Tools: webapp (287)

Web security tool to make fuzzing at HTTP inputs, made in C with libCurl.

Bypassing WAF by abusing SSL/TLS Ciphers.

Simple admin panel finder for php,js,cgi,asp and aspx admin panels.

This python script looks for a large amount of possible administrative interfaces on a given site.

A SQLi exploitation framework in Python.

A XSS vulnerability scanner.

A feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators ev

Automated Security Testing For REST API's.

Open source tool that can suggest sqlmap tampers to bypass WAF/IDS/IPS.

A tool which interfaces with management or administration applications from an offensive standpoint.

A library for detecting known secrets across many web frameworks.

SQL injection exploit tool.

A tiny Batch web vulnerability Scanner.

Python script for searching Bing for sites that may have local and remote file inclusion vulnerabilities.

Exploit Time-based blind-SQL injection in HTTP-Headers (MySQL/MariaDB).

Penetration testing tool that automates testing accounts to the site's login page.

Cross-Site Scripting Bruteforcer.

Blind SQL Injection Brute Forcer.

Blind SQL injection exploitation tool written in ruby.

Vulnerability scanner and information gatherer for the Concrete5 CMS.

Intercepting proxy to replay, inject, scan and fuzz HTTP requests.

A python-based Web Content Discovery Tool.

Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, token.

Community edition nuclei templates.

Tool that generates a PHP capable of run a custom binary (like a meterpreter) or a bash script (p.e. reverse shell) bypa

Drag and Drop ClickJacking exploit development assistance tool.

Obtain GraphQL API Schema even if the introspection is not enabled.

Python script to bypass cloudflare from command line. Built upon cfscrape module.

Joomla, Mambo, PHP-Nuke, and XOOPS CMS SQL injection vulnerability scanning tool written in Python.

Fuzzer for wordpress, cold fusion, drupal, joomla, and phpnuke.

CMS scanner to identify and find vulnerabilities for Wordpress, Drupal, Joomla, vBulletin.

CMS Scanner Framework.

WhiteBox CMS analysis.

Extract all comments from the specified URL resource.

Fast CORS misconfiguration vulnerabilities scanner.

CORS Misconfiguration Scanner.

Automatic remote/local file inclusion vulnerability analysis and exploit tool.

GraphQL password brute-force and fuzzing utility

Web recon tool (find temporary files, parse robots.txt, search folders, google dorks and search domains hosted on same s

The OWASP CSRFTester Project attempts to give developers the ability to test their applications for CSRF flaws.

A Python Web path scanner tool.

Powerful open-source XSS scanner and utility focused on automation.

Open Source Intelligence interface for Deep Web scraping.

This tool will try to find every website that host at the same server at your target.

OSINT Tool For Scraping Dark Websites.

Fingerprints servers, finds exploits, scans WebDAV.

A static analysis security scanner for ruby written web applications.

Tool for finding path of predictable resource locations.

Fast directory scanning and scraping tool.

C CLI implementation of the Java dirbuster tool.

Find web directories without bruteforce.

OSINT Scanning tool which discovers and maps directories found in javascript files hosted on a website.

Uility to embed XXE and XSS payloads in docx,odt,pptx,etc (OXML_XEE on steroids).

A tool used for compromising IBM/Lotus Domino servers.

Tool to bypass 40X response codes..

Passive Vulnerability Auditor.

Selenium powered Python script to automate searching for vulnerable web apps.

A plugin-based scanner that aids security researchers in identifying issues with several CMSs, mainly Drupal & Silverstr

Enumerate on drupal modules.

Simple non-intrusive Drupal scanner.

Drupal enumeration & exploitation tool.

A fully functional File inclusion vulnerability scanner (supporting GET and POST parameters) written in under 100 lines

A fully functional JavaScript library vulnerability scanner written in under 100 lines of code.

A fully functional SQL injection vulnerability scanner (supporting GET and POST parameters) written in under 100 lines o

A parser + crawler for .DS_Store files exposed publically.

A fully functional Cross-site scripting vulnerability scanner (supporting GET and POST parameters) written in under 100

Enemies Of Symfony - Debug mode Symfony looter.

Tool which aims to lure attackers using various types of web vulnerability scanners by tricking them into believing that

Interactive CLI Web Crawler.

