├── LICENSE └── README.md /LICENSE: -------------------------------------------------------------------------------- 1 | Apache License 2 | Version 2.0, January 2004 3 | http://www.apache.org/licenses/ 4 | 5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 6 | 7 | 1. Definitions. 8 | 9 | "License" shall mean the terms and conditions for use, reproduction, 10 | and distribution as defined by Sections 1 through 9 of this document. 11 | 12 | "Licensor" shall mean the copyright owner or entity authorized by 13 | the copyright owner that is granting the License. 14 | 15 | "Legal Entity" shall mean the union of the acting entity and all 16 | other entities that control, are controlled by, or are under common 17 | control with that entity. For the purposes of this definition, 18 | "control" means (i) the power, direct or indirect, to cause the 19 | direction or management of such entity, whether by contract or 20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the 21 | outstanding shares, or (iii) beneficial ownership of such entity. 22 | 23 | "You" (or "Your") shall mean an individual or Legal Entity 24 | exercising permissions granted by this License. 25 | 26 | "Source" form shall mean the preferred form for making modifications, 27 | including but not limited to software source code, documentation 28 | source, and configuration files. 29 | 30 | "Object" form shall mean any form resulting from mechanical 31 | transformation or translation of a Source form, including but 32 | not limited to compiled object code, generated documentation, 33 | and conversions to other media types. 34 | 35 | "Work" shall mean the work of authorship, whether in Source or 36 | Object form, made available under the License, as indicated by a 37 | copyright notice that is included in or attached to the work 38 | (an example is provided in the Appendix below). 39 | 40 | "Derivative Works" shall mean any work, whether in Source or Object 41 | form, that is based on (or derived from) the Work and for which the 42 | editorial revisions, annotations, elaborations, or other modifications 43 | represent, as a whole, an original work of authorship. For the purposes 44 | of this License, Derivative Works shall not include works that remain 45 | separable from, or merely link (or bind by name) to the interfaces of, 46 | the Work and Derivative Works thereof. 47 | 48 | "Contribution" shall mean any work of authorship, including 49 | the original version of the Work and any modifications or additions 50 | to that Work or Derivative Works thereof, that is intentionally 51 | submitted to Licensor for inclusion in the Work by the copyright owner 52 | or by an individual or Legal Entity authorized to submit on behalf of 53 | the copyright owner. For the purposes of this definition, "submitted" 54 | means any form of electronic, verbal, or written communication sent 55 | to the Licensor or its representatives, including but not limited to 56 | communication on electronic mailing lists, source code control systems, 57 | and issue tracking systems that are managed by, or on behalf of, the 58 | Licensor for the purpose of discussing and improving the Work, but 59 | excluding communication that is conspicuously marked or otherwise 60 | designated in writing by the copyright owner as "Not a Contribution." 61 | 62 | "Contributor" shall mean Licensor and any individual or Legal Entity 63 | on behalf of whom a Contribution has been received by Licensor and 64 | subsequently incorporated within the Work. 65 | 66 | 2. Grant of Copyright License. Subject to the terms and conditions of 67 | this License, each Contributor hereby grants to You a perpetual, 68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 69 | copyright license to reproduce, prepare Derivative Works of, 70 | publicly display, publicly perform, sublicense, and distribute the 71 | Work and such Derivative Works in Source or Object form. 72 | 73 | 3. Grant of Patent License. Subject to the terms and conditions of 74 | this License, each Contributor hereby grants to You a perpetual, 75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 76 | (except as stated in this section) patent license to make, have made, 77 | use, offer to sell, sell, import, and otherwise transfer the Work, 78 | where such license applies only to those patent claims licensable 79 | by such Contributor that are necessarily infringed by their 80 | Contribution(s) alone or by combination of their Contribution(s) 81 | with the Work to which such Contribution(s) was submitted. If You 82 | institute patent litigation against any entity (including a 83 | cross-claim or counterclaim in a lawsuit) alleging that the Work 84 | or a Contribution incorporated within the Work constitutes direct 85 | or contributory patent infringement, then any patent licenses 86 | granted to You under this License for that Work shall terminate 87 | as of the date such litigation is filed. 