/awesome-web-security

Curated lookup over qazbnm456/awesome-web-security. Always fetches the latest index from raw.githubusercontent.com — no stale snapshot.

When to use

A user asks for resources, references, learning paths, or tools related to web security topics: XSS, SQLi, CSRF, SSRF, XXE, OAuth/JWT, prototype pollution, deserialization, SAML, file upload, web cache poisoning, WAF / CSP evasion, browser exploitation, recon (subdomain enumeration, OSINT), DNS rebinding, CTF write-ups, bug bounty methodology, defensive tooling, payload lists, cheatsheets, or related blogs.

When NOT to use

• The user wants to attack a target they do not own and have not been authorized to test. Decline and ask for scope: own system, CTF, authorized pentest, academic research, or defensive analysis.
• The user is asking for malware authoring, mass scanning of unowned infrastructure, or detection-evasion guidance for offensive purposes.
• The question has no security framing — it's general programming or framework usage. Hand off to a non-security skill.

How

1. Fetch the index with WebFetch: https://raw.githubusercontent.com/qazbnm456/awesome-web-security/master/data/index.json
2. Parse the JSON. Schema:

   {
     "schema_version": "1",
     "categories": [{"key": "xss", "title": "...", "h_level": 3, "parent": "intro", "anchor": "xss"}],
     "entries": [{
       "id": "xss-google-app-security",
       "url": "...",
       "title": "...",
       "author": {"name": "...", "url": "..."},
       "category": "xss",
       "type": "article|tool|cheatsheet|video|book|community|payload-list",
       "languages": ["en", "zh", "jp"],
       "difficulty": "intro|intermediate|advanced",
       "date_added": "YYYY-MM-DD",
       "archive_url": "...|null",
       "last_checked": "YYYY-MM-DD|null",
       "status": "active|dead|archived-only|quarantined"
     }]
   }

3. Filter by:
   • category matching the user's topic (a topic may map to several categories — for "XSS" check xss, tools-xss, tricks-xss, practices-xss, evasions-csp as relevant).
   • languages: default to the user's language; fall back to en.
   • difficulty: include all unless the user asked for "intro" or "deep".
   • type: filter by what the user wants — articles, tools, cheatsheets, payload lists, etc.
4. Rank by:
   • "Latest" requests → date_added DESC.
   • "Deep dive" requests → prefer difficulty: advanced, then by depth signals (long titles, payload-list type, presence of author URL).
   • "Tools" requests → type: tool only.
5. Return 5–7 entries; for each include title, URL, archive_url fallback if status != active, and a one-line value statement explaining what this entry teaches.

Safety guardrails

• Refuse to assist with unauthorized targeting. Ask for scope.
• Frame all results defensively / educationally.
• For payload-list entries, append: "Test payloads only against systems you own or have written authorization to test."
• Do not chain entries into an attack playbook against a named real target.

Output format

For each result:

Title — author • difficulty • type One line on what this teaches and why it matters. (Archive fallback: archive_url) — included only when status != active.

End with:

Cited from qazbnm456/awesome-web-security. Full list and categories at the README.

Failure handling

• JSON fetch fails (network, 404, parse error) → respond: "The awesome-web-security index is temporarily unreachable. Try again shortly, or visit https://github.com/qazbnm456/awesome-web-security directly." Do NOT fabricate entries.
• No matches in the requested category → say so explicitly. Offer adjacent categories from categories[].parent chain.

Examples

User: "I'm learning XSS, give me intermediate-level resources in English." → Filter category matching xss, tools-xss, tricks-xss, evasions-csp; languages contains en; difficulty in intermediate or advanced; rank by date_added DESC; return top 5–7.

User: "我想找最新的 SSRF 文章。" → Filter category matching ssrf, tricks-ssrf, tools-ssrf; languages contains zh; rank by date_added DESC; return in Chinese.

User: "What's a good XSS payload list?" → Filter category: xss AND type: payload-list; rank by depth signals. Append the unauthorized-testing reminder.