Smart ssrf scanner using different methods like parameter brute forcing in post and get.

A Facebook Hacking Tool

A File Inclusion & Directory Traversal fuzzing, enumeration & exploitation tool.

This is a framework for HTTP related attacks. It is written in Perl with a GTK interface, has a proxy for debugging and

An extremely fast and flexible web fuzzer.

A tool that help you to guess how your shell was renamed after the server-side script of the file uploader saved it.

A little tool for local and remote file inclusion auditing and exploitation.

CMS/LMS/Library etc Versions Fingerprinter.

Decode and encode Flask session cookie.

Decode and encode Flask session cookie.

Tool to make cache poisoning by trying X-Forwarded-Host and X-Forwarded-Scheme headers on web pages.

Tool that automates the process of detecting and exploiting file upload forms flaws.

Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl.

An advanced cross-platform tool that automates the process of detecting and exploiting SQL injection security flaws.

Webkit based webclient (relies on PyQT).

A pentesting tool that dumps the source code from .git even when the directory traversal is disabled.

A repository with 3 tools for pwn'ing websites with .git repositories available'.

Opensource web security testing framework.

Tool to dump a git repository from a website, focused on as-complete-as-possible dumps and handling weird edge-cases.

Tool generates gopher link for exploiting SSRF and gaining RCE in various servers.

A web application scanner. Basically it detects some kind of vulnerabilities in your website.

Tool that lists the different ways of reaching a given type in a GraphQL schema.

Scripting engine to interact with a graphql endpoint for pentesting purposes.

GraphQL endpoint detection and engine fingerprinting.

Set of tools for pentesting gRPC-Web Applications.

HTTP Request Smuggling over HTTP/2 Cleartext (h2c).

Scans a website and suggests security headers to apply.

HTTP toolkit for security research. Aims to become an open source alternative to commercial software like Burp Suite Pro

Integrated web scraper and email account data breach comparison tool.

A web application analysis tool for detecting communications between javascript and the server.

Http2Smugl - Tool to detect and exploit HTTP request smuggling in cases it can be achieved via HTTP/2 -> HTTP/1.1 conver

A set of shell tools that let you manipulate, send, receive, and analyze HTTP messages. These tools can be used to test,

Async HTTP(S) scanner that greps response bodies and headers for strings or regex across hosts, ports, CIDR/ranges and T

"Repeater" style XSS post-exploitation tool for mass browser control.

A fast and multi-purpose HTTP toolkit allow to run multiple probers using retryablehttp library.

Blind WAF identification tool.

CRLF and open redirect fuzzer.

Open-Source Solution for Out of band Data Extraction.

This Python script can be used to bypass IP source restrictions using HTTP headers.

The Swiss Army knife for automated Web Application Testing.

Penetration testing tool that would take as input a list of domain names, scan them, determine if wordpress or joomla pl

Just Another Screenshot Tool.

A library that interprets Java serialized objects. It also comes with a command-line tool that can generate compilable c

Jboss verify and Exploitation Tool.

A simple remote scanner for Atlassian Jira

Network and Web Pentest Framework.

This php script fingerprints a given Joomla system and then uses Packet Storm's archive to check for bugs related to the

A Joomla password brute force tester.

Joomla scanner scans for known vulnerable remote file inclusion paths and files.

A black box, Ruby powered, Joomla vulnerability scanner.

Get a JavaScript shell with XSS.

A ready to use JSONP endpoints/payloads to help bypass content security policy (CSP).

Parse javascript using Tornado and JSBeautifier to discover interesting enpoints.

A Java application for automatic SQL database injection.

Advanced JavaScript Deobfuscation via Partial Evaluation.

Python tool created to identify Joomla version, scan for vulnerabilities and search for config files.

A tool for hacking / security testing to JWT.

LFI Scan & Exploit Tool.

Crawling and spidering framework.

Contextual Content Discovery Tool.

Advanced Web Application Dir Scanner.

Utility for scanning public kubernetes clusters.

This perl script leverages /proc/self/environ to attempt getting code execution out of a local file inclusion vulnerabil

A simple tool to help in the fuzzing for, finding, and exploiting of local file inclusion vulnerabilities in Linux-based

A simple script to infect images with PHP Backdoors for local file inclusion attacks.