88 | 89 | 4. Redistribution. You may reproduce and distribute copies of the 90 | Work or Derivative Works thereof in any medium, with or without 91 | modifications, and in Source or Object form, provided that You 92 | meet the following conditions: 93 | 94 | (a) You must give any other recipients of the Work or 95 | Derivative Works a copy of this License; and 96 | 97 | (b) You must cause any modified files to carry prominent notices 98 | stating that You changed the files; and 99 | 100 | (c) You must retain, in the Source form of any Derivative Works 101 | that You distribute, all copyright, patent, trademark, and 102 | attribution notices from the Source form of the Work, 103 | excluding those notices that do not pertain to any part of 104 | the Derivative Works; and 105 | 106 | (d) If the Work includes a "NOTICE" text file as part of its 107 | distribution, then any Derivative Works that You distribute must 108 | include a readable copy of the attribution notices contained 109 | within such NOTICE file, excluding those notices that do not 110 | pertain to any part of the Derivative Works, in at least one 111 | of the following places: within a NOTICE text file distributed 112 | as part of the Derivative Works; within the Source form or 113 | documentation, if provided along with the Derivative Works; or, 114 | within a display generated by the Derivative Works, if and 115 | wherever such third-party notices normally appear. The contents 116 | of the NOTICE file are for informational purposes only and 117 | do not modify the License. You may add Your own attribution 118 | notices within Derivative Works that You distribute, alongside 119 | or as an addendum to the NOTICE text from the Work, provided 120 | that such additional attribution notices cannot be construed 121 | as modifying the License. 122 | 123 | You may add Your own copyright statement to Your modifications and 124 | may provide additional or different license terms and conditions 125 | for use, reproduction, or distribution of Your modifications, or 126 | for any such Derivative Works as a whole, provided Your use, 127 | reproduction, and distribution of the Work otherwise complies with 128 | the conditions stated in this License. 129 | 130 | 5. Submission of Contributions. Unless You explicitly state otherwise, 131 | any Contribution intentionally submitted for inclusion in the Work 132 | by You to the Licensor shall be under the terms and conditions of 133 | this License, without any additional terms or conditions. 134 | Notwithstanding the above, nothing herein shall supersede or modify 135 | the terms of any separate license agreement you may have executed 136 | with Licensor regarding such Contributions. 137 | 138 | 6. Trademarks. This License does not grant permission to use the trade 139 | names, trademarks, service marks, or product names of the Licensor, 140 | except as required for reasonable and customary use in describing the 141 | origin of the Work and reproducing the content of the NOTICE file. 142 | 143 | 7. Disclaimer of Warranty. Unless required by applicable law or 144 | agreed to in writing, Licensor provides the Work (and each 145 | Contributor provides its Contributions) on an "AS IS" BASIS, 146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or 147 | implied, including, without limitation, any warranties or conditions 148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A 149 | PARTICULAR PURPOSE. You are solely responsible for determining the 150 | appropriateness of using or redistributing the Work and assume any 151 | risks associated with Your exercise of permissions under this License. 152 | 153 | 8. Limitation of Liability. In no event and under no legal theory, 154 | whether in tort (including negligence), contract, or otherwise, 155 | unless required by applicable law (such as deliberate and grossly 156 | negligent acts) or agreed to in writing, shall any Contributor be 157 | liable to You for damages, including any direct, indirect, special, 158 | incidental, or consequential damages of any character arising as a 159 | result of this License or out of the use or inability to use the 160 | Work (including but not limited to damages for loss of goodwill, 161 | work stoppage, computer failure or malfunction, or any and all 162 | other commercial damages or losses), even if such Contributor 163 | has been advised of the possibility of such damages. 164 | 165 | 9. Accepting Warranty or Additional Liability. While redistributing 166 | the Work or Derivative Works thereof, You may choose to offer, 167 | and charge a fee for, acceptance of support, warranty, indemnity, 168 | or other liability obligations and/or rights consistent with this 169 | License. However, in accepting such obligations, You may act only 170 | on Your own behalf and on Your sole responsibility, not on behalf 171 | of any other Contributor, and only if You agree to indemnify, 172 | defend, and hold each Contributor harmless for any liability 173 | incurred by, or claims asserted against, such Contributor by reason 174 | of your accepting any such warranty or additional liability. 175 | 176 | END OF TERMS AND CONDITIONS 177 | 178 | APPENDIX: How to apply the Apache License to your work. 179 | 180 | To apply the Apache License to your work, attach the following 181 | boilerplate notice, with the fields enclosed by brackets "[]" 182 | replaced with your own identifying information. (Don't include 183 | the brackets!) The text should be enclosed in the appropriate 184 | comment syntax for the file format. We also recommend that a 185 | file or class name and description of purpose be included on the 186 | same "printed page" as the copyright notice for easier 187 | identification within third-party archives. 188 | 189 | Copyright [yyyy] [name of copyright owner] 190 | 191 | Licensed under the Apache License, Version 2.0 (the "License"); 192 | you may not use this file except in compliance with the License. 