Open Source Tools · Category
Proxies, scanners and fuzzers used to test web applications and APIs for vulnerabilities during development and authorised assessments.
Alternatives toAcunetixBurp Suite Professional
7 tools
Interactive TLS-capable intercepting HTTP proxy
Interactive HTTPS proxy with a terminal UI (mitmproxy), a web UI (mitmweb) and a scriptable command-line tool (mitmdump) driven by Python add-ons.
Automated SQL injection detection and testing
Command-line tool that automates the detection and confirmation of SQL injection flaws in web applications, with support for many database engines.
Template-based vulnerability scanner
Fast vulnerability scanner driven by YAML templates, with thousands of community templates for CVEs, misconfigurations and exposures across many protocols.
Fast web fuzzer for content and parameter discovery
Fast web fuzzer written in Go, used to discover hidden files, directories, virtual hosts and parameters by replacing a FUZZ keyword with wordlist entries.
Intercepting proxy and DAST scanner for web apps
Web application security scanner and intercepting proxy, formerly OWASP ZAP, with automated scans, a desktop UI, an API and a large add-on marketplace.
Deliberately insecure web application for training
Intentionally vulnerable web shop by OWASP, covering the OWASP Top Ten and more, used for security training, CTFs and testing scanners.
Web server scanner for dangerous files and misconfigurations
Long-running open-source web server scanner that checks for dangerous files, outdated server software and common misconfigurations.
