Web security
Tools that check websites and web apps for weak settings and vulnerabilities
1–100 of 867
ImpactToolCategoryStarsUpdated
Can harm othersNucleiprojectdiscovery/nucleiA command-line scanner that sends requests following steps written in YAML templates and checks the responses for known vulnerabilities and misconfigurations.Vulnerability scanning / Web securitystars32,3012026-10-25Local onlyOWASP Juice Shopjuice-shop/juice-shopAn intentionally vulnerable online shop for practice. Run it on your own computer to learn how web vulnerabilities work and to try out security testing tools.Learning and practice labs / Web securitystars14,2282026-10-23Reaches othersSafeLinechaitin/safelineA self-hosted, reverse-proxy WAF that sits in front of your own web app, inspects incoming HTTP requests, and blocks attacks. You install it on your own Linux server with Docker.Defense and hardening / Web securitystars22,9482026-10-22Reaches othersWeb-Checklissy93/web-checkAn OSINT tool that shows a website's public information, such as DNS, certificates, and headers, from a single URL.Reconnaissance / Web securitystars35,2192026-10-25Can harm othersZAPzaproxy/zaproxyA free web app scanner that sits between your browser and a web app, records the traffic, and looks for vulnerabilities. Formerly OWASP ZAP, now ZAP by Checkmarx.Web security / Vulnerability scanningstars16,0252026-10-23Not ratedfrpfatedier/frpReview coming soon (opens GitHub in a new tab)Web security / Defense and hardeningstars110,1022026-10-23Not ratedstrixusestrix/strixReview coming soon (opens GitHub in a new tab)Web securitystars71,4862026-10-24Not ratedshannonkeygraphhq/shannonReview coming soon (opens GitHub in a new tab)Web security / Vulnerability scanningstars49,2902026-10-15Not ratedbrunousebruno/brunoReview coming soon (opens GitHub in a new tab)Web securitystars47,8172026-10-23Not ratedbig-list-of-naughty-stringsminimaxir/big-list-of-naughty-stringsReview coming soon (opens GitHub in a new tab)AppSec and DevSecOps / Web securitystars47,7212024-04-18Not ratedv2ray-corev2ray/v2ray-coreReview coming soon (opens GitHub in a new tab)Web securitystars46,9022026-08-31Not ratedmitmproxymitmproxy/mitmproxyReview coming soon (opens GitHub in a new tab)Web security / Cryptography and passwordsstars46,2582026-10-23Not ratedsqlmapsqlmapproject/sqlmapReview coming soon (opens GitHub in a new tab)Web securitystars38,7702026-10-22Not ratedclihttpie/cliReview coming soon (opens GitHub in a new tab)Web securitystars38,6702024-12-17Not ratedpentagivxcontrol/pentagiReview coming soon (opens GitHub in a new tab)Web securitystars32,1972026-10-22Not ratednginxconfig.iodigitalocean/nginxconfig.ioReview coming soon (opens GitHub in a new tab)Web securitystars28,2562024-12-14Not ratedapi-security-checklistshieldfy/api-security-checklistReview coming soon (opens GitHub in a new tab)Web securitystars23,3352026-07-21Not ratedskillspectornvidia/skillspectorReview coming soon (opens GitHub in a new tab)Web securitystars21,1172026-10-23Not ratedkatanaprojectdiscovery/katanaReview coming soon (opens GitHub in a new tab)Web security / Reconnaissancestars17,7222026-10-23Not rateddompurifycure53/dompurifyReview coming soon (opens GitHub in a new tab)Web securitystars17,4782026-10-23Not ratedapisixapache/apisixReview coming soon (opens GitHub in a new tab)Web security / Containers and cloudstars17,2502026-10-23Not ratedgoproxysnail007/goproxyReview coming soon (opens GitHub in a