#1Tools for analyzing application behavior during runtime to find security vulnerabilities.
Kitploit recommended
s0md3v/xsstrikeMost advanced XSS scanner.
zaproxy/zaproxyOpen-source web application security scanner for automated vulnerability detection, manual penetration testing, and API security testing with a…
cloudflare/security-audit-skillA coding-agent skill for multi-phase security audits with independently verified, machine-readable findings
bishopfox/mauidllExtract the managed (.NET) assemblies out of a MAUI Android assembly store.
lolcaken/javascript-deobfuscatorDeobfuscator for javascript-obfuscator 5.x output (string arrays, control-flow flattening, self-defending, RC4/base64)
dragonjar/burpiaExtensión de Burp Suite que incorpora detección pasiva de vulnerabilidades mediante inteligencia artificial.
sullo/niktoNikto web server scanner
ejfkdev/jscdReverse bytenode .jsc (V8 code cache) to JavaScript — static, pure Rust, no patched V8/Node. Node 8→26 / V8 5.8–14.6; 25k .jsc tested, 0 fail.
hahwul/dalfoxFast XSS scanner with parameter analysis, WAF fingerprinting, and DOM/AST verification. Supports reflected, stored, and DOM-based XSS detection via…
smackers/smackModular software verification toolchain that translates LLVM IR into Boogie intermediate verification language for bounded and experimental unbounded…
chichou/grapefruitOpen-source mobile security testing suite for iOS and Android. Previously Passionfruit
owasp/nettackerAutomated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management
lifting-bits/sleighCMake build of Ghidra's SLEIGH processor specification library, providing standalone disassembly and p-code lifting engines for reverse engineering…
go-delve/delveSource-level debugger for Go with CLI, API, and headless modes; supports breakpoints, variable inspection, and execution tracing for efficient…
google/honggfuzzSecurity oriented software fuzzer. Supports evolutionary, feedback-driven fuzzing based on code coverage (SW and HW based)
ejfkdev/ddcAndroid DEX → Java decompiler in Rust, built for speed — full apps in seconds, queries in milliseconds. Progressive analysis, javac-verified output,…
ylca0/idalib-cliAgent-native CLI wrapping IDA Pro IDALib for stateless, JSON-output binary analysis: disassembly, Hex-Rays decompilation, CFG, xrefs, strings, and…
trailofbits/polytrackerAn LLVM-based instrumentation tool for universal taint tracking, dataflow analysis, and tracing.
