应用安全

Awesome AppSec ¶

用于了解应用程序安全性的精选资源列表. 包含书籍，网站、博客文章和自我评估测验.

维护者 Paragon Initiative Enterprises 和来自应用程序安全和开发人员社区的贡献. 我们也 have other community projects 这可能是对未来的应用程序安全专家很有用.

如果您是软件安全主题的绝对初学者，您可能会受益从阅读 A Gentle Introduction to Application Security.

Contributing¶

Please refer to the contributing guide for details.

Application Security Learning Resources¶

  * [How to Safely Generate a Random Number](#how-to-safely-generate-a-random-number-2014) (2014)
  * [Salted Password Hashing - Doing it Right](#salted-password-hashing-doing-it-right-2014) (2014)
  * [A good idea with bad usage: /dev/urandom](#a-good-idea-with-bad-usage-devurandom-2014) (2014)
  * [Why Invest in Application Security?](#why-invest-in-application-security-2015) (2015)
  * [Be wary of one-time pads and other crypto unicorns](#be-wary-of-one-time-pads-and-other-crypto-unicorns-2015) (2015)
  * [Web Application Hacker's Handbook](https://github.com/paragonie/awesome-appsec/blob/master/#-web-application-hackers-handbook-2011) (2011) ![nonfree](https://raw.githubusercontent.com/paragonie/awesome-appsec/master/img/nonfree.png)
  * [Cryptography Engineering](https://github.com/paragonie/awesome-appsec/blob/master/#-cryptography-engineering-2010) (2010) ![nonfree](https://raw.githubusercontent.com/paragonie/awesome-appsec/master/img/nonfree.png)
  * [Securing DevOps](https://github.com/paragonie/awesome-appsec/blob/master/#-securing-devops-2018) (2018) ![nonfree](https://raw.githubusercontent.com/paragonie/awesome-appsec/master/img/nonfree.png)
  * [Gray Hat Python: Programming for Hackers and Reverse Engineers](https://github.com/paragonie/awesome-appsec/blob/master/#-gray-hat-python-programming-for-hackers-and-reverse-engineers-2009) (2009) ![nonfree](https://raw.githubusercontent.com/paragonie/awesome-appsec/master/img/nonfree.png)
  * [The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities](https://github.com/paragonie/awesome-appsec/blob/master/#-the-art-of-software-security-assessment-identifying-and-preventing-software-vulnerabilities-2006) (2006) ![nonfree](https://raw.githubusercontent.com/paragonie/awesome-appsec/master/img/nonfree.png)
  * [C Interfaces and Implementations: Techniques for Creating Reusable Software](https://github.com/paragonie/awesome-appsec/blob/master/#-c-interfaces-and-implementations-techniques-for-creating-reusable-software-1996) (1996) ![nonfree](https://raw.githubusercontent.com/paragonie/awesome-appsec/master/img/nonfree.png)
  * [Reversing: Secrets of Reverse Engineering](https://github.com/paragonie/awesome-appsec/blob/master/#-reversing-secrets-of-reverse-engineering-2005) (2005) ![nonfree](https://raw.githubusercontent.com/paragonie/awesome-appsec/master/img/nonfree.png)
  * [JavaScript: The Good parts](https://github.com/paragonie/awesome-appsec/blob/master/#-javascript-the-good-parts-2008) (2008) ![nonfree](https://raw.githubusercontent.com/paragonie/awesome-appsec/master/img/nonfree.png)
  * [Windows Internals: Including Windows Server 2008 and Windows Vista, Fifth Edition ](https://github.com/paragonie/awesome-appsec/blob/master/#-windows-internals-including-windows-server-2008-and-windows-vista-fifth-edition-2007) (2007) ![nonfree](https://raw.githubusercontent.com/paragonie/awesome-appsec/master/img/nonfree.png)
  * [The Mac Hacker's Handbook](https://github.com/paragonie/awesome-appsec/blob/master/#-the-mac-hackers-handbook-2009) (2009) ![nonfree](https://raw.githubusercontent.com/paragonie/awesome-appsec/master/img/nonfree.png)
  * [The IDA Pro Book: The Unofficial Guide to the World's Most Popular Disassembler](https://github.com/paragonie/awesome-appsec/blob/master/#-the-ida-pro-book-the-unofficial-guide-to-the-worlds-most-popular-disassembler-2008) (2008) ![nonfree](https://raw.githubusercontent.com/paragonie/awesome-appsec/master/img/nonfree.png)
  * [Internetworking with TCP/IP Vol. II: ANSI C Version: Design, Implementation, and Internals (3rd Edition)](https://github.com/paragonie/awesome-appsec/blob/master/#-internetworking-with-tcpip-vol-ii-ansi-c-version-design-implementation-and-internals-3rd-edition-1998) (1998) ![nonfree](https://raw.githubusercontent.com/paragonie/awesome-appsec/master/img/nonfree.png)
  * [Network Algorithmics,: An Interdisciplinary Approach to Designing Fast Networked Devices](https://github.com/paragonie/awesome-appsec/blob/master/#-network-algorithmics-an-interdisciplinary-approach-to-designing-fast-networked-devices-2004) (2004) ![nonfree](https://raw.githubusercontent.com/paragonie/awesome-appsec/master/img/nonfree.png)
  * [Computation Structures (MIT Electrical Engineering and Computer Science)](https://github.com/paragonie/awesome-appsec/blob/master/#-computation-structures-mit-electrical-engineering-and-computer-science-1989) (1989) ![nonfree](https://raw.githubusercontent.com/paragonie/awesome-appsec/master/img/nonfree.png)