193 | You may obtain a copy of the License at 194 | 195 | http://www.apache.org/licenses/LICENSE-2.0 196 | 197 | Unless required by applicable law or agreed to in writing, software 198 | distributed under the License is distributed on an "AS IS" BASIS, 199 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 200 | See the License for the specific language governing permissions and 201 | limitations under the License. 202 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # open-source-web-scanners 2 | A list of open source web security scanners on GitHub and GitLab, ordered by Stars. It does not provide in-depth analysis - for more analysis or a wider range of tools, see the links below. 3 | 4 | Note that some large projects have multiple repos - in which case the second most relevant repo is included immediately after and is indented. 5 | 6 | Related: [open-source-llm-scanners](https://github.com/psiinon/open-source-llm-scanners/) 7 | 8 | ## General Purpose Web Scanners 9 | 10 | Tools which can find a range of 'unknown' vulnerabilities on any websites. 11 | 12 | | Main Site | Last Commit | Committers | Stars | 13 | | --- | --- | --- | --- | 14 | | [ZAP](https://www.zaproxy.org) | [![Last Commit](https://img.shields.io/github/last-commit/zaproxy/zaproxy)](https://github.com/zaproxy/zaproxy/commits) | [![Contributors](https://img.shields.io/github/contributors/zaproxy/zaproxy)](https://github.com/zaproxy/zaproxy/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/zaproxy/zaproxy)](https://github.com/zaproxy/zaproxy/stargazers) | 15 | | - [ZAP Extensions](https://github.com/zaproxy/zap-extensions) | [![Last Commit](https://img.shields.io/github/last-commit/zaproxy/zap-extensions)](https://github.com/zaproxy/zap-extensions/commits) | [![Contributors](https://img.shields.io/github/contributors/zaproxy/zap-extensions)](https://github.com/zaproxy/zap-extensions/graphs/contributors)| [![Stars](https://img.shields.io/github/stars/zaproxy/zap-extensions)](https://github.com/zaproxy/zap-extensions/stargazers) | 16 | | [Hetty](https://hetty.xyz/) | [![Last Commit](https://img.shields.io/github/last-commit/dstotijn/hetty)](https://github.com/dstotijn/hetty/commits) | [![Contributors](https://img.shields.io/github/contributors/dstotijn/hetty)](https://github.com/dstotijn/hetty/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/dstotijn/hetty)](https://github.com/dstotijn/hetty/stargazers) | 17 | | [W3af](http://w3af.org/) | [![Last Commit](https://img.shields.io/github/last-commit/andresriancho/w3af/develop)](https://github.com/andresriancho/w3af/commits) | [![Contributors](https://img.shields.io/github/contributors/andresriancho/w3af)](https://github.com/andresriancho/w3af/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/andresriancho/w3af)](https://github.com/andresriancho/w3af/stargazers) | 18 | | [Arachni](https://www.arachni-scanner.com/) | [![Last Commit](https://img.shields.io/github/last-commit/Arachni/arachni)](https://github.com/Arachni/arachni/commits) | [![Contributors](https://img.shields.io/github/contributors/Arachni/arachni)](https://github.com/Arachni/arachni/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/Arachni/arachni)](https://github.com/Arachni/arachni/stargazers) | 19 | | [Astra](https://github.com/flipkart-incubator/Astra) | [![Last Commit](https://img.shields.io/github/last-commit/flipkart-incubator/Astra)](https://github.com/flipkart-incubator/Astra/commits) | [![Contributors](https://img.shields.io/github/contributors/flipkart-incubator/Astra)](https://github.com/flipkart-incubator/Astra/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/flipkart-incubator/Astra)](https://github.com/flipkart-incubator/Astra/stargazers) | 20 | | [Wapiti](https://wapiti-scanner.github.io/) | [![Last Commit](https://img.shields.io/github/last-commit/wapiti-scanner/wapiti)](https://github.com/wapiti-scanner/wapiti/commits) | [![Contributors](https://img.shields.io/github/contributors/wapiti-scanner/wapiti)](https://github.com/wapiti-scanner/wapiti/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/wapiti-scanner/wapiti)](https://github.com/wapiti-scanner/wapiti/stargazers) | 21 | | [Skipfish](https://code.google.com/archive/p/skipfish/) | [![Last Commit](https://img.shields.io/github/last-commit/spinkham/skipfish)](https://github.com/spinkham/skipfish/commits) | [![Contributors](https://img.shields.io/github/contributors/spinkham/skipfish)](https://github.com/spinkham/skipfish/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/spinkham/skipfish)](https://github.com/spinkham/skipfish/stargazers) | 22 | | [Sitadel](https://github.com/shenril/Sitadel) | [![Last Commit](https://img.shields.io/github/last-commit/shenril/Sitadel)](https://github.com/shenril/Sitadel/commits) | [![Contributors](https://img.shields.io/github/contributors/shenril/Sitadel)](https://github.com/shenril/Sitadel/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/shenril/Sitadel)](https://github.com/shenril/Sitadel/stargazers) | 23 | | [Taipan](https://github.com/enkomio/Taipan) | [![Last Commit](https://img.shields.io/github/last-commit/enkomio/Taipan)](https://github.com/enkomio/Taipan/commits) | [![Contributors](https://img.shields.io/github/contributors/enkomio/Taipan)](https://github.com/enkomio/Taipan/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/enkomio/Taipan)](https://github.com/enkomio/Taipan/stargazers) | 24 | | [Vega](https://subgraph.com/vega/) | [![Last