Sources Cited by Checks and the Academy

Generated from the code by internal/sources (regenerate with go test ./internal/sources -update); do not edit by hand. Every reference that any check or Academy module cites is listed here, grouped by publisher, with the publisher's terms and any credit line those terms ask for. OpenVAPT cites sources by title, identifier and link; it does not copy their text. Use of a source does not imply that its publisher endorses OpenVAPT.

Totals: 289 distinct sources from 42 publishers, cited by 310 checks and 36 Academy modules.

NIST (National Institute of Standards and Technology)

Terms: Works of the U.S. Government, not subject to copyright in the United States. Cited by title, identifier and link.
Credit: Includes references to NIST publications and the National Vulnerability Database (NVD). Use of NIST material does not imply endorsement by NIST.

Source	Cited By
NIST IR 7966, Security of Interactive and Automated Access Management Using Secure Shell (SSH)	HOST-SSH-013
NIST SP 800-115, Technical Guide to Information Security Testing and Assessment	Academy A1, Academy A3, Academy A7, Academy F2, Academy P23, NET-FW-006, NET-LSN-001
NIST SP 800-119, Guidelines for the Secure Deployment of IPv6	NET-FW-002
NIST SP 800-12 Rev. 1, An Introduction to Information Security	Academy F1
NIST SP 800-123, Guide to General Server Security	Academy P1, Academy P17, Academy P22, HOST-BOOT-001, HOST-BOOT-002, HOST-BOOT-006, HOST-FS-001, HOST-FS-003, HOST-FS-010, HOST-FS-011, HOST-FS-012, HOST-FS-013, HOST-FS-014, HOST-FS-015, HOST-FS-016, HOST-FS-017, HOST-FS-018, HOST-FS-019, HOST-FS-020, HOST-FS-022, HOST-SEC-001, HOST-SSH-001, HOST-SVC-001, HOST-SVC-002, HOST-SVC-003, HOST-SVC-004, HOST-SVC-005, HOST-SVC-006, HOST-SVC-007, HOST-SVC-008, HOST-SVC-009, HOST-SVC-010, HOST-SVC-011, HOST-SVC-012, HOST-SYSD-001, HOST-USR-010, NET-SVC-001
NIST SP 800-131A Rev. 2, Transitioning Cryptographic Algorithms	HOST-SSH-004, NET-TLS-005
NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices	HOST-PKG-003
NIST SP 800-177 Rev. 1, Trustworthy Email	Academy P19, NET-MAIL-001
NIST SP 800-190, Application Container Security Guide	Academy A5, Academy P9, HOST-CTR-002, HOST-CTR-003, HOST-CTR-004, HOST-CTR-005, HOST-CTR-009, HOST-CTR-010, HOST-CTR-011, HOST-CTR-012, HOST-CTR-013, HOST-CTR-014
NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments	Academy F1
NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning	Academy A2, Academy P1, Academy P22, HOST-PKG-001, HOST-PKG-002, HOST-PKG-003, HOST-PKG-004, HOST-PKG-005, HOST-PKG-006, HOST-UPD-001, HOST-UPD-002
NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy	Academy P12, Academy P3, NET-FW-001, NET-FW-003, NET-FW-004, NET-FW-005, NET-FW-006
NIST SP 800-52 Rev. 2, Guidelines for TLS Implementations	Academy P18, Academy P4, NET-MAIL-002, NET-TLS-001, NET-TLS-002, NET-TLS-003, NET-TLS-004, WEB-APA-005, WEB-NGX-003
NIST SP 800-53 Rev. 5, Security and Privacy Controls	Academy P15, Academy P16, Academy P20, Academy P21, Academy P22, HOST-AUD-002, HOST-AUD-003, HOST-AUD-004, HOST-AUD-005, HOST-AUD-006, HOST-AUD-007, HOST-BOOT-006, HOST-BOOT-007, HOST-FS-014, HOST-IDS-001, HOST-PAM-002, HOST-PAM-003, HOST-PAM-007, HOST-PAM-008, HOST-PAM-009, HOST-PKG-005, HOST-PWD-004, HOST-SEC-001, HOST-TIME-001, HOST-USR-001, NET-DB-016, NET-DB-020
NIST SP 800-63B, Digital Identity Guidelines: Authentication	NET-DB-019, NET-DB-022
NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management	Academy P15, Academy P22, Academy P7, HOST-PAM-001, HOST-PAM-004, HOST-PAM-005, HOST-PAM-006, HOST-PWD-001, HOST-PWD-002, HOST-PWD-003, HOST-PWD-005, HOST-SSH-002
NIST SP 800-81 Rev. 2, Secure Domain Name System Deployment Guide	Academy P19, NET-DNS-002
NIST SP 800-92, Guide to Computer Security Log Management	Academy P16, Academy P21, HOST-AUD-001, HOST-AUD-002, HOST-AUD-003, HOST-AUD-004, HOST-AUD-005, HOST-AUD-006, HOST-AUD-007, HOST-AUD-008, HOST-AUD-009, HOST-AUD-010, HOST-AUD-011, HOST-LOG-001, HOST-LOG-003
NIST Transitioning Away from SHA-1	NET-TLS-006
NVD	HOST-CVE-001, HOST-CVE-002, HOST-CVE-003, WEB-CVE-001
NVD, CVE-2018-7600	WEB-CMS-011, WEB-CMS-012
NVD, CVE-2020-1938	WEB-TOM-004
NVD, CVE-2023-23752	WEB-CMS-010

