Tools

sqlmapproject/sqlmap

Automatic SQL injection and database takeover tool

projectdiscovery/nuclei

Fast YAML-based vulnerability scanner with template-driven detection engine for automated security testing across web apps, APIs, networks, DNS, and…

wpscanteam/wpscan

WordPress security scanner that detects vulnerabilities, enumerates plugins/themes/users, and checks for weak passwords. Integrates with the WPScan…

hahwul/dalfox

Fast XSS scanner with parameter analysis, WAF fingerprinting, and DOM/AST verification. Supports reflected, stored, and DOM-based XSS detection via…

go-appsec/toolbox

Collaborative application security testing between humans and agents via CLI and MCP

tno-s3/wuppiefuzz

A coverage-guided REST API fuzzer developed on top of LibAFL

pennacle-security/summit

Open-source web security testing platform: proxy, scanner and fuzzer in one CLI. By Pennacle Security.

pizlonator/fil-c

Fil-C: completely compatible memory safety for C and C++

projectdiscovery/httpx

Fast, multi-probe HTTP toolkit for reconnaissance and information gathering. Probes TLS, CSP, headers, tech stack, and CDN. Supports matchers,…

mda2av/http11probe

An open testing platform that probes HTTP/1.1 servers against RFC 9110/9112 requirements, smuggling vectors, and malformed input handling. Add your…

akha-security/akca

Evidence-oriented DAST scanner in Go that crawls web apps and APIs, then runs adaptive SQLi, XSS, RCE, SSRF, and auth checks with replayable proof.

owasp/nettacker

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management

portswigger/active-scan-plus-plus

Burp Suite extension that extends active and passive scanning with checks for host header attacks, XXE, code injection, and known CVEs like…

opaxial/cve-2026-9830

CVE-2026-9830 Proof of Concept

albinowax/activescanplusplus

Burp Suite extension that extends active and passive scanning with checks for host header attacks, XXE, expression language injection, shellshock and…

infobyte/ai-pentest-agent

Standalone autonomous AI pentest agent with a plan→act→judge loop, generic skills, destructive-action gate, and swappable LLM providers, plus a…

brutelogic/unkover

Bash 403/401 access bypass tester that probes a URL with header spoofing, method tampering, path normalization, and encoding techniques, returning a…

abraxas/moodle-grades-gradeitems

Moodle 5.2.3 - High - Remote - IDOR - core_grades_get_gradeitems lists hidden grade items