#1Automated tools for detecting known vulnerabilities in systems and applications.
Kitploit recommended
cr0hn/dockerscanThe Most Comprehensive Docker Security Scanner
fullhunt/log4j-scanA fully automated, accurate, and extensive scanner for finding log4j RCE CVE-2021-44228
assetnote/react2shell-scannerHigh Fidelity Detection Mechanism for RSC/Next.js RCE (CVE-2025-55182 & CVE-2025-66478)
eth0izzle/shhgitAh shhgit! Find secrets in your code. Secrets detection for your GitHub, GitLab and Bitbucket repositories.
wallarm/gotestwafAn open-source project in Golang to asess different API Security tools and WAF for detection logic and bypasses
tuhinshubhra/cmseekCMS Detection and Exploitation suite - Scan WordPress, Joomla, Drupal and over 180 other CMSs
r0oth3x49/ghauriAn advanced cross-platform tool that automates the process of detecting and exploiting SQL injection security flaws
mozilla/cipherscanA very simple way to find out which SSL ciphersuites are supported by a target.
defparam/smugglerPython-based HTTP request smuggling and desync testing tool that detects CL.TE and TE.CL vulnerabilities using configurable mutation payloads and…
0xsteph/pentest-ai-agentsTurn Claude Code into your offensive security research assistant. Specialized AI subagents for authorized penetration testing plan engagements,…
devploit/nomore403403/401 bypass tool: finds HTTP access-control bypasses via path, method, header and raw-request mutations. Baseline diff, auto-calibration,…
stackrox/stackroxThe StackRox Kubernetes Security Platform performs a risk analysis of the container environment, delivers visibility and runtime alerts, and provides…
codingo/nosqlmapAutomated NoSQL database enumeration and web application exploitation tool.
assetnote/php2shell-scannerHigh fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)
stamparm/dsssDamn Small SQLi Scanner
ekultek/whatwafDetect and bypass web application firewalls and protection systems
aikidosec/safe-chainProtect against malicious code installed via npm, yarn, pnpm, npx, pnpx, pip, uv and poetry with Aikido Safe Chain. Free to use, no tokens required.
0xn0ne/weblogicscannerweblogic 漏洞扫描工具。目前包含对以下漏洞的检测能力：CVE-2014-4210、CVE-2016-0638、CVE-2016-3510、CVE-2017-3248、CVE-2017-3506、CVE-2017-10271、CVE-2018-2628、CVE-2018-2893、CVE-20…
