#1Tools for assessing the security of REST, SOAP, and GraphQL APIs.
Kitploit recommended
usestrix/strixOpen-source AI penetration testing tool to find and fix your app’s vulnerabilities.
mitmproxy/mitmproxyAn interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
sqlmapproject/sqlmapAutomatic SQL injection and database takeover tool
keygraphhq/shannonShannon is an autonomous, white-box AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes…
projectdiscovery/nucleiFast YAML-based vulnerability scanner with template-driven detection engine for automated security testing across web apps, APIs, networks, DNS, and…
mobsf/mobile-security-framework-mobsfAutomated mobile application security testing framework for Android, iOS, and Windows. Performs static and dynamic analysis, malware detection, and…
zaproxy/zaproxyOpen-source web application security scanner for automated vulnerability detection, manual penetration testing, and API security testing with a…
chaitin/safelineSelf-hosted WAF and reverse proxy that filters malicious HTTP traffic, blocks SQL injection, XSS, and bot attacks, with rate limiting and dynamic…
ffuf/ffufFast web fuzzer written in Go
maurosoria/dirsearchWeb path scanner
semgrep/semgrepLightweight static analysis for many languages. Find bug variants with patterns that look like source code.
httpie/cli🥧 HTTPie CLI — modern, user-friendly command-line HTTP client for the API era. JSON support, colors, sessions, downloads, plugins & more.
projectdiscovery/katanaA next-generation crawling and spidering framework.
projectdiscovery/httpxFast, multi-probe HTTP toolkit for reconnaissance and information gathering. Probes TLS, CSP, headers, tech stack, and CDN. Supports matchers,…
leebaird/discoverCustom Bash and Python scripts used to automate various penetration testing tasks including recon, scanning, enumeration, and malicious payload…
owasp/nettackerAutomated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management
epi052/feroxbusterA fast, simple, recursive content discovery tool written in Rust.
simoneavogadro/android-reverse-engineering-skillDecompiles Android APK/XAPK/JAR/AAR files and extracts HTTP APIs, authentication patterns, and call flows using jadx, with R8-resistant Kotlin name…