Commit](https://img.shields.io/github/last-commit/subgraph/Vega)](https://github.com/subgraph/Vega/commits) | [![Contributors](https://img.shields.io/github/contributors/subgraph/Vega)](https://github.com/subgraph/Vega/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/subgraph/Vega)](https://github.com/subgraph/Vega/stargazers) | 25 | | [Reaper](https://ghostsecurity.github.io/reaper/) | [![Last Commit](https://img.shields.io/github/last-commit/ghostsecurity/reaper)](https://github.com/ghostsecurity/reaper/commits) | [![Contributors](https://img.shields.io/github/contributors/ghostsecurity/reaper)](https://github.com/ghostsecurity/reaper/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/ghostsecurity/reaper)](https://github.com/ghostsecurity/reaper/stargazers) | 26 | | [BrowserBruter](https://github.com/netsquare/BrowserBruter) | [![Last Commit](https://img.shields.io/github/last-commit/netsquare/BrowserBruter)](https://github.com/netsquare/BrowserBruter/commits) | [![Contributors](https://img.shields.io/github/contributors/netsquare/BrowserBruter)](https://github.com/netsquare/BrowserBruter/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/netsquare/BrowserBruter)](https://github.com/netsquare/BrowserBruter/stargazers) | 27 | | [Tuplar](https://github.com/tulpar/tulpar) | [![Last Commit](https://img.shields.io/github/last-commit/tulpar/tulpar)](https://github.com/tulpar/tulpar/commits) | [![Contributors](https://img.shields.io/github/contributors/tulpar/tulpar)](https://github.com/tulpar/tulpar/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/tulpar/tulpar)](https://github.com/tulpar/tulpar/stargazers) | 28 | | [Ugly-duckling](https://github.com/detectify/ugly-duckling) | [![Last Commit](https://img.shields.io/github/last-commit/detectify/ugly-duckling)](https://github.com/detectify/ugly-duckling/commits) | [![Contributors](https://img.shields.io/github/contributors/detectify/ugly-duckling)](https://github.com/detectify/ugly-duckling/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/detectify/ugly-duckling)](https://github.com/detectify/ugly-duckling/stargazers) | 29 | | [Jawfish](https://github.com/war-and-code/jawfish) | [![Last Commit](https://img.shields.io/github/last-commit/war-and-code/jawfish)](https://github.com/war-and-code/jawfishO/commits) | [![Contributors](https://img.shields.io/github/contributors/war-and-code/jawfish)](https://github.com/war-and-code/jawfish/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/war-and-code/jawfish)](https://github.com/war-and-code/jawfish/stargazers) | 30 | | [Pākiki](https://github.com/forensant/pakiki-core) | [![Last Commit](https://img.shields.io/github/last-commit/forensant/pakiki-core)](https://github.com/forensant/pakiki-core/commits) | [![Contributors](https://img.shields.io/github/contributors/forensant/pakiki-core)](https://github.com/forensant/pakiki-core/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/forensant/pakiki-core)](https://github.com/forensant/pakiki-core/stargazers) | 31 | | [ProKZee](https://github.com/al-sultani/prokzee) | [![Last Commit](https://img.shields.io/github/last-commit/al-sultani/prokzee)](https://github.com/al-sultani/prokzee/commits) | [![Contributors](https://img.shields.io/github/contributors/al-sultani/prokzee)](https://github.com/al-sultani/prokzee/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/al-sultani/prokzee)](https://github.com/al-sultani/prokzee/stargazers) | 32 | | [Browserker](https://gitlab.com/wirepair/browserker/) | [![Last Commit](https://img.shields.io/gitlab/last-commit/18213633)](https://gitlab.com/wirepair/browserker/-/commits/master) | [![Contributors](https://img.shields.io/gitlab/contributors/18213633)](https://gitlab.com/wirepair/browserker/-/graphs/master) | [![Stars](https://img.shields.io/gitlab/stars/18213633)](https://gitlab.com/wirepair/browserker/-/starrers) | 33 | 34 | ## Infrastructure Web Scanners 35 | 36 | Tools which can find a range of 'known' vulnerabilities on any websites. 37 | 38 | | Main Site | Last Commit | Committers | Stars | 39 | | --- | --- | --- | --- | 40 | | [Nuclei](https://nuclei.projectdiscovery.io/) | [![Last Commit](https://img.shields.io/github/last-commit/projectdiscovery/nuclei)](https://github.com/projectdiscovery/nuclei/commits) | [![Contributors](https://img.shields.io/github/contributors/projectdiscovery/nuclei)](https://github.com/projectdiscovery/nuclei/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/projectdiscovery/nuclei)](https://github.com/projectdiscovery/nuclei/stargazers) | 41 | | - [Nuclei Templates](https://github.com/projectdiscovery/nuclei-templates/) | [![Last Commit](https://img.shields.io/github/last-commit/projectdiscovery/nuclei-templates)](https://github.com/projectdiscovery/nuclei-templates/commits) | [![Contributors](https://img.shields.io/github/contributors/projectdiscovery/nuclei-templates)](https://github.com/projectdiscovery/nuclei-templates/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/projectdiscovery/nuclei-templates)](https://github.com/projectdiscovery/nuclei-templates/stargazers) | 42 | | [Xray](https://github.com/chaitin/xray) | [![Last Commit](https://img.shields.io/github/last-commit/chaitin/xray)](https://github.com/chaitin/xray/commits) | [![Contributors](https://img.shields.io/github/contributors/chaitin/xray)](https://github.com/chaitin/xray/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/chaitin/xray)](https://github.com/chaitin/xray/stargazers) | 43 | | [Tsunami](https://github.com/google/tsunami-security-scanner) | [![Last