waf-checker
sech0us3/waf-checkerAutomated WAF assessment tool that detects firewall vendors, tests 19 attack categories with advanced evasion payloads, and provides color-coded…
api-security-testingids-ips-evasioninformation-gathering+6
34
sech0us3/waf-checkerAutomated WAF assessment tool that detects firewall vendors, tests 19 attack categories with advanced evasion payloads, and provides color-coded…
unkn0wn-root/restermTerminal API client for HTTP, GraphQL and gRPC. Plain .http files you can diff and version, with workflows, mocks, profiling, tracing, OpenAPI…
endava/catsAutomated REST API fuzzer and negative testing tool for OpenAPI endpoints. Generates, runs, and reports thousands of self-healing tests with no…
leebaird/discoverCustom Bash and Python scripts used to automate various penetration testing tasks including recon, scanning, enumeration, and malicious payload…
spectolabs/hoverflyLightweight service virtualization/ API simulation / API mocking tool for developers and testers
simioni87/auth_analyzerBurp Extension for testing authorization issues. Automated request repeating and parameter value extraction on the fly.
zaproxy/zaproxyOpen-source web application security scanner for automated vulnerability detection, manual penetration testing, and API security testing with a…
hahwul/mzap⚡️ Multiple target ZAP Scanning
foxvr-sudo/bug-bounty-arsenal-v.3Full-stack platform for authorized web application security scanning with a detector-based engine, async Celery workers, and a React dashboard for…
zaproxy/community-scriptsA collection of ZAP scripts and tips provided by the community - pull requests very welcome!
projectdiscovery/chaos-clientGo client to communicate with Chaos DB API.
go-appsec/toolboxCollaborative application security testing between humans and agents via CLI and MCP
hahwul/smugglexRust-powered HTTP Request Smuggling Scanner.
hunt-benito/your-bot-my-inbox-cve-2026-68929-fastgpt-unauthenticated-wechat-channel-hijackProof-of-concept exploit for CVE-2026-68929, demonstrating unauthenticated cross-tenant takeover of FastGPT WeChat channels via public shareId,…
kerlenton/mcpsnoopWireshark for MCP. A transparent proxy that shows every real tool call between your AI client and your MCP servers, live in your terminal.
datadog/stratus-red-team:cloud: :zap: Granular, Actionable Adversary Emulation for the Cloud
bugcrowd/huntFlags parameters commonly associated with injection, SSRF, path traversal, IDOR, and SSTI, via passive Burp/ZAP scanning; also organizes manual…
chocapikk/wpprobeA fast WordPress plugin enumeration tool