The MITRE Corporation (ATT&CK, CWE, CVE)

Terms: Identifiers, names and links only, under the published ATT&CK, CWE and CVE terms of use.
Credit: © The MITRE Corporation. ATT&CK®, CVE® and CWE™ are trademarks of The MITRE Corporation; identifiers are cited under MITRE's published terms of use, and their use does not imply endorsement by MITRE.

Source	Cited By
CVE Program	Academy F3
CVE-2003-1418, Apache inode disclosure in ETag	WEB-APA-009
MITRE ATT&CK T1040, Network Sniffing	HOST-SVC-002, HOST-SVC-003, HOST-SVC-005, HOST-SVC-006
MITRE ATT&CK T1053.003, Scheduled Task/Job: Cron	Academy P20, HOST-CRON-001, HOST-FS-005
MITRE ATT&CK T1091, Replication Through Removable Media	HOST-BOOT-004
MITRE ATT&CK T1543.002, Create or Modify System Process: Systemd Service	Academy P11, HOST-SYSD-003
MITRE ATT&CK T1548, Abuse Elevation Control Mechanism	Academy P7
MITRE ATT&CK T1548.001, Setuid and Setgid	HOST-FS-004, HOST-FS-016
MITRE ATT&CK T1552.001, Unsecured Credentials: Credentials In Files	HOST-USR-007
MITRE ATT&CK T1574.007, Hijack Execution Flow: Path Interception by PATH Environment Variable	Academy P20, HOST-CRON-002, HOST-PAM-008
MITRE ATT&CK T1574.010, Hijack Execution Flow: Services File Permissions Weakness	HOST-SYSD-004
MITRE CWE	Academy F3

FIRST (Forum of Incident Response and Security Teams)

Terms: The CVSS v3.1 scale and vector notation are applied; the specification text is not copied.
Credit: CVSS is owned by FIRST.Org, Inc. and is used under the terms FIRST publishes for public use of CVSS, with attribution and a link to https://www.first.org/cvss/. FIRST does not endorse OpenVAPT.

Source	Cited By
FIRST, CVSS v3.1 Specification Document	Academy F3

OWASP Foundation

Terms: The cited OWASP projects are published under CC BY-SA 4.0. Cited by title, identifier and link; no text is copied.
Credit: References OWASP Top 10, ASVS, WSTG, Cheat Sheet Series and the OWASP Top 10 for Large Language Model Applications, © OWASP Foundation, CC BY-SA 4.0.

