#1Tools specifically designed to exploit common web application vulnerabilities (e.g., SQL injection, XSS).
Kitploit recommended
swisskyrepo/payloadsallthethingsA list of useful payloads and bypass for Web Application Security and Pentest/CTF
enaqx/awesome-pentestA collection of awesome penetration testing resources, tools and other shiny things
usestrix/strixOpen-source AI penetration testing tool to find and fix your app’s vulnerabilities.
sqlmapproject/sqlmapAutomatic SQL injection and database takeover tool
keygraphhq/shannonShannon is an autonomous, white-box AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes…
projectdiscovery/nucleiFast YAML-based vulnerability scanner with template-driven detection engine for automated security testing across web apps, APIs, networks, DNS, and…
manisso/fsocietyfsociety Hacking Tools Pack – A Penetration Testing Framework
zaproxy/zaproxyOpen-source web application security scanner for automated vulnerability detection, manual penetration testing, and API security testing with a…
chaitin/safelineSelf-hosted WAF and reverse proxy that filters malicious HTTP traffic, blocks SQL injection, XSS, and bot attacks, with rate limiting and dynamic…
mr-xn/penetration_testing_poc渗透测试有关的POC、EXP、脚本、提权、小工具等---About penetration-testing python-script poc getshell csrf xss cms php-getshell domainmod-xss csrf-webshell cobub-razor…
infoslack/awesome-web-hackingCurated list of web application security resources including books, tools, cheat sheets, labs, and courses for learning penetration testing and…
ffuf/ffufFast web fuzzer written in Go
maurosoria/dirsearchWeb path scanner
webgoat/webgoatDeliberately vulnerable web application with interactive lessons and challenges for learning web application security and penetration testing…
beefproject/beefThe Browser Exploitation Framework Project
projectdiscovery/katanaA next-generation crawling and spidering framework.
elder-plinius/t3mp3stautonomous red teaming platform; multi-agent offensive-security meta-harness
wifiphisher/wifiphisherRogue Access Point framework for red team engagements and Wi-Fi security testing. Performs Evil Twin, KARMA, and Known Beacons attacks to achieve…
