Tools

0xmarik/aresius

Native HTTP/HTTPS interception proxy for penetration testers and bug bounty hunters with live request tampering, request replay, high-speed fuzzing,…

hahwul/gori

A fast, keyboard-driven HTTP intercepting proxy and hacking & pentesting toolkit for the terminal.

wapiti-scanner/wapiti

Web vulnerability scanner written in Python3

chrislockard/api_wordlist

A wordlist of API names for web application assessments

epi052/feroxfuzz

Build structure-aware black-box HTTP fuzzers in Rust with composable mutators, schedulers, observers, deciders, and processors for custom web and API…

net-hunter121/api-wordlist

Curated wordlists of API function names, verbs, and nouns for fuzzing web application endpoints with Burp Suite Intruder.

caido-community/paramfinder

Discover hidden parameters in Caido

compasssecurity/samlraider

SAML2 Burp Extension

raz0r/burp-radamsa

Radamsa fuzzer extension for Burp Suite

owasp/pysap

pysap is an open source Python library that provides modules for crafting and sending packets using SAP's NI, Diag, Enqueue, Router, MS, SNC, IGS,…

fevra-dev/claimjumper

Professional JWT security testing toolkit. Analyze, crack, forge, and exploit JSON Web Tokens with 15+ vulnerability checks, 100k secret wordlist,…

teycir/burpapisecuritysuite

Burp Suite extension for API security testing with 15 attack types, 108+ payloads, intelligent fuzzing, BOLA/IDOR detection, AI integration, and…

hackinglz/maps_scanner

MAPS cloud scanner and response parser for Microsoft Defender research.

bogdanticu88/ratrace

A lightweight CLI tool for systematically detecting and exploiting race conditions in web applications, APIs, and modern services.

mda2av/http11probe

An open testing platform that probes HTTP/1.1 servers against RFC 9110/9112 requirements, smuggling vectors, and malformed input handling. Add your…

functori/dev/gaia

Global API Integrity Assessor

omar2535/graphqler

☸The first ever dependency-aware GraphQL API testing tool!

mseclab/pyjfuzz

PyJFuzz - Python JSON Fuzzer