Source	Cited By
OWASP Application Security Verification Standard (ASVS)	Academy A8
OWASP Clickjacking Defense Cheat Sheet	WEB-HDR-003
OWASP Content Security Policy Cheat Sheet	WEB-HDR-002
OWASP Database Security Cheat Sheet	Academy P3, Academy P8, NET-DB-001
OWASP Docker Security Cheat Sheet	Academy A5, Academy P9, HOST-CTR-001, HOST-CTR-003, HOST-CTR-008, HOST-CTR-013
OWASP HTTP Headers Cheat Sheet	WEB-HDR-001, WEB-HDR-007
OWASP Key Management Cheat Sheet	HOST-FS-007
OWASP Logging Cheat Sheet	WEB-EXP-008
OWASP Node.js Security Cheat Sheet	Academy P13, NET-APP-002, WEB-NODE-002, WEB-NODE-003
OWASP PHP Configuration Cheat Sheet	WEB-PHP-001, WEB-PHP-002, WEB-PHP-003
OWASP Secrets Management Cheat Sheet	Academy P20, Academy P6, HOST-SEC-001, WEB-APP-002, WEB-APP-004, WEB-APP-009, WEB-DOC-001, WEB-DOC-003, WEB-EXP-002
OWASP Secure Headers Project	Academy P5, WEB-HDR-004, WEB-HDR-005, WEB-HDR-006
OWASP Session Management Cheat Sheet	Academy P5, WEB-CK-001
OWASP Top 10 2021, A05 Security Misconfiguration	Academy P6
OWASP Top 10 2021, A06 Vulnerable and Outdated Components	WEB-APP-008
OWASP Top 10 for Large Language Model Applications	Academy P24, NET-AI-001
OWASP Transport Layer Security Cheat Sheet	WEB-CMS-016, WEB-TLS-001
OWASP Vulnerable Dependency Management Cheat Sheet	WEB-APP-008
OWASP WSTG-CLNT-07, Testing Cross Origin Resource Sharing	WEB-COR-001
OWASP WSTG-CONF-02, Test Application Platform Configuration	Academy A6, WEB-APP-006, WEB-TOM-005
OWASP WSTG-CONF-04, Review Old Backup and Unreferenced Files	WEB-APA-010, WEB-APP-009, WEB-DOC-001, WEB-DOC-003, WEB-EXP-001, WEB-EXP-004, WEB-EXP-007, WEB-EXP-008, WEB-EXP-009, WEB-NGX-007
OWASP WSTG-CONF-05, Enumerate Infrastructure and Application Admin Interfaces	WEB-EXP-011
OWASP WSTG-CONF-06, Test HTTP Methods	WEB-APA-002
OWASP WSTG-CONF-09, Test File Permission	WEB-APP-010, WEB-DOC-002
OWASP WSTG-ERRH-01, Testing for Improper Error Handling	WEB-EXP-012
OWASP WSTG-INFO-02, Fingerprint Web Server	WEB-APA-001, WEB-EXP-010, WEB-NGX-001
OWASP WSTG-INPV-17, Testing for Host Header Injection	WEB-CMS-013
OWASP Web Security Testing Guide	Academy F2
OWASP Web Security Testing Guide, Configuration and Deployment Management Testing	Academy P18

Center for Internet Security (CIS)

Terms: CIS Controls v8 is published by the Center for Internet Security, Inc. under CC BY-NC-ND 4.0. Referred to by Control number and link only; no CIS text is reproduced.
Credit: CIS Controls® is a trademark of the Center for Internet Security, Inc. Use does not imply endorsement by CIS.

Source	Cited By
CIS Critical Security Controls	Academy A8
CIS Critical Security Controls v8, Control 5 (Account Management)	HOST-PWD-005
CIS Docker Benchmark (referenced by recommendation number)	Academy A5, HOST-CTR-005, HOST-CTR-006, HOST-CTR-007, HOST-CTR-008, HOST-CTR-010, HOST-CTR-012, HOST-CTR-013, HOST-CTR-015

IETF / RFC Editor

Terms: RFCs are © IETF Trust and the persons identified as authors (BCP 78). Cited by number, title and link.

Source	Cited By
RFC 5321, Simple Mail Transfer Protocol, section 7.3	NET-MAIL-003
RFC 5905, Network Time Protocol Version 4	Academy P16
RFC 6125, Representation and Verification of Domain-Based Application Service Identity	NET-TLS-003
RFC 6265, HTTP State Management Mechanism	WEB-CK-001
RFC 6797, HTTP Strict Transport Security	Academy P4, WEB-HDR-001
RFC 7525, Recommendations for Secure Use of TLS and DTLS	WEB-APA-006, WEB-NGX-004
RFC 8996, Deprecating TLS 1.0 and TLS 1.1	Academy P4, NET-MAIL-002, NET-MAIL-004, NET-TLS-001, NET-TLS-004, WEB-NGX-003
RFC 9116, A File Format to Aid in Security Vulnerability Disclosure	WEB-SEC-001
RFC 9142, Key Exchange Method Updates for SSH	Academy P2, HOST-SSH-004

CISA (U.S. Cybersecurity and Infrastructure Security Agency)

Terms: U.S. Government work. Cited by title and link; the KEV catalogue is used only by the release pipeline.

Source	Cited By
CISA Alert TA14-013A, NTP Amplification Attacks Using CVE-2013-5211	NET-SVC-003
CISA KEV	Academy P10, HOST-CVE-001, HOST-CVE-002, HOST-CVE-003
CISA, DNS Amplification Attacks (Alert TA13-088A)	Academy P8

OSV (Open Source Vulnerabilities, osv.dev) and the OSV Schema (OpenSSF)

Terms: Cited by link. Advisory data is downloaded only by the release pipeline; licences vary by originating database and are recorded per release (docs/VULNDB.md).

Source	Cited By
OSV schema, defined ecosystems (WordPress)	WEB-CVE-001
OSV vulnerability database	Academy P10, HOST-CVE-001, HOST-CVE-002, HOST-CVE-003, WEB-CVE-001

OASIS Open

Terms: The SARIF 2.1.0 format is implemented; the specification text is not copied.