new tab)Web securitystars17,1462026-08-17Not ratedlyniscisofy/lynisReview coming soon (opens GitHub in a new tab)Vulnerability scanning / Defense and hardening / Web securitystars16,5412026-09-16Not ratedcrowdseccrowdsecurity/crowdsecReview coming soon (opens GitHub in a new tab)Defense and hardening / Network / Web securitystars15,2782026-10-23Not ratedoauth2-proxyoauth2-proxy/oauth2-proxyReview coming soon (opens GitHub in a new tab)Defense and hardening / Web securitystars15,2572026-10-23Not ratedxsstrikes0md3v/xsstrikeReview coming soon (opens GitHub in a new tab)Web securitystars15,2262025-04-26Not rateddirsearchmaurosoria/dirsearchReview coming soon (opens GitHub in a new tab)AppSec and DevSecOps / Web securitystars15,0022026-10-20Not ratedfscanshadow1ng/fscanReview coming soon (opens GitHub in a new tab)Web securitystars14,7082026-10-01Not ratedhacker101hacker0x01/hacker101Review coming soon (opens GitHub in a new tab)Web securitystars14,5842025-02-22Not rateddvwadigininja/dvwaReview coming soon (opens GitHub in a new tab)Web security / Learning and practice labsstars13,8942026-10-18Not ratedroutersploitthreat9/routersploitReview coming soon (opens GitHub in a new tab)Web securitystars13,2692026-05-05Not ratednuclei-templatesprojectdiscovery/nuclei-templatesReview coming soon (opens GitHub in a new tab)Web security / Learning and practice labsstars13,2022026-10-24Not ratedesp32marauderjustcallmekoko/esp32marauderReview coming soon (opens GitHub in a new tab)Network / Web security / Reverse engineeringstars12,8812026-10-24Not ratedcamoufoxdaijro/camoufoxReview coming soon (opens GitHub in a new tab)Red teaming and C2 / Web securitystars12,7522026-10-24Not ratedresources-for-beginner-bug-bounty-huntersnahamsec/resources-for-beginner-bug-bounty-huntersReview coming soon (opens GitHub in a new tab)Web securitystars12,3022024-07-23Not rateddetect-it-easyhorsicq/detect-it-easyReview coming soon (opens GitHub in a new tab)Reverse engineering / Web securitystars11,7872026-10-24Not ratedxraychaitin/xrayReview coming soon (opens GitHub in a new tab)Web securitystars11,7682024-10-29Not ratedcodex-securityopenai/codex-securityReview coming soon (opens GitHub in a new tab)Web security / Vulnerability scanningstars11,1882026-10-24Not ratedbunkerwebbunkerity/bunkerwebReview coming soon (opens GitHub in a new tab)Defense and hardening / Web security / Containers and cloudstars11,1062026-10-23Not ratedbeefbeefproject/beefReview coming soon (opens GitHub in a new tab)Web securitystars11,0692026-10-23Not ratedtyktyktechnologies/tykReview coming soon (opens GitHub in a new tab)Containers and cloud / Web securitystars10,8692026-10-23Not ratedniktosullo/niktoReview coming soon (opens GitHub in a new tab)Web securitystars10,7962026-10-22Not ratedwuzzasciimoo/wuzzReview coming soon (opens GitHub in a new tab)Web securitystars10,7432026-08-04Not ratedwpscanwpscanteam/wpscanReview coming soon (opens GitHub in a new tab)Web security / Networkstars9,8112026-10-22Not ratedmitmproxy2swaggeralufers/mitmproxy2swaggerReview coming soon (opens GitHub in a new tab)Web securitystars9,6712026-10-19Not ratedrengineyogeshojha/rengineReview coming soon (opens GitHub in a new tab)Reconnaissance / Web securitystars8,8862026-10-08Not ratedclaude-redsnailsploit/claude-redReview coming soon (opens GitHub in a new tab)Reconnaissance / Web security / Defense and hardeningstars8,6332026-10-12Not ratedtsunami-security-scannergoogle/tsunami-security-scannerReview