Automated SQL injection detection and testing
Command-line tool that automates the detection and confirmation of SQL injection flaws in web applications, with support for many database engines.
sqlmap tests parameters of a web application for SQL injection and, when a flaw is confirmed, can enumerate the backend database to demonstrate impact. It supports a long list of database management systems and several injection techniques, and is a standard tool in web penetration testing.
Because it can extract data from vulnerable systems, sqlmap is a dual-use tool. It belongs in authorised assessments, in bug bounty programmes that permit it, and in developers' own test environments to verify that fixes work.
GPL-2.0-or-later · GNU GPL v2 or later, with clarifications · Open source
The LICENSE file grants GPL v2 (or later) with clarifications and exceptions; commercial embedding licences are sold separately.
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: NOASSERTION.
No published advisory found for sqlmap in GitHub repository advisories. That does not mean the tool has no vulnerabilities.
Sources: GitHub repository advisories · checked 2026-10-20.
Interactive TLS-capable intercepting HTTP proxy
Interactive HTTPS proxy with a terminal UI (mitmproxy), a web UI (mitmweb) and a scriptable command-line tool (mitmdump) driven by Python add-ons.
Fast web fuzzer for content and parameter discovery
Fast web fuzzer written in Go, used to discover hidden files, directories, virtual hosts and parameters by replacing a FUZZ keyword with wordlist entries.
Intercepting proxy and DAST scanner for web apps
Web application security scanner and intercepting proxy, formerly OWASP ZAP, with automated scans, a desktop UI, an API and a large add-on marketplace.
Template-based vulnerability scanner
Fast vulnerability scanner driven by YAML templates, with thousands of community templates for CVEs, misconfigurations and exposures across many protocols.
Deliberately insecure web application for training
Intentionally vulnerable web shop by OWASP, covering the OWASP Top Ten and more, used for security training, CTFs and testing scanners.
Web server scanner for dangerous files and misconfigurations
Long-running open-source web server scanner that checks for dangerous files, outdated server software and common misconfigurations.