Commit](https://img.shields.io/github/last-commit/google/tsunami-security-scanner)](https://github.com/google/tsunami-security-scanner/commits) | [![Contributors](https://img.shields.io/github/contributors/google/tsunami-security-scanner)](https://github.com/google/tsunami-security-scanner/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/google/tsunami-security-scanner)](https://github.com/google/tsunami-security-scanner/stargazers) | 44 | | [Nikto](https://cirt.net/Nikto2) | [![Last Commit](https://img.shields.io/github/last-commit/sullo/nikto)](https://github.com/sullo/nikto/commits) | [![Contributors](https://img.shields.io/github/contributors/sullo/nikto)](https://github.com/sullo/nikto/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/sullo/nikto)](https://github.com/sullo/nikto/stargazers) | 45 | | [Striker](https://github.com/s0md3v/Striker) | [![Last Commit](https://img.shields.io/github/last-commit/s0md3v/Striker)](https://github.com/s0md3v/Striker/commits) | [![Contributors](https://img.shields.io/github/contributors/s0md3v/Striker)](https://github.com/s0md3v/Striker/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/s0md3v/Striker)](https://github.com/s0md3v/Striker/stargazers) | 46 | | [Jaeles](https://github.com/jaeles-project/jaeles) | [![Last Commit](https://img.shields.io/github/last-commit/jaeles-project/jaeles)](https://github.com/jaeles-project/jaeles/commits) | [![Contributors](https://img.shields.io/github/contributors/jaeles-project/jaeles)](https://github.com/jaeles-project/jaeles/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/jaeles-project/jaeles)](https://github.com/jaeles-project/jaeles/stargazers) | 47 | | - [Jaeles-Signatures](https://github.com/jaeles-project/jaeles-signatures) | [![Last Commit](https://img.shields.io/github/last-commit/jaeles-project/jaeles-signatures)](https://github.com/jaeles-project/jaeles-signatures/commits) | [![Contributors](https://img.shields.io/github/contributors/jaeles-project/jaeles-signatures)](https://github.com/jaeles-project/jaeles-signatures/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/jaeles-project/jaeles-signatures)](https://github.com/jaeles-project/jaeles-signatures/stargazers) | 48 | | [Yasuo](https://github.com/0xsauby/yasuo) | [![Last Commit](https://img.shields.io/github/last-commit/0xsauby/yasuo)](https://github.com/0xsauby/yasuo/commits) | [![Contributors](https://img.shields.io/github/contributors/0xsauby/yasuo)](https://github.com/0xsauby/yasuo/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/0xsauby/yasuo)](https://github.com/0xsauby/yasuo/stargazers) | 49 | | [Observatory](https://observatory.mozilla.org/) | [![Last Commit](https://img.shields.io/github/last-commit/mozilla/http-observatory-website)](https://github.com/mozilla/http-observatory-website/commits) | [![Contributors](https://img.shields.io/github/contributors/mozilla/http-observatory-website)](https://github.com/mozilla/http-observatory-website/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/mozilla/http-observatory-website)](https://github.com/mozilla/http-observatory-website/stargazers) | 50 | | [Spaghetti](https://github.com/infosecsecurity/Spaghetti) | [![Last Commit](https://img.shields.io/github/last-commit/infosecsecurity/Spaghetti)](https://github.com/infosecsecurity/Spaghetti/commits) | [![Contributors](https://img.shields.io/github/contributors/infosecsecurity/Spaghetti)](https://github.com/infosecsecurity/Spaghetti/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/infosecsecurity/Spaghetti)](https://github.com/infosecsecurity/Spaghetti/stargazers) | 51 | 52 | ## Fuzzers / Brute Forcers 53 | 54 | Tools which focus on throwing 'bad stuff' at things - the user typically has to work out if it sticks. 55 | 56 | | Main Site | Last Commit | Committers | Stars | 57 | | --- | --- | --- | --- | 58 | | [dirsearch](https://github.com/maurosoria/dirsearch) | [![Last Commit](https://img.shields.io/github/last-commit/maurosoria/dirsearch)](https://github.com/maurosoria/dirsearch/commits) | [![Contributors](https://img.shields.io/github/contributors/maurosoria/dirsearch)](https://github.com/maurosoria/dirsearch/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/maurosoria/dirsearch)](https://github.com/maurosoria/dirsearch/stargazers) | 59 | | [Ffuf](https://github.com/ffuf/ffuf) | [![Last Commit](https://img.shields.io/github/last-commit/ffuf/ffuf)](https://github.com/ffuf/ffuf/commits) | [![Contributors](https://img.shields.io/github/contributors/ffuf/ffuf)](https://github.com/ffuf/ffuf/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/ffuf/ffuf)](https://github.com/ffuf/ffuf/stargazers) | 60 | | [gobuster](https://github.com/OJ/gobuster) | [![Last Commit](https://img.shields.io/github/last-commit/OJ/gobuster)](https://github.com/OJ/gobuster/commits) | [![Contributors](https://img.shields.io/github/contributors/OJ/gobuster)](https://github.com/OJ/gobuster/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/OJ/gobuster)](https://github.com/OJ/gobuster/stargazers) | 61 | | [Wfuzz](https://wfuzz.readthedocs.io/en/latest/) | [![Last Commit](https://img.shields.io/github/last-commit/xmendez/wfuzz)](https://github.com/xmendez/wfuzz/commits) | [![Contributors](https://img.shields.io/github/contributors/xmendez/wfuzz)](https://github.com/xmendez/wfuzz/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/xmendez/wfuzz)](https://github.com/xmendez/wfuzz/stargazers) | 62 | | [feroxbuster](https://github.com/epi052/feroxbuster) | [![Last