  * [Surreptitious Software: Obfuscation, Watermarking, and Tamperproofing for Software Protection](https://github.com/paragonie/awesome-appsec/blob/master/#-surreptitious-software-obfuscation-watermarking-and-tamperproofing-for-software-protection-2009) (2009) ![nonfree](https://raw.githubusercontent.com/paragonie/awesome-appsec/master/img/nonfree.png)
  * [Secure Programming HOWTO](#secure-programming-howto-2015) (2015)
  * [Security Engineering - Second Edition](#security-engineering-second-edition-2008) (2008)
  * [Bulletproof SSL and TLS](https://github.com/paragonie/awesome-appsec/blob/master/#-bulletproof-ssl-and-tls-2014) (2014) ![nonfree](https://raw.githubusercontent.com/paragonie/awesome-appsec/master/img/nonfree.png)
  * [Holistic Info-Sec for Web Developers (Fascicle 0)](#holistic-info-sec-for-web-developers-fascicle-0-2016) (2016)
    * [Cossack Labs blog](#cossack-labs-blog-2018) (2018)
  * [SEI CERT Android Secure Coding Standard](#sei-cert-android-secure-coding-standard-2015) (2015)
  * [SEI CERT C Coding Standard](#sei-cert-c-coding-standard-2006) (2006)
  * [Defensive Coding: A Guide to Improving Software Security by the Fedora Security Team](#defensive-coding-a-guide-to-improving-software-security-by-the-fedora-security-team-2022) (2022)
  * [SEI CERT C++ Coding Standard](#sei-cert-c-coding-standard-2006-1) (2006)
  * [Security Driven .NET](https://github.com/paragonie/awesome-appsec/blob/master/#-security-driven-net-2015) (2015) ![nonfree](https://raw.githubusercontent.com/paragonie/awesome-appsec/master/img/nonfree.png)
  * [Clojure OWASP](#clojure-owasp-2020) (2020)
  * [Memory Security in Go - spacetime.dev](#memory-security-in-go-spacetime-dev-2017) (2017)
  * [SEI CERT Java Coding Standard](#sei-cert-java-coding-standard-2007) (2007)
  * [Secure Coding Guidelines for Java SE](#secure-coding-guidelines-for-java-se-2014) (2014)
  * [Node.js Security Checklist - Rising Stack Blog](#node-js-security-checklist-rising-stack-blog-2015) (2015)
  * [Awesome Electron.js hacking & pentesting resources](#awesome-electron-js-hacking-pentesting-resources-2020) (2020)
  * [Essential Node.js Security](https://github.com/paragonie/awesome-appsec/blob/master/#-essential-node-js-security-2017) (2017) ![nonfree](https://raw.githubusercontent.com/paragonie/awesome-appsec/master/img/nonfree.png)
  * [Security Training by ^Lift Security](https://github.com/paragonie/awesome-appsec/blob/master/#-security-training-by-lift-security) ![nonfree](https://raw.githubusercontent.com/paragonie/awesome-appsec/master/img/nonfree.png)
  * [Security Training from BinaryMist](https://github.com/paragonie/awesome-appsec/blob/master/#-security-training-from-binarymist) ![nonfree](https://raw.githubusercontent.com/paragonie/awesome-appsec/master/img/nonfree.png)
  * [It's All About Time](#its-all-about-time-2014) (2014)
  * [Secure Authentication in PHP with Long-Term Persistence](#secure-authentication-in-php-with-long-term-persistence-2015) (2015)
  * [20 Point List For Preventing Cross-Site Scripting In PHP](#20-point-list-for-preventing-cross-site-scripting-in-php-2013) (2013)
  * [25 PHP Security Best Practices For Sys Admins](#25-php-security-best-practices-for-sys-admins-2011) (2011)
  * [PHP data encryption primer](#php-data-encryption-primer-2014) (2014)
  * [Preventing SQL Injection in PHP Applications - the Easy and Definitive Guide](#preventing-sql-injection-in-php-applications-the-easy-and-definitive-guide-2014) (2014)
  * [You Wouldn't Base64 a Password - Cryptography Decoded](#you-wouldnt-base64-a-password-cryptography-decoded-2015) (2015)
  * [A Guide to Secure Data Encryption in PHP Applications](#a-guide-to-secure-data-encryption-in-php-applications-2015) (2015)
  * [The 2018 Guide to Building Secure PHP Software](#the-2018-guide-to-building-secure-php-software-2017) (2017)
  * [Securing PHP: Core Concepts](https://github.com/paragonie/awesome-appsec/blob/master/#-securing-php-core-concepts) ![nonfree](https://raw.githubusercontent.com/paragonie/awesome-appsec/master/img/nonfree.png)
  * [SEI CERT Perl Coding Standard](#sei-cert-perl-coding-standard-2011) (2011)
  * [Black Hat Python: Python Programming for Hackers and Pentesters](https://github.com/paragonie/awesome-appsec/blob/master/#-black-hat-python-python-programming-for-hackers-and-pentesters) ![nonfree](https://raw.githubusercontent.com/paragonie/awesome-appsec/master/img/nonfree.png)
  * [Violent Python](https://github.com/paragonie/awesome-appsec/blob/master/#-violent-python) ![nonfree](https://raw.githubusercontent.com/paragonie/awesome-appsec/master/img/nonfree.png)
  * [OWASP Python Security Wiki](#owasp-python-security-wiki-2014) (2014)
  * [Secure Ruby Development Guide](#secure-ruby-development-guide-2014) (2014)

