graphw00f
dolevf/graphw00fGraphQL server engine fingerprinting tool that sends benign and malformed queries to identify backend technology and assess security defenses via the…
api-securityapi-security-testingdynamic-code-analysis+5
884
dolevf/graphw00fGraphQL server engine fingerprinting tool that sends benign and malformed queries to identify backend technology and assess security defenses via the…
ronin-rb/roninRonin is a Free and Open Source Ruby Toolkit for Security Research and Development. Ronin also allows for the rapid development and distribution of…
fcavallarin/htcaphtcap is a web application scanner able to crawl single page application (SPA) recursively by intercepting ajax calls and DOM changes.
lumoslab-innovation/openhunteraiLocal-first AI red team for web, API, and LLM application security. Attacker-style reasoning, evidence-backed findings, and skills for AI coding…
dragonked2/egyscanEgyscan The Best web vulnerability scanner; it's a multifaceted security powerhouse designed to fortify your web applications against malicious…
dolevf/graphql-copLightweight Python utility for automated security auditing of GraphQL APIs. Detects misconfigurations, information leaks, and denial-of-service…
portswigger/active-scan-plus-plusBurp Suite extension that extends active and passive scanning with checks for host header attacks, XXE, code injection, and known CVEs like…
akha-security/akcaEvidence-oriented DAST scanner in Go that crawls web apps and APIs, then runs adaptive SQLi, XSS, RCE, SSRF, and auth checks with replayable proof.
we1h0/securitymanageframworkSecurity Manage Framwork is a security management platform for enterprise intranet, which includes asset management, vulnerability management,…
teycir/burpapisecuritysuiteBurp Suite extension for API security testing with 15 attack types, 108+ payloads, intelligent fuzzing, BOLA/IDOR detection, AI integration, and…
hood3drob1n/bingooBinGoo! A Linux bash based Bing and Google Dorking Tool
noptrix/lulzbusterA multithreaded, very fast and smart HTTP(S) directory and file bruteforcer written in C on top of libcurl
0xinfection/logmepwnA fully automated, reliable, super-fast, scanning and validation toolkit for the Log4J RCE CVE-2021-44228 vulnerability.
proviesec/xss-payload-listCurated collection of cross-site scripting payloads, polyglots, and injection test rules for web application penetration testing and bug bounty…
lwzsoviet/noxssFaster xss scanner,support reflected-xss and dom-xss
ostesayed/oste-meta-scanMulti-engine DAST scanner aggregating Nikto, ZAP, Nuclei, SkipFish, and Wapiti for automated web injection vulnerability detection with consolidated…
jewel591/xssmapPython-based XSS vulnerability scanner with support for POST/GET requests, parameter injection in cookies/referer/user-agent, and multiple encoding…
karim852/kumo-domain-recon-toolDomain OSINT and security reconnaissance framework running 26 parallel modules for DNS, ports, subdomains, leaked credentials, exposed endpoints,…