Commit](https://img.shields.io/github/last-commit/epi052/feroxbuster)](https://github.com/epi052/feroxbuster/commits) | [![Contributors](https://img.shields.io/github/contributors/epi052/feroxbuster)](https://github.com/epi052/feroxbuster/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/epi052/feroxbuster)](https://github.com/epi052/feroxbuster/stargazers) | 63 | | [rustbusterv](https://github.com/phra/rustbuster) | [![Last Commit](https://img.shields.io/github/last-commit/phra/rustbuster)](https://github.com/phra/rustbuster/commits) | [![Contributors](https://img.shields.io/github/contributors/phra/rustbuster)](https://github.com/phra/rustbuster/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/phra/rustbuster)](https://github.com/phra/rustbuster/stargazers) | 64 | | [vaf](https://github.com/d4rckh/vaf) | [![Last Commit](https://img.shields.io/github/last-commit/d4rckh/vaf)](https://github.com/d4rckh/vaf/commits) | [![Contributors](https://img.shields.io/github/contributors/d4rckh/vaf)](https://github.com/d4rckh/vaf/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/d4rckh/vaf)](https://github.com/d4rckh/vaf/stargazers) | 65 | | [radamsa](https://gitlab.com/akihe/radamsa) | [![Last Commit](https://img.shields.io/gitlab/last-commit/akihe/radamsa)](https://img.shields.io/gitlab/last-commit/akihe/radamsa) | [![Contributors](https://img.shields.io/gitlab/contributors/akihe%2Fradamsa)](https://gitlab.com/akihe/radamsa/-/graphs/master) | [![Stars](https://img.shields.io/gitlab/stars/akihe%2Fradamsa)](https://gitlab.com/akihe/radamsa/-/starrers) | 66 | | [BrowserBruter](https://github.com/netsquare/BrowserBruter) | [![Last Commit](https://img.shields.io/github/last-commit/netsquare/BrowserBruter)](https://github.com/netsquare/BrowserBruter/commits) | [![Contributors](https://img.shields.io/github/contributors/netsquare/BrowserBruter)](https://github.com/netsquare/BrowserBruter/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/netsquare/BrowserBruter)](https://github.com/netsquare/BrowserBruter/stargazers) | 67 | 68 | ## CMS Web Scanners 69 | 70 | Tools which can find a range of 'known' vulnerabilities on one or more CMS websites. 71 | 72 | | Main Site | Last Commit | Committers | Stars | 73 | | --- | --- | --- | --- | 74 | | [WPscan](https://wpscan.org/) | [![Last Commit](https://img.shields.io/github/last-commit/wpscanteam/wpscan)](https://github.com/wpscanteam/wpscan/commits) | [![Contributors](https://img.shields.io/github/contributors/wpscanteam/wpscan)](https://github.com/wpscanteam/wpscan/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/wpscanteam/wpscan)](https://github.com/wpscanteam/wpscan/stargazers) | 75 | | [Volnx](https://github.com/anouarbensaad/vulnx) | [![Last Commit](https://img.shields.io/github/last-commit/anouarbensaad/vulnx)](https://github.com/anouarbensaad/vulnx/commits) | [![Contributors](https://img.shields.io/github/contributors/anouarbensaad/vulnx)](https://github.com/anouarbensaad/vulnx/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/anouarbensaad/vulnx)](https://github.com/anouarbensaad/vulnx/stargazers) | 76 | | [Droopescan](https://github.com/SamJoan/droopescan) | [![Last Commit](https://img.shields.io/github/last-commit/SamJoan/droopescan)](https://github.com/SamJoan/droopescan/commits) | [![Contributors](https://img.shields.io/github/contributors/SamJoan/droopescan)](https://github.com/SamJoan/droopescan/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/SamJoan/droopescan)](https://github.com/SamJoan/droopescan/stargazers) | 77 | | [CMSScan](https://github.com/ajinabraham/CMSScan) | [![Last Commit](https://img.shields.io/github/last-commit/ajinabraham/CMSScan)](https://github.com/ajinabraham/CMSScan/commits) | [![Contributors](https://img.shields.io/github/contributors/ajinabraham/CMSScan)](https://github.com/ajinabraham/CMSScan/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/ajinabraham/CMSScan)](https://github.com/ajinabraham/CMSScan/stargazers) | 78 | | [JoomScan](https://wiki.owasp.org/index.php/Category:OWASP_Joomla_Vulnerability_Scanner_Project) | [![Last Commit](https://img.shields.io/github/last-commit/OWASP/joomscan)](https://github.com/OWASP/joomscan/commits) | [![Contributors](https://img.shields.io/github/contributors/OWASP/joomscan)](https://github.com/OWASP/joomscan/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/OWASP/joomscan)](https://github.com/OWASP/joomscan/stargazers) | 79 | | [Clusterd](https://github.com/hatRiot/clusterd) | [![Last Commit](https://img.shields.io/github/last-commit/hatRiot/clusterd)](https://github.com/hatRiot/clusterd/commits) | [![Contributors](https://img.shields.io/github/contributors/hatRiot/clusterd)](https://github.com/hatRiot/clusterd/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/hatRiot/clusterd)](https://github.com/hatRiot/clusterd/stargazers) | 80 | 81 | ## API Web Scanners 82 | 83 | Tools which focus on web APIs. 84 | 85 | | Main Site | Last Commit | Committers | Stars | 86 | | --- | --- | --- | --- | 87 | | [Cherrybomb](https://github.com/blst-security/cherrybomb) | [![Last Commit](https://img.shields.io/github/last-commit/blst-security/cherrybomb)](https://github.com/blst-security/cherrybomb/commits) | [![Contributors](https://img.shields.io/github/contributors/blst-security/cherrybomb)](https://github.com/blst-security/cherrybomb/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/blst-security/cherrybomb)](https://github.com/blst-security/cherrybomb/stargazers) | 88 | | [Akto](https://github.com/akto-api-security/community-edition) | [![Last