Tools

cybervelia/graphicator

Automated GraphQL schema enumeration and data extraction tool that iterates introspection documents, reconstructs queries, and saves responses for…

go-appsec/toolbox

Collaborative application security testing between humans and agents via CLI and MCP

welfordian/mitm-proxy

Go-based MITM HTTP/HTTPS proxy with HTTP/2 and HTTP/1.1 interception, local CA/per-host cert generation, CONNECT/WebSocket tunneling, disk caching,…

m19o/graphqlgrapper

Burp Suite extension to extract and collect GraphQL API endpoints from HTTP request history for security testing and reconnaissance.

hannah-portswigger/totpauthenticate

This extension, for Burp Suite Enterprise Edition, utilizes session handling rules to provide a TOTP token to outgoing requests.

qianlijaingshan/milvus-auth-audit

Milvus 认证安全检测脚本：CVE-2025-64513 (sourceid后门) / CVE-2026-26190 (/expr弱token) / 内部端口53100

razureink/arisu

Scans public code repositories and code snippet platforms to extract and validate AI service API keys with real-time dashboard and multi-format…

maurosoria/dirsearch

Web path scanner

shoucheng3/perwendel__spark_cve-2016-9177_2-5-1

Exploit for CVE-2016-9177 targeting Spark Java web framework, demonstrating directory traversal vulnerability in version 2.5.1 for security testing…

shoucheng3/vert-x3__vertx-web_cve-2018-12542_3-5-3-cr1

Exploit for CVE-2018-12542 in Vert.x-Web, a Java web framework. Demonstrates a path traversal vulnerability allowing unauthorized access to static…

brinhosa/apidetector

Multi-threaded scanner for detecting exposed Swagger/OpenAPI endpoints across web domains and subdomains, with automatic XSS detection, PoC…

santandersecurityresearch/corsair_scan

Automated CORS misconfiguration scanner that tests Origin header injection, wildcard reflection, and credential leakage across web applications and…

hahwul/smugglex

Rust-powered HTTP Request Smuggling Scanner.

ngalongc/openapi_security_scanner

Automated authorization security scanner for OpenAPI-based APIs. Tests GET endpoints with multiple credential sets to detect privilege escalation and…

secsys-fdu/cve-2025-51862

Demonstrates an IDOR vulnerability in TelegAI's chat API allowing unauthorized conversation tampering, leading to phishing and XSS-based account…

rtcatc/packer-fuzzer

Packer Fuzzer is a fast and efficient scanner for security detection of websites constructed by javascript module bundler such as Webpack.

yalcinyolalan/wssat

WEB SERVICE SECURITY ASSESSMENT TOOL

ridhinva/langflow-cors-scanner

Scanner: CVE-2025-34291 Langflow Origin Validation Error / CORS Misconfiguration — Python checker (CISA KEV)