Awesome Web Security

SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.

Most advanced XSS scanner.

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

Incredibly fast crawler designed for OSINT.

Fast subdomains enumeration tool for penetration testers

Web application fuzzer

Automated Αll-in-One OS command injection exploitation tool.

A python script that finds endpoints in JavaScript files

Server-Side Template Injection and Code Injection Detection and Exploitation Tool

A Social Media Enumeration & Correlation Tool by Jacob Wilkin(Greenwolf)

A high performance offensive security tool for reconnaissance and vulnerability scanning

CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool

Plasma is an interactive disassembler for x86/ARM/MIPS. It can generates indented pseudo-code with colored syntax.

Automated Security Testing For REST API's

Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor

Tool for advanced mining for content on Github

GitHub Sensitive Information Leakage（GitHub敏感信息泄露监控）

Reconnaissance Swiss Army Knife

Tool to scan for secret files on HTTP servers

Find web directories without bruteforce

The Offensive Manual Web Application Penetration Testing Framework.

Analyze the security of any domain by finding all the information possible. Made in python.

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.

The Prime Cross Site Request Forgery (CSRF) Audit and Exploitation Toolkit.

A collection of AWS penetration testing junk

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision

Open-source autonomous AI penetration testing. 50 specialist agents across web, API, cloud, Active Directory, Kubernetes, CI/CD and AI/LLM (OWASP LLM Top 10). Runs on a local LLM behind a Privacy Gateway. Integrates with GitHub, GitLab, Jenkins, VS Code, JetBrains, n8n, Grafana & Splunk.

Auditing for TLS certificates.

Auto Scanning to SSL Vulnerability

Self-hosted, invisible CAPTCHA that detects AI agents driving real browsers. GDPR, WCAG 2.2 AA, and EAA: no cookies, no third-party data sharing, and no visual or audio puzzle. With a false-positive budget enforced in CI. Proof of work, drop-in for Turnstile and reCAPTCHA.

Parse NTLM challenge messages over HTTP and SMB

Git manager for pentesters

Vulnerable Web applications Generator

EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.