Source	Cited By
OASIS SARIF 2.1.0	Academy A3, Academy A7

W3C

Terms: Copyright of the publisher. Cited by title and link only; no text is copied.

Source	Cited By
W3C Content Security Policy Level 3	WEB-HDR-002

IANA

Terms: Public registry data (port numbers) consulted; cited by link.

Source	Cited By
IANA Service Name and Transport Protocol Port Number Registry	NET-SVC-002, NET-SVC-004

PTES (Penetration Testing Execution Standard)

Terms: Copyright of the publisher. Cited by title and link only; no text is copied.

Source	Cited By
Penetration Testing Execution Standard (PTES) Technical Guidelines	Academy F2

Linux Kernel Documentation

Terms: Kernel documentation is generally distributed under GPL-2.0; individual files may carry other licences. Cited by title and link only.

Source	Cited By
Linux kernel documentation, /proc/sys/fs	HOST-KRN-004, HOST-KRN-011, HOST-KRN-012, HOST-KRN-020, HOST-KRN-021
Linux kernel documentation, /proc/sys/kernel	Academy P17, HOST-BOOT-008, HOST-FS-018, HOST-KRN-001, HOST-KRN-002, HOST-KRN-003, HOST-KRN-009, HOST-KRN-018
Linux kernel documentation, /proc/sys/vm	HOST-KRN-028
Linux kernel documentation, IP sysctl	HOST-KRN-005, HOST-KRN-006, HOST-KRN-007, HOST-KRN-008, HOST-KRN-013, HOST-KRN-014, HOST-KRN-015, HOST-KRN-016, HOST-KRN-017, HOST-KRN-023, HOST-KRN-024, HOST-KRN-025, HOST-KRN-026
Linux kernel documentation, Kernel module signing facility	HOST-BOOT-005
Linux kernel documentation, Linux Magic System Request Key Hacks	HOST-KRN-019
Linux kernel documentation, Linux Security Module development and LSMs	HOST-MAC-001
Linux kernel documentation, Yama LSM	HOST-KRN-010
NFS security, Linux kernel documentation (exports and rpcbind)	HOST-SVC-008

Linux Manual Pages (man7.org, Ubuntu and Debian Manpages)

Terms: Man pages carry per-page licences. Cited by page name and link only.

Source	Cited By
Linux exports(5)	NET-DB-008
apt-get(8), Debian trixie manual pages (autoremove)	HOST-PKG-004
apt-secure(8), Debian manual pages	HOST-PKG-002
at(1), Linux man-pages (at.allow and at.deny)	HOST-FS-019
auditctl(8), Linux man-pages	Academy P21, HOST-AUD-002, HOST-AUD-003, HOST-AUD-004, HOST-AUD-005, HOST-AUD-006, HOST-AUD-007
auditd(8), Linux man-pages	Academy P16, HOST-AUD-001, HOST-LOG-002
auditd.conf(5), Linux man-pages	HOST-AUD-008, HOST-AUD-009
chmod(1), Linux man-pages (restricted deletion flag)	HOST-FS-002, HOST-FS-017
crontab(1), Linux man-pages (cron.allow and cron.deny)	HOST-FS-019
crontab(5), Linux man-pages	HOST-CRON-001, HOST-CRON-002, HOST-FS-005, HOST-FS-020
crypt(5), libxcrypt, Debian trixie manual pages (hashing methods)	HOST-PWD-002
dnf.conf(5), Ubuntu noble manual pages (gpgcheck)	HOST-PKG-002
group(5), Linux man-pages	HOST-USR-008
limits.conf(5), Linux-PAM	HOST-BOOT-008
login.defs(5), Linux man-pages	HOST-FS-009, HOST-FS-021, HOST-PAM-005, HOST-PAM-006, HOST-PWD-001, HOST-PWD-005, HOST-USR-010
logrotate(8), Linux man-pages	HOST-LOG-004
modprobe.d(5), Linux man-pages	HOST-BOOT-003, HOST-BOOT-004
mount(8), Linux man-pages (nodev, nosuid, noexec)	HOST-FS-008, HOST-FS-010, HOST-FS-011, HOST-FS-012, HOST-FS-013
nologin(8), Linux man-pages	HOST-USR-005
nsswitch.conf(5), Linux man-pages (compat mode)	HOST-USR-006
pam.conf(5), Linux man-pages (PAM configuration)	Academy P22
pam_faillock(8), Linux-PAM	Academy P15, HOST-PAM-002, HOST-PWD-004
pam_pwhistory(8), Linux-PAM	HOST-PAM-004
pam_unix(8), Linux-PAM	HOST-PAM-004
pam_wheel(8), Linux-PAM	HOST-PAM-003
passwd(5), Linux man-pages	HOST-FS-015, HOST-USR-001, HOST-USR-004, HOST-USR-008, HOST-USR-009
prelink(8), Linux man-pages	HOST-BOOT-007
[proc(5), Linux man-pages (/proc/\[pid\]/mounts)](https://man7.org/linux/man-pages/man5/proc.5.html)	HOST-FS-010, HOST-FS-011, HOST-FS-012
proc_net(5), Linux man-pages	NET-LSN-001
pwck(8), Linux man-pages	Academy P20, HOST-USR-009
pwquality.conf(5), libpwquality, Debian trixie manual pages	HOST-PAM-001, HOST-PWD-003
rsyslog.conf(5), Debian trixie manual pages (forwarding actions)	HOST-AUD-011
shadow(5), Linux man-pages	HOST-FS-001, HOST-FS-022, HOST-USR-002, HOST-USR-009
sources.list(5), Debian manual pages	HOST-PKG-003
ufw(8) manual (Ubuntu)	NET-FW-003
umask(2), Linux man-pages	HOST-FS-009, HOST-FS-021
user_namespaces(7), Linux man-pages	HOST-KRN-022
useradd(8), Linux man-pages (default INACTIVE value)	HOST-PAM-007

