Media Library

Comprehensive guide to finding and exploiting web application security flaws. Covers injection, authentication, session management, and more.

Deep dive into source code auditing and vulnerability discovery across C, C++, Java, and web technologies. The definitive SAST reference for practitioners.

Covers buffer overflows, integer overflows, memory safety, and secure coding practices for systems programming languages.

Java-focused security guide covering XSS, SQL injection, CSRF, authentication, and secure development lifecycle.

Framework for identifying, communicating, and understanding threats and mitigations. Essential for integrating security into the SDLC.

A guide to securing modern web applications, focusing on browser security models, HTTP, and the quirks of the web platform.

Beginner-friendly introduction to application security concepts, secure coding, and DevSecOps practices.

Hands-on introduction to exploitation techniques including buffer overflows, shellcode, and network programming from a low-level perspective.

Foundational book on integrating security into the software development lifecycle through risk analysis, code review, and testing.

Full course on using Semgrep for static analysis, writing custom rules, and integrating SAST into CI/CD pipelines.

Comprehensive walkthrough of the OWASP Top 10 vulnerabilities with real-world examples, detection techniques, and mitigations.

Learn how to perform effective code reviews with a security mindset — identifying injection flaws, logic bugs, and insecure patterns.

An overview of SAST concepts, tool categories, and how to evaluate SAST tools for enterprise use.

Conference talk from the author of Threat Modeling: Designing for Security on applying threat modeling to real systems.

Free interactive labs covering SQL injection, XSS, CSRF, SSRF, XXE, deserialization, and more with hands-on challenges.

Learn to embed SAST, DAST, and dependency scanning into GitHub Actions pipelines for shift-left security.

The definitive standard for the top 10 most critical web application security risks, backed by data from hundreds of organizations.

Comprehensive catalog of security and privacy controls for federal information systems, widely adopted in enterprise security programs.

Annually updated list of the most dangerous software weaknesses. Essential reference for SAST rule development and code review.

Academic evaluation of popular SAST tools comparing precision, recall, and false positive rates across real codebases.

Annual industry report on the state of software security, application vulnerability trends, and remediation benchmarks across thousands of apps.

Framework to help organizations formulate and implement a security strategy for software development that fits their risk profile.

Best practices for securing the software supply chain including dependency management, build pipelines, and artifact signing.

A list of the most widespread and critical programming errors that can lead to serious software vulnerabilities, co-produced with MITRE.