General¶

Articles¶

How to Safely Generate a Random Number (2014)¶

发布：2014 年 2 月 25 日

关于加密安全伪随机数生成器的建议.

Salted Password Hashing - Doing it Right (2014)¶

发布：2014 年 8 月 6 日

上的一个帖子 Crackstation, 一个项目 Defuse Security

A good idea with bad usage: /dev/urandom (2014)¶

发布：2014 年 5 月 3 日

提到了许多使 Linux/BSD 上的 /dev/urandom 失败的方法.

Why Invest in Application Security? (2015)¶

发布：2015 年 6 月 21 日

经营企业需要有成本意识并尽量减少不必要的支出. 大多数公司都看不到确保应用程序安全的好处，因此他们常常忽视投资安全软件开发作为一种节省成本的措施. 这些公司没有意识到可预防的数据泄露可能导致的潜在成本（财务和品牌声誉）.

平均数据泄露造成数百万美元的损失.

对于大多数公司来说，投入更多的时间和人员来开发安全软件是值得的，可以将这种不必要的风险降至最低.

Be wary of one-time pads and other crypto unicorns (2015)¶

发布：2015 年 3 月 25 日

对于希望构建自己的密码学功能的任何人来说都是必读.

Books¶

发布：2011 年 9 月 27 日

Web 应用程序安全性的精彩介绍；虽然有点过时了.

发布：2010 年 3 月 15 日

在展示密码设计技术时培养职业偏执感.

发布：2018 年 3 月 1 日

保护 DevOps 探讨了如何将 DevOps 和安全技术结合起来使云服务更安全. 这本介绍性书籍回顾了用于保护 Web 应用程序及其基础架构的最先进实践，并教您将安全性直接集成到您的产品中的技术.

发布：2009 年 5 月 3 日

发布：2006 年 11 月 30 日

发布：1996 年 8 月 30 日

发布：2005 年 4 月 15 日

发布：2008 年 5 月 1 日

发布：2007 年 6 月 17 日

发布：2009 年 3 月 3 日

发布：2008 年 8 月 22 日

发布：1998 年 6 月 25 日

发布：2004 年 12 月 29 日

发布：1989 年 12 月 13 日

发布：2009 年 8 月 3 日

Secure Programming HOWTO (2015)¶

发布：2015 年 3 月 1 日

Security Engineering - Second Edition (2008)¶

发布：2008 年 4 月 14 日

Released: August 1, 2014

Holistic Info-Sec for Web Developers (Fascicle 0) (2016)¶

发布：2016 年 9 月 17 日

系列丛书分为三部分，第一部分广泛而深入地介绍了 Web 开发人员和架构师需要了解的内容，以便创建稳健、可靠、可维护和安全的软件、网络和其他，这些软件、网络和其他软件、网络和其他软件、网络和其他软件、网络和其他软件、网络和其他软件、网络和其他软件、网络和其他软件、网络和其他软件、网络和其他软件、没有令人讨厌的惊喜.