OpenBSD (OpenSSH Manual Pages)

Terms: Manual pages generally under BSD or ISC style licences. Cited by page name and link only.

Source	Cited By
OpenBSD, sshd_config(5) manual page	Academy P2, HOST-SSH-001, HOST-SSH-002, HOST-SSH-003, HOST-SSH-004, HOST-SSH-005, HOST-SSH-006, HOST-SSH-007, HOST-SSH-008, HOST-SSH-009, HOST-SSH-010, HOST-SSH-011, HOST-SSH-012
sshd(8), AUTHORIZED_KEYS FILE FORMAT, OpenBSD manual pages	Academy P20, HOST-SSH-013

freedesktop.org and systemd

Terms: Copyright of the publisher. Cited by title and link only; no text is copied.

Source	Cited By
coredump.conf(5), systemd	HOST-BOOT-008
journal-upload.conf(5), systemd	HOST-AUD-011
journald.conf(5), systemd	Academy P21, HOST-AUD-010, HOST-LOG-001
systemd, System and Service Credentials	Academy P11, HOST-SYSD-005
systemd-analyze(1), security verb	HOST-SYSD-002
systemd.exec(5), execution environment configuration	Academy P11, HOST-SYSD-001, HOST-SYSD-002, HOST-SYSD-004, HOST-SYSD-005
systemd.unit(5), unit configuration	HOST-SYSD-003

Kernel Self Protection Project (KSPP)

Terms: Recommended settings are cited by title and link only; the project's text is not copied.

Source	Cited By
Kernel Self Protection Project, Recommended Settings	Academy P17, HOST-BOOT-003, HOST-BOOT-005, HOST-KRN-022, HOST-KRN-027, HOST-KRN-029, HOST-KRN-030, HOST-KRN-031

UEFI Forum

Terms: The UEFI Specification is cited by section title and link only.

Source	Cited By
UEFI Specification, Secure Boot and Driver Signing	HOST-BOOT-002

AIDE Project

Terms: Copyright of the publisher. Cited by title and link only; no text is copied.

Source	Cited By
AIDE, Advanced Intrusion Detection Environment	Academy P17, HOST-BOOT-006

GNU Project

Terms: Most GNU manuals are published under the GNU FDL. Cited by title and link only.

Source	Cited By
Bash Reference Manual, Bash Variables (TMOUT)	HOST-PAM-009
GNU GRUB Manual, Security	Academy P17, HOST-BOOT-001, HOST-FS-006

sudo Project

Terms: Copyright of the publisher. Cited by title and link only; no text is copied.

Source	Cited By
sudoers(5) manual	Academy P15, HOST-SUDO-001, HOST-USR-003

nftables Project

Terms: Copyright of the publisher. Cited by title and link only; no text is copied.

Source	Cited By
nftables wiki	NET-FW-001

chrony Project

Terms: Copyright of the publisher. Cited by title and link only; no text is copied.

Source	Cited By
chrony Documentation - Access Control	NET-SVC-003

Linux Distributions (Debian, Ubuntu, Red Hat)

Terms: Copyright of the publisher. Cited by title and link only; no text is copied.

Source	Cited By
Debian Policy Manual, Version numbering	Academy P10
Debian releases and LTS	HOST-OS-001
Debian, UnattendedUpgrades	HOST-PKG-001, HOST-PKG-006, HOST-UPD-001
Red Hat Enterprise Linux life cycle	HOST-OS-001
Ubuntu release cycle	HOST-OS-001

endoflife.date (Community-Maintained)

Terms: Community-maintained data, published by the project under its stated open licence, consulted for release dates, cross-checked with vendor pages.

