Tools

cloudflare/security-audit-skill

A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings

wpscanteam/wpscan

WordPress security scanner that detects vulnerabilities, enumerates plugins/themes/users, and checks for weak passwords. Integrates with the WPScan…

s0md3v/xsstrike

Most advanced XSS scanner.

sullo/nikto

Nikto web server scanner

hahwul/dalfox

Fast XSS scanner with parameter analysis, WAF fingerprinting, and DOM/AST verification. Supports reflected, stored, and DOM-based XSS detection via…

urbanadventurer/whatweb

Next generation web scanner

google/honggfuzz

Security oriented software fuzzer. Supports evolutionary, feedback-driven fuzzing based on code coverage (SW and HW based)

enablesecurity/wafw00f

Automated Web Application Firewall fingerprinting tool that identifies and detects over 200 WAF products by analyzing HTTP responses to normal and…

pizlonator/fil-c

Fil-C: completely compatible memory safety for C and C++

danmcinerney/xsscrapy

XSS spider - 66/66 wavsep XSS detected

zhzyker/vulmap

Web vulnerability scanner and exploitation tool with POC/EXP modes for known CVEs across webapps such as Weblogic, Shiro, Struts2, and Tomcat;…

tomnomnom/gf

A wrapper around grep, to help you grep for things

jaeles-project/jaeles

The Swiss Army knife for automated Web Application Testing

vladko312/sstimap

Automatic SSTI detection tool with interactive interface

rust-fuzz/cargo-fuzz

Cargo subcommand for coverage-guided Rust fuzzing with libFuzzer: create and run fuzz targets, minimize failures and corpora, and report coverage.

narfindustries/http-garden

Differential testing framework for HTTP implementations

byt3bl33d3r/offensivedlr

Toolbox containing research notes & PoC code for weaponizing .NET's DLR