool for C and C++ codebases. It is designed to help security researchers identify interesting functionality in large codebases - 1K star
- docs.google.com: Safer Usage Of C++
- vusec/typesan - TypeSan checks casts in C++ code - code released for CCS 2016
- secure-software-engineering/phasar - A LLVM-based static analysis framework. https://phasar.org
- GoSSIP-SJTU/TripleDoggy - 基于clang static analyzer的源码漏洞检测插件
- vlad902/kernel-uninitialized-memory-checker - A clang analyzer checker that looks for kernel uninitialized memory disclosures to userland
- google/path-auditor - a tool meant to find file access related vulnerabilities by auditing libc functions
- vlad902/kernel-uninitialized-memory-checker - A clang analyzer checker that looks for kernel uninitialized memory disclosures to userland
Javascript / NodeJS
- tsrc: 面向DevSecOps的编码安全指南 JavaScript篇 - 带一个很长的PDF
- lirantal/awesome-nodejs-security - Awesome Node.js Security resources
- ajinabraham/NodeJsScan - NodeJsScan is a static security code scanner for Node.js applications
- dpnishant/jsprime - a javascript static security analysis tool
- doyensec/electronegativity - Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron applications
- doyensec/electronegativity - Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron applications
- hackerone: Remote Code Execution in Slack desktop apps + bonus - XSS没啥，主要是 Electron 下面，用 BrowserWindow constructor + nodeIntegration 实现了 RCE
Powershell
Firmware
- PreOS-Security/fwaudit - Platform Firmware Auditing Tool
- firmadyne/firmadyne - System for emulation and dynamic analysis of Linux-based firmware
Ruby
- thesp0nge/dawnscanner - a static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks
- presidentbeef/brakeman - A static analysis security vulnerability scanner for Ruby on Rails applications
Linux kernel
Golang
- praetorian-inc/gokart - A static analysis tool for securing Go code
- securego/gosec - Golang security checker
DotNet
- pumasecurity/puma-scan - the leading software security Visual Studio analyzer extension. Built on top of Roslyn, the open-source .NET Compiler Platform, Puma Scan provides real time, continuous source code analysis as development teams write code. Vulnerabilities are immediately displayed in the development environment as spell check and compiler warnings, ...
- security-code-scan - Vulnerability Patterns Detector for C# and VB.NET
Python
- python-security/pyt - A Static Analysis Tool for Detecting Security Vulnerabilities in Python Web Applications
- PyCQA/bandit - a tool designed to find common security issues in Python code
- SeriousAlpha/py-security-audit-tool - python security audit tool，用于python源码的代码审计，支持命令注入，sql注入
- MisakiKata/python_code_audit - python 代码审计项目
PHP
- phpstan/phpstan - PHP Static Analysis Tool - discover bugs in your code without running it
- exakat/php-static-analysis-tools - A reviewed list of useful PHP static analysis tools
- Qihoo360/phptrace - A tracing and troubleshooting tool for PHP scripts
- fate0/prvd - PHP Runtime Vulnerability Detection
- laruence/taint - Taint is a PHP extension, used for detecting XSS codes - 污点检测，只做了GPC
- webarx-security/wpbullet - A static code analysis for WordPress (and PHP)
- phith0n/chip - a simple tool to detect potential security threat in php code - 挖掘PHP动态特性
- designsecurity/progpilot - A static analysis tool for security
- SukaraLin/php_code_audit_project - 该项目用来记录，我用来练手的PHP代码审计项目
- bowu678/php_bugs - PHP代码审计分段讲解
- Xyntax/1000php - 1000个PHP代码审计案例(2016.7以前乌云公开漏洞)
- jiangsir404/PHP-code-audit - php code audit for cms vulnerabilities / 代码审计，对一些大型cms漏洞的复现研究，更新源码和漏洞exp
Android
- facebook/mariana-trench - Our security focused static analysis tool for Android and Java applications
- vincentcox/StaCoAn - a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications
- reddr/LibScout - Third-party library detector for Java/Android apps
- hitb-2018dxb: D1T2 - Gold Digging - Discovering Hidden Gems in APKs - Marc Schoenefeld - APK安全测试案例
Uncategorized
- Tencent/secguide - 面向开发人员梳理的代码安全指南
- jiangsir404/Audit-Learning - 记录自己对《代码审计》的理解和总结，对危险函数的深入分析以及在p牛的博客和代码审计圈的收获
- CHYbeta/Code-Audit-Challenges - 一些有趣的代码审计“小”题目
- phith0n/code-breaking - 这里是code-breaking puzzles游戏的所有环境与相关writeup
- CHYbeta/Web-Security-Learning
- analysis-tools-dev/static-analysis - Static analysis tools for all programming languages, build tools, config files and more
- fkie-cad/cwe_checker - is a BAP plugin to find vulnerable patterns in binary executables
- nccgroup/sobelow - Security-focused static analysis for the Phoenix Framework
- google/vulncode-db - a database for vulnerabilities and their corresponding source code if available