Source	Cited By
endoflife.date (community-maintained lifecycle data)	HOST-OS-001
endoflife.date, Node.js (community-maintained lifecycle data)	WEB-NODE-001

Mozilla (MDN Web Docs and Mozilla Wiki)

Terms: MDN prose is published by Mozilla Contributors under CC BY-SA 2.5; Mozilla wiki pages carry the licence stated on the wiki. Cited by title and link only.

Source	Cited By
MDN Web Docs, Access-Control-Allow-Origin	WEB-COR-001
MDN Web Docs, Permissions-Policy	WEB-HDR-006
MDN Web Docs, Referrer-Policy	WEB-HDR-005
MDN Web Docs, Strict-Transport-Security	WEB-HDR-001
MDN Web Docs, X-Content-Type-Options	WEB-HDR-004
MDN Web Docs, X-Frame-Options	WEB-HDR-003
Mozilla SSL Configuration Generator	Academy P18, WEB-APA-006, WEB-APA-007, WEB-NGX-004, WEB-NGX-005
Mozilla Server Side TLS guidelines	Academy P18, NET-TLS-001, NET-TLS-004, WEB-APA-005, WEB-NGX-003, WEB-NGX-004

Let's Encrypt (ISRG)

Terms: Copyright of the publisher. Cited by title and link only; no text is copied.

Source	Cited By
Let's Encrypt, certificate lifetimes and renewal	NET-TLS-002

Apache Software Foundation (HTTP Server, Tomcat)

Terms: Apache documentation is published under the Apache License 2.0. Cited by title and link only.

Source	Cited By
Apache HTTP Server, AllowOverride directive	WEB-APA-004
Apache HTTP Server, DirectoryMatch directive	WEB-APA-010
Apache HTTP Server, FileETag directive	WEB-APA-009
Apache HTTP Server, Options directive	WEB-APA-003, WEB-EXP-005
Apache HTTP Server, SSLCipherSuite directive	WEB-APA-006
Apache HTTP Server, SSLProtocol directive	WEB-APA-005
Apache HTTP Server, SSLUseStapling directive	WEB-APA-007
Apache HTTP Server, Security Tips	Academy P18, WEB-APA-004, WEB-APA-008, WEB-APA-011
Apache HTTP Server, ServerTokens directive	WEB-APA-001, WEB-HDR-007
Apache HTTP Server, TraceEnable directive	WEB-APA-002
Apache HTTP Server, mod_reqtimeout	Academy P25, WEB-APA-011
Apache HTTP Server, mod_status	WEB-EXP-006
Apache Tomcat 10.1 Configuration Reference, The AJP Connector	WEB-TOM-004
Apache Tomcat 10.1 Configuration Reference, The Server Component	WEB-TOM-003
Apache Tomcat 10.1, Manager App How-To	WEB-TOM-001
Apache Tomcat 10.1, Realm Configuration How-To (digested passwords)	WEB-TOM-002
Apache Tomcat 10.1, Security Considerations	Academy P13, WEB-TOM-001, WEB-TOM-002, WEB-TOM-003, WEB-TOM-004, WEB-TOM-005
Apache Tomcat 9, AJP Connector	NET-APP-001

nginx Documentation (F5, Inc.)

Terms: nginx documentation is published by the nginx project under its stated BSD-style licence. Cited by title and link only.

Source	Cited By
nginx documentation, ngx_http_autoindex_module	WEB-NGX-002
nginx documentation, ngx_http_core_module	WEB-NGX-001, WEB-NGX-006, WEB-NGX-007
nginx documentation, ngx_http_limit_req_module	Academy P25, WEB-NGX-006
nginx documentation, ngx_http_ssl_module	Academy P18, WEB-NGX-003, WEB-NGX-005

OpenSSL Project (documentation)

Terms: OpenSSL documentation is published by the OpenSSL Project under the Apache License 2.0. Cited by title and link only.

Source	Cited By
OpenSSL, config(5): system default TLS settings (MinProtocol)	WEB-APA-005, WEB-NGX-003

OWASP CRS Project (Core Rule Set)

Terms: The OWASP CRS documentation is published under the Apache License 2.0. Cited by title and link only.

Source	Cited By
OWASP ModSecurity Core Rule Set	WEB-APA-008

PHP Documentation

Terms: The PHP manual is published under CC BY 3.0. Cited by title and link only.

Source	Cited By
PHP manual, Session security	WEB-PHP-005
PHP manual, php.ini directives	WEB-PHP-001, WEB-PHP-002, WEB-PHP-003, WEB-PHP-005
PHP manual, phpinfo()	WEB-EXP-003
PHP, Supported Versions	WEB-PHP-004

Web Frameworks and Runtimes (Django, Flask, Werkzeug, Node.js, Express, Gunicorn)

Terms: Copyright of the publisher. Cited by title and link only; no text is copied.

