Dynamic Code Analysis (DAST)

zaproxy/zaproxy

Open-source web application security scanner for automated vulnerability detection, manual penetration testing, and API security testing with a…

go-delve/delve

Source-level debugger for Go with CLI, API, and headless modes; supports breakpoints, variable inspection, and execution tracing for efficient…

chaitin/safeline

Self-hosted WAF and reverse proxy that filters malicious HTTP traffic, blocks SQL injection, XSS, and bot attacks, with rate limiting and dynamic…

ffuf/ffuf

Fast web fuzzer written in Go

maurosoria/dirsearch

Web path scanner

projectdiscovery/katana

A next-generation crawling and spidering framework.

sullo/nikto

Nikto web server scanner

wpscanteam/wpscan

WordPress security scanner that detects vulnerabilities, enumerates plugins/themes/users, and checks for weak passwords. Integrates with the WPScan…

projectdiscovery/httpx

Fast, multi-probe HTTP toolkit for reconnaissance and information gathering. Probes TLS, CSP, headers, tech stack, and CDN. Supports matchers,…

rr-debugger/rr

Record and replay framework for deterministic debugging of multi-threaded applications, enabling reverse execution, hardware watchpoints, and…

s0md3v/xsstrike

Most advanced XSS scanner.

owasp/nettacker

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management

epi052/feroxbuster

A fast, simple, recursive content discovery tool written in Rust.

microsoft/detours

Runtime Windows API interception library for hooking, monitoring, and instrumenting function calls. Supports binary rewriting and DLL injection,…

tanprathan/mobileapp-pentest-cheatsheet

The Mobile App Pentest cheat sheet was created to provide concise collection of high value information on specific mobile application penetration…

cloudflare/security-audit-skill

A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings