Tools for web apps

HTTP/S applications and APIs.

137 tools indexed

kcwarden

—

Audit Keycloak configuration for security misconfigurations

ScanHardenCloudWeb apps

PythonApache-2.0

mitmproxy

—

Interactive HTTPS proxy.

InterceptAnalyzeWeb appsNetworks

PythonMIT

promptfoo

—

Red-team prompts, agents and RAGs.

ScanFuzzWeb appsSource code

TypeScriptMIT

ptai

—

AI pentest tool that re-runs every exploit to verify it.

AutomateScanWeb apps

PythonMIT

reGeorg

—

SOCKS proxy through a web shell.

InterceptExploitWeb appsNetworks

PythonMIT

reNgine

—

Automated reconnaissance framework for web applications

ReconScanWeb appsNetworks

PythonGPL-3.0

reburp

—

Burp Suite extension exposing the Montoya API as a local REST API.

AutomateScanWeb apps

KotlinMIT

reconFTW

—

Automated recon and web vulnerability-scanning framework.

ReconScanWeb appsNetworks

ShellMIT

sn0int

—

Semi-automatic OSINT framework.

ReconAutomateWeb appsNetworks

RustGPL-3.0

snowpick

—

Scan ServiceNow instances for unauthenticated data exposure

ScanReconWeb appsCloud

GoMIT

sqlmap

—

Automatic SQL injection and database takeover.

ExploitScanWeb apps

PythonGPL-2.0

testssl.sh

—

Test TLS/SSL on any port.

ScanAnalyzeWeb appsNetworks

ShellGPL-2.0

theHarvester

—

E-mail and subdomain harvester.

ReconWeb appsNetworks

PythonGPL-2.0

w3af

—

Web application attack and audit framework.

ScanExploitWeb apps

PythonGPL-2.0

wafw00f

—

WAF fingerprinting.

ReconScanWeb apps

PythonBSD-3-Clause

waybackurls

—

Historical URLs from the Wayback Machine.

ReconWeb apps

GoMIT

ysoserial

—

Java deserialization payload generator.

ExploitWeb appsBinaries

JavaMIT