Commit](https://img.shields.io/github/last-commit/akto-api-security/community-edition)](https://github.com/akto-api-security/community-edition/commits) | [![Contributors](https://img.shields.io/github/contributors/akto-api-security/community-edition)](https://github.com/akto-api-security/community-edition/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/akto-api-security/community-edition)](https://github.com/akto-api-security/community-edition/stargazers) | 89 | | [Automatic API Attack Tool](https://github.com/imperva/automatic-api-attack-tool) | [![Last Commit](https://img.shields.io/github/last-commit/imperva/automatic-api-attack-tool)](https://github.com/imperva/automatic-api-attack-tool/commits) | [![Contributors](https://img.shields.io/github/contributors/imperva/automatic-api-attack-tool)](https://github.com/imperva/automatic-api-attack-tool/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/imperva/automatic-api-attack-tool)](https://github.com/imperva/automatic-api-attack-tool/stargazers) | 90 | | [VulnAPI](https://github.com/cerberauth/vulnapi) | [![Last Commit](https://img.shields.io/github/last-commit/cerberauth/vulnapi)](https://github.com/cerberauth/vulnapi/commits) | [![Contributors](https://img.shields.io/github/contributors/cerberauth/vulnapi)](https://github.com/cerberauth/vulnapi/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/cerberauth/vulnapi)](https://github.com/cerberauth/vulnapi/stargazers) | 91 | 92 | 93 | ## Specialised Scanners 94 | 95 | Tools which focus on specific types of vulnerabilities. 96 | 97 | | Main Site | Last Commit | Committers | Stars | 98 | | --- | --- | --- | --- | 99 | | [Sqlmap](https://sqlmap.org/) | [![Last Commit](https://img.shields.io/github/last-commit/sqlmapproject/sqlmap)](https://github.com/sqlmapproject/sqlmap/commits) | [![Contributors](https://img.shields.io/github/contributors/sqlmapproject/sqlmap)](https://github.com/sqlmapproject/sqlmap/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/sqlmapproject/sqlmap)](https://github.com/sqlmapproject/sqlmap/stargazers) | 100 | | [XSStrike](https://github.com/s0md3v/XSStrike) | [![Last Commit](https://img.shields.io/github/last-commit/s0md3v/XSStrike)](https://github.com/s0md3v/XSStrike/commits) | [![Contributors](https://img.shields.io/github/contributors/s0md3v/XSStrike)](https://github.com/s0md3v/XSStrike/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/s0md3v/XSStrike)](https://github.com/s0md3v/XSStrike/stargazers) | 101 | | [Commix](https://github.com/commixproject/commix) | [![Last Commit](https://img.shields.io/github/last-commit/commixproject/commix)](https://github.com/commixproject/commix/commits) | [![Contributors](https://img.shields.io/github/contributors/commixproject/commix)](https://github.com/commixproject/commix/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/commixproject/commix)](https://github.com/commixproject/commix/stargazers) | 102 | | [Tplmap](https://github.com/epinna/tplmap) | [![Last Commit](https://img.shields.io/github/last-commit/epinna/tplmap)](https://github.com/epinna/tplmap/commits) | [![Contributors](https://img.shields.io/github/contributors/epinna/tplmap)](https://github.com/epinna/tplmap/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/epinna/tplmap)](https://github.com/epinna/tplmap/stargazers) | 103 | | [Dalfox](https://github.com/hahwul/dalfox) | [![Last Commit](https://img.shields.io/github/last-commit/hahwul/dalfox)](https://github.com/hahwul/dalfox/commits) | [![Contributors](https://img.shields.io/github/contributors/hahwul/dalfox)](https://github.com/hahwul/dalfox/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/hahwul/dalfox)](https://github.com/hahwul/dalfox/stargazers) | 104 | | [Fuxploider](https://github.com/almandin/fuxploider) | [![Last Commit](https://img.shields.io/github/last-commit/almandin/fuxploider)](https://github.com/almandin/fuxploider/commits) | [![Contributors](https://img.shields.io/github/contributors/almandin/fuxploider)](https://github.com/almandin/fuxploider/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/almandin/fuxploider)](https://github.com/almandin/fuxploider/stargazers) | 105 | | [Ghauri](https://github.com/r0oth3x49/ghauri) | [![Last Commit](https://img.shields.io/github/last-commit/r0oth3x49/ghauri)](https://github.com/r0oth3x49/ghauri/commits) | [![Contributors](https://img.shields.io/github/contributors/r0oth3x49/ghauri)](https://github.com/r0oth3x49/ghauri/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/r0oth3x49/ghauri)](https://github.com/r0oth3x49/ghauri/stargazers) | 106 | | [NoSQLMap](https://github.com/codingo/NoSQLMap) | [![Last Commit](https://img.shields.io/github/last-commit/codingo/NoSQLMap)](https://github.com/codingo/NoSQLMap/commits) | [![Contributors](https://img.shields.io/github/contributors/codingo/NoSQLMap)](https://github.com/codingo/NoSQLMap/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/codingo/NoSQLMap)](https://github.com/codingo/NoSQLMap/stargazers) | 107 | | [Xsscrapy](https://github.com/DanMcInerney/xsscrapy) | [![Last Commit](https://img.shields.io/github/last-commit/DanMcInerney/xsscrapy)](https://github.com/DanMcInerney/xsscrapy/commits) | [![Contributors](https://img.shields.io/github/contributors/DanMcInerney/xsscrapy)](https://github.com/DanMcInerney/xsscrapy/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/DanMcInerney/xsscrapy)](https://github.com/DanMcInerney/xsscrapy/stargazers) | 108 | | [XSpear](https://github.com/hahwul/XSpear) | [![Last