# Web Security Resources

Finds curated web security learning resources by topic, difficulty, and language.

- Repository: https://github.com/qazbnm456/awesome-web-security (13981 stars)
- Category: Security
- License: see repository
- Last updated: 2026-09-14
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add qazbnm456/awesome-web-security --skill awesome-web-security -g -a claude-code -y`
Codex: `npx skills add qazbnm456/awesome-web-security --skill awesome-web-security -g -a codex -y`
Cursor: `npx skills add qazbnm456/awesome-web-security --skill awesome-web-security -g -a cursor -y`
Gemini CLI: `npx skills add qazbnm456/awesome-web-security --skill awesome-web-security -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add qazbnm456/awesome-web-security`

## Description

Looks up curated web security learning resources (XSS, SQLi, CSRF, SSRF, OAuth/JWT, deserialization, SAML, recon, evasion, defensive tooling, CTF). Filters by topic, difficulty, language, and resource type. Returns top references with archive fallbacks. Defensive and educational use only.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# /awesome-web-security

Curated lookup over [qazbnm456/awesome-web-security](https://github.com/qazbnm456/awesome-web-security).
Always fetches the latest index from `raw.githubusercontent.com`, no stale snapshot.

## When to use

A user asks for resources, references, learning paths, or tools related to web
security topics: XSS, SQLi, CSRF, SSRF, XXE, OAuth/JWT, prototype pollution,
deserialization, SAML, file upload, web cache poisoning, WAF / CSP evasion,
browser exploitation, recon (subdomain enumeration, OSINT), DNS rebinding,
CTF write-ups, bug bounty methodology, defensive tooling, payload lists,
cheatsheets, or related blogs.

## When NOT to use

- The user wants to attack a target they do not own and have not been
  authorized to test. Decline and ask for scope: own system, CTF,
  authorized pentest, academic research, or defensive analysis.
- The user is asking for malware authoring, mass scanning of unowned
  infrastructure, or detection-evasion guidance for offensive purposes.
- The question has no security framing, it's general programming or
  framework usage. Hand off to a non-security skill.

## How

The rest: https://github.com/qazbnm456/awesome-web-security/blob/HEAD/skills/awesome-web-security/SKILL.md