Tools

projectdiscovery/nuclei

Fast YAML-based vulnerability scanner with template-driven detection engine for automated security testing across web apps, APIs, networks, DNS, and…

chaitin/safeline

Self-hosted WAF and reverse proxy that filters malicious HTTP traffic, blocks SQL injection, XSS, and bot attacks, with rate limiting and dynamic…

jaeles-project/jaeles

The Swiss Army knife for automated Web Application Testing

whatswrongandwhy/ptrace

Linux ptrace-based process tracing and debugging utility for inspecting system calls, memory, and program execution flow.

projectdiscovery/httpx

Fast, multi-probe HTTP toolkit for reconnaissance and information gathering. Probes TLS, CSP, headers, tech stack, and CDN. Supports matchers,…

ffuf/ffuf

Fast web fuzzer written in Go

vladko312/sstimap

Automatic SSTI detection tool with interactive interface

s0md3v/xsstrike

Most advanced XSS scanner.

wapiti-scanner/wapiti

Web vulnerability scanner written in Python3

sullo/nikto

Nikto web server scanner

sqlmapproject/sqlmap

Automatic SQL injection and database takeover tool

go-delve/delve

Source-level debugger for Go with CLI, API, and headless modes; supports breakpoints, variable inspection, and execution tracing for efficient…

zaproxy/zaproxy

Open-source web application security scanner for automated vulnerability detection, manual penetration testing, and API security testing with a…

projectdiscovery/katana

A next-generation crawling and spidering framework.

cloudflare/security-audit-skill

A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings

wpscanteam/wpscan

WordPress security scanner that detects vulnerabilities, enumerates plugins/themes/users, and checks for weak passwords. Integrates with the WPScan…

urbanadventurer/whatweb

Next generation web scanner

trailofbits/polytracker

An LLVM-based instrumentation tool for universal taint tracking, dataflow analysis, and tracing.