
Moxy
Open-source DAST proxy with agentic AI for intercepting, modifying, and replaying HTTP/HTTPS traffic. Automates web application security testing via…

Open-source DAST proxy with agentic AI for intercepting, modifying, and replaying HTTP/HTTPS traffic. Automates web application security testing via…

Web technology identification scanner with 1800+ plugins for detecting CMS, servers, JS libraries, and embedded devices. Supports stealthy to…

Automated Web Application Firewall fingerprinting tool that identifies and detects over 200 WAF products by analyzing HTTP responses to normal and…

Web application firewall testing tool with 344+ attack payloads, auto WAF detection, bypass techniques, and full reconnaissance including DNS,…

A comprehensive web application security testing toolkit that combines 10 powerful penetration testing features into one tool.

Collaborative application security testing between humans and agents via CLI and MCP

WordPress security scanner that detects vulnerabilities, enumerates plugins/themes/users, and checks for weak passwords. Integrates with the WPScan…

A wrapper around grep, to help you grep for things

High-performance web fuzzer for content discovery, virtual host enumeration, and parameter fuzzing. Supports recursive scanning, multi-wordlist…

The collaborative web app pentest suite

Shannon is an autonomous, white-box AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes…

Advanced web path brute-forcer for discovering hidden directories and files. Supports recursive scanning, custom wordlists, filters, proxies, and…

High-speed API and web content discovery tool that bruteforces routes using compiled Swagger datasets, supporting depth scanning, custom wordlists,…

Multi-threaded scanner for detecting exposed Swagger/OpenAPI endpoints across web domains and subdomains, with automatic XSS detection, PoC…

Validates Google Maps API keys against 21 endpoints, revealing exposed services with PoC URLs, proxy support, and quiet mode for focused auditing.

A fast, simple, recursive content discovery tool written in Rust.

The AI toolkit for building reliable browser automations

Use Cloudflare to create HTTP pass-through proxies for unique IP rotation, similar to fireprox