Commit](https://img.shields.io/github/last-commit/hahwul/XSpear)](https://github.com/hahwul/XSpear/commits) | [![Contributors](https://img.shields.io/github/contributors/hahwul/XSpear)](https://github.com/hahwul/XSpear/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/hahwul/XSpear)](https://github.com/hahwul/XSpear/stargazers) | 109 | | [Gxss](https://github.com/KathanP19/Gxss) | [![Last Commit](https://img.shields.io/github/last-commit/KathanP19/Gxss)](https://github.com/KathanP19/Gxss/commits) | [![Contributors](https://img.shields.io/github/contributors/KathanP19/Gxss)](https://github.com/KathanP19/Gxss/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/KathanP19/Gxss)](https://github.com/KathanP19/Gxss/stargazers) | 110 | | [Domdig](https://github.com/fcavallarin/domdig) | [![Last Commit](https://img.shields.io/github/last-commit/fcavallarin/domdig)](https://github.com/fcavallarin/domdig/commits) | [![Contributors](https://img.shields.io/github/contributors/fcavallarin/domdig)](https://github.com/fcavallarin/domdig/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/fcavallarin/domdig)](https://github.com/fcavallarin/domdig/stargazers) | 111 | | [O-Saft](https://github.com/OWASP/O-Saft/) | [![Last Commit](https://img.shields.io/github/last-commit/OWASP/O-Saft)](https://github.com/OWASP/O-Saft/commits) | [![Contributors](https://img.shields.io/github/contributors/OWASP/O-Saft)](https://github.com/OWASP/O-Saft/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/OWASP/O-Saft)](https://github.com/OWASP/O-Saft/stargazers) | 112 | | [CakeFuzzer](https://zigrin.com/tools/cake-fuzzer/) | [![Last Commit](https://img.shields.io/github/last-commit/Zigrin-Security/CakeFuzzer)](https://github.com/Zigrin-Security/CakeFuzzer/commits) | [![Contributors](https://img.shields.io/github/contributors/Zigrin-Security/CakeFuzzer)](https://github.com/Zigrin-Security/CakeFuzzer/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/Zigrin-Security/CakeFuzzer)](https://github.com/Zigrin-Security/CakeFuzzer/stargazers) | 113 | | [Takeover](https://github.com/edoardottt/takeover) | [![Last Commit](https://img.shields.io/github/last-commit/edoardottt/takeover)](https://github.com/edoardottt/takeover/commits) | [![Contributors](https://img.shields.io/github/contributors/edoardottt/takeover)](https://github.com/edoardottt/takeover/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/edoardottt/takeover)](https://github.com/edoardottt/takeover/stargazers) | 114 | | [LFIscanner](https://github.com/R3LI4NT/LFIscanner) | [![Last Commit](https://img.shields.io/github/last-commit/R3LI4NT/LFIscanner)](https://github.com/R3LI4NT/LFIscanner/commits) | [![Contributors](https://img.shields.io/github/contributors/R3LI4NT/LFIscanner)](https://github.com/R3LI4NT/LFIscanner/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/R3LI4NT/LFIscanner)](https://github.com/R3LI4NT/LFIscanner/stargazers) | 115 | | [YA-LFI](https://github.com/0x-Apollyon/YA-LFI) | [![Last Commit](https://img.shields.io/github/last-commit/0x-Apollyon/YA-LFI)](https://github.com/0x-Apollyon/YA-LFI/commits) | [![Contributors](https://img.shields.io/github/contributors/0x-Apollyon/YA-LFI)](https://github.com/0x-Apollyon/YA-LFI/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/0x-Apollyon/YA-LFI)](https://github.com/0x-Apollyon/YA-LFI/stargazers) | 116 | | [YA-CORS](https://github.com/0x-Apollyon/YA-CORS) | [![Last Commit](https://img.shields.io/github/last-commit/0x-Apollyon/YA-CORS)](https://github.com/0x-Apollyon/YA-CORS/commits) | [![Contributors](https://img.shields.io/github/contributors/0x-Apollyon/YA-CORS)](https://github.com/0x-Apollyon/YA-CORS/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/0x-Apollyon/YA-CORS)](https://github.com/0x-Apollyon/YA-CORS/stargazers) | 117 | 118 | ## Links 119 | 120 | * [Free for Open Source Application Security Tools](https://owasp.org/www-community/Free_for_Open_Source_Application_Security_Tools) - includes commercial tools as well 121 | * [Vulnerability Scanning Tools](https://owasp.org/www-community/Vulnerability_Scanning_Tools) - covers more tools, includes commercial tools as well 122 | * [Linux Security Tools](https://linuxsecurity.expert/security-tools/) - covers more tools and evaluates more criteria 123 | * [Web Hackers Weapons](https://github.com/hahwul/WebHackersWeapons) - covers more tools 124 | * [Arsenal of cloud native security tools](https://www.marcolancini.it/2018/blog-arsenal-cloud-native-security-tools/) 125 | 126 | ## Contribute 127 | 128 | PR's welcomed. 129 | 130 | Template line for GitHub projects (replace USER_REPO): 131 | ``` 132 | | []() | [![Last Commit](https://img.shields.io/github/last-commit/USER_REPO)](https://github.com/USER_REPO/commits) | [![Contributors](https://img.shields.io/github/contributors/USER_REPO)](https://github.com/USER_REPO/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/USER_REPO)](https://github.com/USER_REPO/stargazers) | 133 | ``` 134 | Template line for GitLab projects (replace USER_REPO): 135 | ``` 136 | | []() | [![Last Commit](https://badgen.net/gitlab/last-commit/USER_REPO)](https://gitlab.com/USER_REPO/-/commits/master) | [![Contributors](https://badgen.net/gitlab/contributors/USER_REPO/)](https://gitlab.com/USER_REPO/-/graphs/master) | [![Stars](https://badgen.net/gitlab/stars/USER_REPO/)](https://gitlab.com/USER_REPO/-/starrers) | 137 | ``` 138 | --------------------------------------------------------------------------------