Web Vulnerability Scanners

andresriancho/w3af

Open-source web application security scanner that identifies and exploits 200+ vulnerabilities including XSS, SQL injection, and OS commanding.…

m14r41/scan4secrets

Find credentials and secret with 170+ rules covering across source code, Web URL, and CI/CD, verifies them against vendor APIs, and generates SARIF,…

sqlmapproject/sqlmap

Automatic SQL injection and database takeover tool

awarexone/agentic-bug-hunter

AI-powered bug bounty hunting toolkit that works with or without subscription.

ffuf/ffuf

Fast web fuzzer written in Go

akha-security/akca

Evidence-oriented DAST scanner in Go that crawls web apps and APIs, then runs adaptive SQLi, XSS, RCE, SSRF, and auth checks with replayable proof.

projectdiscovery/nuclei-templates

Community curated list of templates for the nuclei engine to find security vulnerabilities.

devcop95/bugbounty-lab101

A complete bug bounty workspace for HackerOne researchers. Includes scope enforcement, automated recon/vuln pipeline (400+ tools), report templates,…

projectdiscovery/katana

A next-generation crawling and spidering framework.

1n3/sn1per

Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.

karim852/kumo-domain-recon-tool

Domain OSINT and security reconnaissance framework running 26 parallel modules for DNS, ports, subdomains, leaked credentials, exposed endpoints,…

sabri-zaki/easy_hack

Hack the World using Termux

urbanadventurer/whatweb

Next generation web scanner

piratesshield/apiharvester

The one shot API attacker tool - finds the API url from the given root simulate the automated attacks

jaeles-project/jaeles

The Swiss Army knife for automated Web Application Testing

projectdiscovery/httpx

Fast, multi-probe HTTP toolkit for reconnaissance and information gathering. Probes TLS, CSP, headers, tech stack, and CDN. Supports matchers,…

wapiti-scanner/wapiti

Web vulnerability scanner written in Python3