Source	Cited By
Django documentation, Deployment checklist	Academy P13, WEB-PY-001, WEB-PY-002, WEB-PY-003
Django documentation, django-admin runserver (not for production)	WEB-PY-005
Django settings reference, ALLOWED_HOSTS	WEB-PY-002
Django settings reference, DEBUG	WEB-PY-001
Django settings reference, SECRET_KEY	WEB-PY-003
Express documentation, Production best practices: performance and reliability	WEB-NODE-003
Flask documentation, Debug mode	WEB-APP-007, WEB-PY-004
Flask documentation, Deploying to Production	WEB-APP-007, WEB-PY-005
Gunicorn documentation, Deploying Gunicorn (behind a proxy)	NET-APP-002
Node.js documentation, Debugging guide (security implications)	WEB-NODE-002
Node.js, Inspector security implications	NET-APP-001
Werkzeug documentation, Debugging Applications	WEB-PY-004

Content Management Systems (WordPress, Drupal, Joomla)

Terms: Copyright of the publisher. Cited by title and link only; no text is copied.

Source	Cited By
Drupal.org, Drupal core release cycle and end of life	WEB-CMS-012
Drupal.org, Running update.php (update_free_access)	WEB-CMS-019
Drupal.org, Securing file permissions and ownership	Academy P14, WEB-CMS-004, WEB-CMS-005, WEB-CMS-019
Drupal.org, Security advisories	WEB-CMS-011
Drupal.org, Trusted Host settings	Academy A6, WEB-CMS-013
Joomla Documentation, Joomla Release and Support Cycle	WEB-CMS-014
Joomla Documentation, Security Checklist	Academy P14, WEB-CMS-010, WEB-CMS-014
Joomla Documentation, Security Checklist: Site Administration	WEB-CMS-009
WordPress Developer Resources, Brute Force Attacks (XML-RPC)	WEB-CMS-002, WEB-CMS-018
WordPress Developer Resources, Configuring Automatic Background Updates	WEB-CMS-008
WordPress Developer Resources, Debugging in WordPress	WEB-CMS-006
WordPress Developer Resources, Editing wp-config.php	WEB-CMS-007
WordPress Developer Resources, Hardening WordPress	Academy P14, WEB-CMS-001, WEB-CMS-004, WEB-CMS-005, WEB-CMS-007, WEB-CMS-017, WEB-CMS-018
WordPress Developer Resources, Hooking WP-Cron Into the System Task Scheduler	WEB-CMS-017
WordPress Developer Resources, REST API Users endpoint	WEB-CMS-003

Application Frameworks (Laravel, Symfony, Ruby on Rails, Spring Boot)

Terms: Copyright of the publisher. Cited by title and link only; no text is copied.

Source	Cited By
Laravel documentation, Configuration (debug mode, environment files)	WEB-APP-001
Laravel documentation, Deployment	Academy A6, WEB-APP-001, WEB-APP-010
Ruby on Rails Guides, Configuring Rails Applications	WEB-APP-005
Ruby on Rails Guides, Custom Credentials	WEB-APP-004
Ruby on Rails Guides, Securing Rails Applications	Academy A6, WEB-APP-004, WEB-APP-005
Spring Boot documentation, Actuator endpoints	Academy A6, WEB-APP-006
Spring Boot documentation, Securing HTTP endpoints	WEB-APP-006
Symfony documentation, Configuring Symfony (environments)	WEB-APP-003
Symfony documentation, How to Deploy a Symfony Application	Academy A6, WEB-APP-003
Symfony documentation, Setting up or Fixing File Permissions	WEB-APP-010

Commerce and Publishing Platforms (Adobe Commerce, Ghost)

Terms: Copyright of the publisher. Cited by title and link only; no text is copied.

Source	Cited By
Adobe Commerce documentation, Security best practices	WEB-CMS-015
Adobe Commerce documentation, Set the Magento mode	WEB-CMS-015
Ghost documentation, Configuration (url)	WEB-CMS-016

Containers and Orchestration (Docker, Kubernetes)

Terms: Copyright of the publisher. Cited by title and link only; no text is copied.