This tool helps you exploit LFI (Local File Inclusion) vulnerabilities. Post discovery, simply pass the affected URL and

A unique automated LFi Exploiter with Bind/Reverse Shells.

Local file inclusion discovery and exploitation tool.

A Local File Inclusion Exploitation tool.

Python framework for auditing web applications firewalls.

Discovers endpoint and their parameters in JavaScript files.

Extracts links from webpage.

Log4j web app tester that includes WAF bypasses.

A fully automated, accurate, and extensive scanner for finding log4j RCE CVE-44228.

Find the parameters that can be used to find SSRF or Out-of-band resource load.

A multithreaded, very fast and smart HTTP(S) directory and file bruteforcer written in C on top of libcurl.

Scan a Magento site for information.

Generate a bunch of malicious pdf files with phone-home functionality.

Web Command Injection Tool.

Fetch many paths for many hosts - without killing the hosts.

Tool for scanning the HTTP methods supported by a webserver.

A fast HTTP enumerator that allows you to execute a large number of HTTP requests.

A scanner for Moodle LMS.

Path Traversal checking tool.

Automatic SQL injection utility using a lsit of URI addresses to test parameter manipulation.

NoSQL scanner and injector.

Automated Mongo database and NoSQL web application exploitation tool

A webshell framework for penetration testers.

Tool to find admin panels / admin login pages.

Script that scrapes urls on different .onion search engines.

OWASP WEB Directory Scanner.

A web application penetration testing framework (WAPTF).

The Offensive (Web) Testing Framework.

An intercepting proxy for web application testing.

This tool can be used to brute discover GET and POST parameters.

This tool for brute discover GET and POST parameters.

Mining URLs from dark corners of Web Archives for bug hunting/fuzzing/further probing.

Web Payload list editor to use techniques to try bypass web application firewall.

A tool to take screenshots of websites. Much like eyewitness.

Lightweight stealth web data collection framework for ethical security testing.

A Findsock Shell implementation in PHP + C.

Detect potentially malicious PHP files.

JavaScript file crawler and secret finder.

Image Payload Creating/Injecting tools.

Wordpress finger printer Tool.

A security scanner for Plone CMS.

Polymorphic webshells.

Security testing and exploitation toolkit built on top of Node.js and NPM.

A fast tool to scan client-side prototype pollution vulnerability written in Rust.

A scanner/exploitation tool written in GO, which leverages client-side Prototype Pollution to XSS by exploiting known ga

THE REAL hacker friendly proxy for web application pentests.

Self-deployable file hosting service for red teamers, allowing to easily upload and share payloads over HTTP and WebDAV.

Free web-application vulnerability and version scanner.

Web Inventory tool, takes screenshots of webpages using Pyppeteer.

JavaScript unobfuscator and beautifier.

A CLI tool and library allowing to simply decode all kind of BigIP cookies.

The Multi-Tool Web Vulnerability Scanner.

Tool for black-box regex fuzzing to bypass validations and discover normalizations in web applications.

An Simple Exploit for PHP Language.

First stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding securi

Web backdoor - infector - explorer.

Load cookies from your web browsers.

A tool to abuse Exchange services.

DirBuster for Rust.

Performs a dictionary attack against a live Microsoft Windows Small Business Server.

Send Attack Web Forms.

SQLi scanner to detect SQL vulns.

Collect RDP, web, and VNC screenshots smartly.

Second-order subdomain takeover scanner.

A python script to find sensitive data (apikeys, accesstoken, jwt,..) in javascript files.

Web Apps Scanner and Much more utilities.

Security tool to find potential vulnerable Server Side Request Forgery (SSRF) parameters.

A tool to dump Java serialization streams in a more human readable form.

A web fuzzing script written in perl.

A wrapper around massdns written in GO.

Web Application Security Scanner.

Fingerprint a web app using local files as the fingerprint sources.

A tool for auditing endpoints defined in exposed (Swagger/OpenAPI) definition files.

PHP Command Injection exploitation tool.

An HTTP Request Smuggling / Desync testing tool written in Python 3.

Python tool used to test for HTTP Desync/Request Smuggling attacks.

