#1Tools for intercepting, analyzing, and modifying web traffic for security testing.
Kitploit recommended
apify/crawleeNode.js web scraping and browser automation library for building reliable crawlers with HTTP and headless browser support, proxy rotation, and…
modzero/burp-responseclustererBurp plugin that clusters responses to show an overview of received responses
hoodoer/colonelclusteredA Java Burp Plugin that performs text clustering on responses to identify outliers/groups based on the actual content of the server responses, say…
pentagridsec/pentagridresponseoverviewResponse Overview Extension for BurpSuite - Find exotic responses by grouping response bodies
hackvertor/repeat-strikeBurp Suite extension that uses AI-generated regex strike rules to detect IDOR and access-control flaws, then scans proxy history to find similar…
hackvertor/shadow-repeaterBurp Suite Repeater extension that automatically mutates payloads and analyzes responses to uncover path traversal, SQL injection, XSS, and other web…
portswigger/burp-extensions-montoya-api-examplesSample Burp Suite extensions demonstrating the Montoya API, covering HTTP and proxy handlers, custom scan checks, Intruder payloads, WebSocket…
confused-binary/waf-fuTerminal UI for browsing and replaying AWS WAF v2 logs from CloudWatch, S3, and the sampling API, with YAML filtering, auth detection, and…
davidvoitenko/proxy-workbenchCollects, checks and ranks public HTTP/SOCKS proxies against your own targets, then serves them via ranked exports, pools, a rotating gateway and a…
splinters-io/blinderContent-blind reverse proxy for exposure-protected security scanning
ejfkdev/avdrootRoot an Android Studio emulator by patching its ramdisk with Magisk — in pure Go.
bifrost-proxy/bifrostHigh-performance HTTP/HTTPS/SOCKS5 MITM proxy in Rust with TLS interception, rule-based request rewriting, traffic capture, breakpoints, script…
germondai/trawlSelf-hosted scraping engine — bypasses any JS challenge & captcha: Cloudflare, Turnstile, reCAPTCHA, hCaptcha, GeeTest. FlareSolverr & Byparr…
sunghoojung/reverse-engineering-browserLocal-first macOS research browser built on a custom Brave build that captures network traffic, fingerprints, scripts, and runtime evidence for…
absllk/hexestraAI-native penetration testing IDE where operators and an AI agent share browser, terminals, traffic capture, shells, asset graph, tasks, and evidence…
forefy/reburpA Burp Suite extension that exposes the full Montoya API as a local REST API, with Swagger UI
t0xodile-swig/http3-adapterBurp Suite extension that intercepts requests and sends them over HTTP/3, converting responses back for Burp, with support for kettled requests and…
danieldev23/frida-ssl-bypassFrida toolkit that bypasses SSL/TLS certificate pinning on Android apps, hooking Java TrustManager, OkHttp, Conscrypt, and native OpenSSL/BoringSSL…