Source	Cited By
Docker documentation, AppArmor security profiles	HOST-CTR-011
Docker documentation, Configure logging drivers	HOST-CTR-005
Docker documentation, Content trust in Docker	HOST-CTR-015
Docker documentation, Docker Engine security	Academy A5, HOST-CTR-002
Docker documentation, Docker daemon attack surface	HOST-DKR-001
Docker documentation, Packet filtering and firewalls	Academy P12, NET-FW-005
Docker documentation, Protect the Docker daemon socket	HOST-CTR-001, HOST-CTR-004, HOST-CTR-008, NET-SVC-002
Docker documentation, Resource constraints	HOST-CTR-012
Docker documentation, Rootless mode	Academy A5, HOST-CTR-009
Docker documentation, Seccomp security profiles	HOST-CTR-011
Docker documentation, dockerd daemon reference	HOST-CTR-006, HOST-CTR-007, HOST-CTR-010
Kubernetes Ports and Protocols	NET-SVC-002
Kubernetes documentation, Kubelet authentication and authorization	Academy P9, HOST-K8S-001
Kubernetes documentation, Operating etcd clusters for Kubernetes	HOST-K8S-002
Kubernetes documentation, Securing a cluster	HOST-K8S-001, HOST-K8S-002, HOST-K8S-003

Prometheus (The Linux Foundation)

Terms: Copyright of the publisher. Cited by title and link only; no text is copied.

Source	Cited By
Prometheus, Security model	NET-SVC-004

Databases and Data Services (MySQL, PostgreSQL, MongoDB, Redis, Memcached, Elastic)

Terms: Copyright of the publisher. Cited by title and link only; no text is copied.

Source	Cited By
Elastic Security Minimal Setup	NET-DB-007
MongoDB Security Checklist	NET-DB-003
MySQL 8.4 Reference Manual, Configuring MySQL to Use Encrypted Connections	NET-DB-016
MySQL 8.4 Reference Manual, Server System Variables	NET-DB-017
MySQL 8.4 Reference Manual, The Error Log	NET-DB-017
MySQL 8.4 Reference Manual, Using Symbolic Links	NET-DB-014
MySQL 8.4 Reference Manual, secure_file_priv	NET-DB-015
MySQL 8.4 Reference Manual, skip_name_resolve	NET-DB-018
MySQL Server Security Guidelines	Academy P19, NET-DB-005, NET-DB-014, NET-DB-015, NET-DB-018
PostgreSQL Client Authentication	NET-DB-004
PostgreSQL, Authentication Methods	NET-DB-019
PostgreSQL, Connections and Authentication	NET-DB-022
PostgreSQL, Error Reporting and Logging	NET-DB-021
PostgreSQL, Password Authentication	Academy P19, NET-DB-019, NET-DB-022
PostgreSQL, Secure TCP/IP Connections with SSL	NET-DB-020
Redis ACL	NET-DB-023
Redis security	Academy P19, Academy P8, NET-DB-001, NET-DB-002, NET-DB-023
memcached Configuration	NET-DB-006

Network Services (BIND 9, Samba, Postfix, Dovecot)

Terms: Copyright of the publisher. Cited by title and link only; no text is copied.

Source	Cited By
BIND 9 Administrator Reference Manual - Access Control	NET-DB-010
BIND 9 Administrator Reference Manual - allow-transfer	NET-DB-011
BIND 9 Administrator Reference Manual, dnssec-validation	NET-DNS-002
BIND 9 Administrator Reference Manual, options	NET-DNS-001
BIND 9 Administrator Reference Manual, version statement	NET-DNS-001
Dovecot Authentication Settings	NET-DB-013
Dovecot SSL/TLS Configuration	Academy P19, NET-MAIL-004
Postfix Configuration Parameters	NET-MAIL-001
Postfix SMTP Relay and Access Control	NET-DB-012
Postfix TLS Support	Academy P19, NET-MAIL-001, NET-MAIL-002
Postfix, disable_vrfy_command	NET-MAIL-003
Samba smb.conf Manual	NET-DB-009

AI Tooling Documentation (Project Jupyter, Ray)

Terms: Copyright of the publisher. Cited by title and link only; no text is copied.

Source	Cited By
Jupyter Server documentation, Security in the Jupyter Server	Academy P24, NET-AI-002
Ray documentation, Security	NET-AI-001

Projects Hosted on GitHub (Publisher Named in Each Title)

Terms: Copyright of the publisher. Cited by title and link only; no text is copied.

Source	Cited By
Node.js Release Working Group, release schedule	WEB-NODE-001
OWASP ASVS 4.0.3, V14 Configuration	Academy A6, WEB-APP-001, WEB-APP-002, WEB-APP-003
Ollama FAQ, How do I configure Ollama server?	NET-AI-001
OpenVAPT source code	Academy A4
containerd documentation, Operations (configuration)	HOST-CTR-014
containers.conf(5), Podman configuration	HOST-CTR-014
fail2ban project	HOST-IDS-001

Cite This Work: OpenVAPT. (2026). OpenVAPT: An open academic vulnerability assessment tool (Version 0.1.0-alpha.6) [Computer software]. https://github.com/OpenVAPT/openvapt