Tool to scan for secret files on HTTP servers.

Automatic XSS filter bypass.

Extract JavaScript source trees from Sourcemap files.

Static Php Analysis and Fuzzer.

An open source tool written in python to audit web applications using sharepoint and frontpage architecture.

Configurable web resource scanner.

A Proxy for detecting vulnerabilities in web applications

SPIP (CMS) scanner for penetration testing purpose written in Python.

A SQL injection digger.

A simple SSRF-testing sheriff written in Go.

Automatic SSRF fuzzer and exploitation tool.

A Security Tool for Enumerating WebSockets.

An offensive information and vulnerability scanner.

Fetches javascript file from a list of URLS or subdomains.

Automatic SQL injection exploitation tool.

Offensive Web Application Penetration Testing Framework.

Crawl and extract (regular or onion) webpages through TOR network.

Automatic Server-Side Template Injection Detection and Exploitation Tool.

Enumerate Typo3 version and extensions.

Defeating the latest version of ReCaptcha with 91% accuracy.

A script that automates detection of security flaws on websites' file upload systems'.

A python tool to extract URL addresses from different HOT sources and/or detect SPAM and malicious code

Information gathering & website reconnaissance.

Extracts URLs from OSINT Archives for Security Insights.

A vulnerability scanner which checks the security of WordPress installations using a black box approach.

A comprehensive web penetration testing tool written in Perl thatidentifies vulnerabilities in web applications.

A black box vBulletin vulnerability scanner written in perl.

Black box tool for Vulnerability detection in web applications.

A tool to scan for web vulnerabilities.

Cms and vulnerabilites detector & An intelligent bot auto shell injector.

Passive Security Scanner.

A tool which contains two functions to attack Web Application Firewalls.

An easy to use Web Application Finger Printing tool written in ruby using sqlite3 databases for storing the fingerprints

Analysing parameters with all payloads' bypass methods, aiming at benchmarking security solutions like WAF.

Web Application Scanner.

Download the entire Wayback Machine archive for a given URL.

Fetch and normalize parameterized URLs from the Wayback CDX API.

Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning.

A plugin based scanner for attacking and data mining web sites written in Perl.

Port of Wappalyzer (uncovers technologies used on websites) in go to automate scanning.

A directory-enumeration tool written in Go.

A handler for PHP system functions & also an alternative 'netcat' handler.

Tool Information Gathering Write By Python.

A tool designed for brute forcing Web Applications.

Identify technologies used on websites.

An OWASP Top 10 Security scanner.

AWS Attack Library.

Detect and bypass web application firewalls and protection systems.

Tool to detect if a given website is protected by a Content Delivery Network.

A perl script that consists of a port scanner, LFI scanner, MD5 bruteforcer, dork SQL injection scanner, fresh proxy sca

A Ruby framework for developing and using modules which aid in the penetration testing of WordPress powered websites and

Wordpress Attack Suite.

Chrome extension designed for WordPress Vulnerability Scanning and information gathering.

Simple Wordpress Security Scanner.

A modular framework for web services penetration testing.

Application for capturing, modifying and sending custom WebSocket data from client to server and vice versa.

Interactive cli tool for HTTP inspection.

Hidden parameters discovery suite.

An XMLRPC brute forcer targeting Wordpress written in Python 3.

Powerful XSS Scanning and Parameter analysis tool&gem.

An XSS scanner fully written in Python3 from scratch.

Simple XSS Scanner tool.

XSS spider - 66/66 wavsep XSS detected.

An automated XSS payload generator written in python.

Web Application XSS Scanner.

A brute force cross site scripting scanner.

Command line tool for detection of XSS attacks in URLs. Based on ModSecurity rules from OWASP CRS.

An automatic XSS discovery tool

A Cross Site Scripting Scanner & Vulnerability Confirmation.

Automatic WAF bypass tool.

A tool Designed for blind optimized XPath 1 injection attacks.

A fork of xxxpwn adding further optimizations and tweaks.

Yet Another Admin Finder.

A ruby script that scans for vulnerable & exploitable 3rd-party web applications on a network.

The YAWAST Antecedent Web Application Security Toolkit.

A web crawler that is useful for grabbing all user supplied input related to a given website and will save the output. I

A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.