Kscan: Simple Asset Mapping Tool
Kscan – Simple Asset Mapping Tool kscan is an asset mapping tool that can perform port scanning, TCP fingerprinting, and banner capture for specified assets, and obtain as much port information as possible without...
Category: Web Vulnerability Analysis
SQLiDetector: detect SQL injection Error based
SQLiDetector Simple python script supported with BurpBouty profile that helps you to detect SQL injection “Error based” by sending multiple requests with 14 payloads and checking for 152 regex patterns for different databases. The...
SSTImap v1.2 releases: About Automatic SSTI detection tool
SSTImap SSTImap is a penetration testing software that can check websites for Code Injection and Server-Side Template Injection vulnerabilities and exploit them, giving access to the operating system itself. This tool was developed to...
cloudfox v1.13 releases: find exploitable attack paths in cloud infrastructure
CloudFox CloudFox helps you gain situational awareness in unfamiliar cloud environments. It’s an open-source command line tool created to help penetration testers and other offensive security professionals find exploitable attack paths in cloud infrastructure....
ghauri v1.3 releases: automates the process of detecting and exploiting SQL injection
Ghauri An advanced cross-platform tool that automates the process of detecting and exploiting SQL injection security flaws Features Supports the following types of injection payloads: Boolean based. Error Based Time-Based Stacked Queries Support SQL...
bbot: OSINT automation for hackers
BEE·bot OSINT automation for hackers. BBOT is a recursive, modular OSINT framework written in Python. It is capable of executing the entire OSINT process in a single command, including subdomain enumeration, port scanning, web screenshots (with its gowitness module),...
autossrf: Smart context-based SSRF vulnerabiltiy scanner
autoSSRF autoSSRF is your best ally for identifying SSRF vulnerabilities at scale. Different from other ssrf automation tools, this one comes with the two following original features : Smart fuzzing on relevant SSRF GET parameters...
riskscanner: Open source multi-cloud security compliance scanning platform
riskscanner RiskScanner is an open-source multi-cloud security compliance scanning platform, Based on Cloud Custodian, Prowler, and Nuclei engines, it realizes security compliance scanning and vulnerability scanning of mainstream public (private) cloud resources. Functional advantage...
scodescanner: scan the source code for finding the Critical Vulnerabilities
SCodeScanner SCodeScanner stands for Source Code scanner where the user can scan the source code for finding the Critical Vulnerabilities. The main objective of this scanner is to find the vulnerabilities inside the source...
dnsReaper v1.9.4 releases: subdomain takeover tool for attackers, bug bounty hunters and the blue team
DNS Reaper DNS Reaper is yet another subdomain takeover tool, but with an emphasis on accuracy, speed, and the number of signatures in our arsenal! We can scan around 50 subdomains per second, testing...
Apache Tomcat Scanner v3.5 releases: scan for Apache Tomcat server vulnerabilities
Apache Tomcat Scanner A python script to scan for Apache Tomcat server vulnerabilities. Features Multithreaded workers to search for Apache tomcat servers. Multiple target sources accepted: Retrieving list of computers from a Windows domain...
cats: REST API Fuzzer and negative testing tool
cats REST API fuzzer and negative testing tool. Run thousands of self-healing API tests within minutes with no coding effort! Comprehensive: tests are generated automatically based on a large number of scenarios and cover...
CrackQL: GraphQL password brute-force and fuzzing utility
CrackQL CrackQL is a GraphQL password brute-force and fuzzing utility. CrackQL is a versatile GraphQL penetration testing tool that exploits poor rate-limit and cost analysis controls to brute-force credentials and fuzz operations. How does...
packj: detect malicious/risky open-source software packages
Packj flags malicious/risky open-source packages Packj (pronounced package) is a command-line (CLI) tool to vet open-source software packages for “risky” attributes that make them vulnerable to supply chain attacks. This is the tool behind...
restler-fuzzer v9.2.2 releases: first stateful REST API fuzzing tool
RESTler What is RESTler? RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services. For a given cloud service...
