# Awesome Web Security

> Looks up curated web security learning resources (XSS, SQLi, CSRF, SSRF, OAuth/JWT, deserialization, SAML, recon, evasion, defensive tooling, CTF). Filters by topic, difficulty, language, and resource type. Returns top references with archive fallbacks. Defensive and educational use only.

- Skill: `qazbnm456/awesome-web-security` (Agent Skill)
- Install (CLI): `npx skillmds@latest add qazbnm456/awesome-web-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/qazbnm456/awesome-web-security/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: qazbnm456 (https://skillmd.com/u/qazbnm456)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/qazbnm456/awesome-web-security

---


# /awesome-web-security

Curated lookup over [qazbnm456/awesome-web-security](https://github.com/qazbnm456/awesome-web-security).
Always fetches the latest index from `raw.githubusercontent.com` — no stale snapshot.

## When to use

A user asks for resources, references, learning paths, or tools related to web
security topics: XSS, SQLi, CSRF, SSRF, XXE, OAuth/JWT, prototype pollution,
deserialization, SAML, file upload, web cache poisoning, WAF / CSP evasion,
browser exploitation, recon (subdomain enumeration, OSINT), DNS rebinding,
CTF write-ups, bug bounty methodology, defensive tooling, payload lists,
cheatsheets, or related blogs.

## When NOT to use

- The user wants to attack a target they do not own and have not been
  authorized to test. Decline and ask for scope: own system, CTF,
  authorized pentest, academic research, or defensive analysis.
- The user is asking for malware authoring, mass scanning of unowned
  infrastructure, or detection-evasion guidance for offensive purposes.
- The question has no security framing — it's general programming or
  framework usage. Hand off to a non-security skill.

## How

1. Fetch the index with WebFetch:
   `https://raw.githubusercontent.com/qazbnm456/awesome-web-security/master/data/index.json`
2. Parse the JSON. Schema:
   ```
   {
     "schema_version": "1",
     "categories": [{"key": "xss", "title": "...", "h_level": 3, "parent": "intro", "anchor": "xss"}],
     "entries": [{
       "id": "xss-google-app-security",
       "url": "...",
       "title": "...",
       "author": {"name": "...", "url": "..."},
       "category": "xss",
       "type": "article|tool|cheatsheet|video|book|community|payload-list",
       "languages": ["en", "zh", "jp"],
       "difficulty": "intro|intermediate|advanced",
       "date_added": "YYYY-MM-DD",
       "archive_url": "...|null",
       "last_checked": "YYYY-MM-DD|null",
       "status": "active|dead|archived-only|quarantined"
     }]
   }
   ```
3. Filter by:
   - `category` matching the user's topic (a topic may map to several
     categories — for "XSS" check `xss`, `tools-xss`, `tricks-xss`,
     `practices-xss`, `evasions-csp` as relevant).
   - `languages`: default to the user's language; fall back to `en`.
   - `difficulty`: include all unless the user asked for "intro" or "deep".
   - `type`: filter by what the user wants — articles, tools, cheatsheets,
     payload lists, etc.
4. Rank by:
   - "Latest" requests → `date_added` DESC.
   - "Deep dive" requests → prefer `difficulty: advanced`, then by depth
     signals (long titles, payload-list type, presence of author URL).
   - "Tools" requests → `type: tool` only.
5. Return 5–7 entries; for each include title, URL, archive_url fallback if
   `status != active`, and a one-line value statement explaining what this
   entry teaches.

## Safety guardrails

- Refuse to assist with unauthorized targeting. Ask for scope.
- Frame all results defensively / educationally.
- For `payload-list` entries, append: "Test payloads only against systems
  you own or have written authorization to test."
- Do not chain entries into an attack playbook against a named real target.

## Output format

For each result:

> **[Title](url)** — *author* • *difficulty* • *type*
> One line on what this teaches and why it matters.
> *(Archive fallback: archive_url)* — included only when `status != active`.

End with:

> Cited from [qazbnm456/awesome-web-security](https://github.com/qazbnm456/awesome-web-security). Full list and categories at the README.

## Failure handling

- JSON fetch fails (network, 404, parse error) → respond:
  "The awesome-web-security index is temporarily unreachable. Try again
  shortly, or visit https://github.com/qazbnm456/awesome-web-security
  directly." Do NOT fabricate entries.
- No matches in the requested category → say so explicitly. Offer adjacent
  categories from `categories[].parent` chain.

## Examples

User: "I'm learning XSS, give me intermediate-level resources in English."
→ Filter `category` matching `xss`, `tools-xss`, `tricks-xss`, `evasions-csp`;
  `languages` contains `en`; `difficulty` in `intermediate` or `advanced`;
  rank by `date_added` DESC; return top 5–7.

User: "我想找最新的 SSRF 文章。"
→ Filter `category` matching `ssrf`, `tricks-ssrf`, `tools-ssrf`;
  `languages` contains `zh`; rank by `date_added` DESC; return in Chinese.

User: "What's a good XSS payload list?"
→ Filter `category: xss` AND `type: payload-list`; rank by depth signals.
  Append the unauthorized-testing reminder.