coming soon (opens GitHub in a new tab)Web security / Vulnerability scanningstars8,6182026-10-06Not ratedjsfuckaemkei/jsfuckReview coming soon (opens GitHub in a new tab)Reverse engineering / Web securitystars8,6032025-03-10Not ratedbanditpycqa/banditReview coming soon (opens GitHub in a new tab)Web securitystars8,3392026-10-19Not ratedreconftwsix2dez/reconftwReview coming soon (opens GitHub in a new tab)Reconnaissance / Web securitystars8,2832026-09-26Not ratedgraphql-voyagerapis-guru/graphql-voyagerReview coming soon (opens GitHub in a new tab)Web securitystars8,1692026-05-12Not ratedferoxbusterepi052/feroxbusterReview coming soon (opens GitHub in a new tab)Web securitystars8,1342026-10-15Not ratedtraccartraccar/traccarReview coming soon (opens GitHub in a new tab)Web security / Containers and cloudstars7,9112026-10-23Not ratedyakityaklang/yakitReview coming soon (opens GitHub in a new tab)Web securitystars7,8262026-10-23Not ratedawesome-shodan-queriesjakejarvis/awesome-shodan-queriesReview coming soon (opens GitHub in a new tab)Reconnaissance / Web security / Learning and practice labsstars7,8082024-05-27Not ratedpenetration_testing_pocmr-xn/penetration_testing_pocReview coming soon (opens GitHub in a new tab)Web security / Vulnerability scanning / Red teaming and C2stars7,5292026-10-24Not ratedawesome-web-hackinginfoslack/awesome-web-hackingReview coming soon (opens GitHub in a new tab)Web securitystars7,3282026-09-18Not rateddeepauditlintsinghua/deepauditReview coming soon (opens GitHub in a new tab)Web security / AppSec and DevSecOpsstars7,2062026-10-16Not ratedai-infra-guardtencent/ai-infra-guardReview coming soon (opens GitHub in a new tab)Web securitystars7,0662026-10-22Not ratedtfsecaquasecurity/tfsecReview coming soon (opens GitHub in a new tab)Web security / Vulnerability scanning / Containers and cloudstars7,0582026-03-25Not ratedwhatweburbanadventurer/whatwebReview coming soon (opens GitHub in a new tab)Reconnaissance / Web securitystars6,9112026-04-02Not ratedproxybridgeinterceptsuite/proxybridgeReview coming soon (opens GitHub in a new tab)Web securitystars6,8752026-10-22Not ratedjwt_toolticarpi/jwt_toolReview coming soon (opens GitHub in a new tab)Web security / Cryptography and passwordsstars6,8032025-05-01Not ratedhackerone-reportsreddelexc/hackerone-reportsReview coming soon (opens GitHub in a new tab)Web securitystars6,6262026-10-12Not ratedawesome-bugbounty-toolsvavkamil/awesome-bugbounty-toolsReview coming soon (opens GitHub in a new tab)Learning and practice labs / Web securitystars6,3752026-10-06Not ratedk8toolsk8gege/k8toolsReview coming soon (opens GitHub in a new tab)Exploits and PoCs / Web securitystars6,2362025-01-25Not ratedscan4allghosttroops/scan4allReview coming soon (opens GitHub in a new tab)Web security / Network / Cryptography and passwordsstars6,1872024-07-12Not ratedspringbootvulexploitlandgrey/springbootvulexploitReview coming soon (opens GitHub in a new tab)Web securitystars6,1472021-03-10Not ratedzammadzammad/zammadReview coming soon (opens GitHub in a new tab)Web securitystars6,0262026-10-23Not ratedcommixcommixproject/commixReview coming soon (opens GitHub in a new tab)Web securitystars5,8942026-10-24Not ratedeyewitnessredsiege/eyewitnessReview coming soon (opens GitHub in a new tab)Reconnaissance / Web securitystars5,8782026-01-05Not ratedsqli-labsaudi-1/sqli-labsReview coming soon (opens GitHub in a new tab)Web securitystars5,8632023-12-11Not rateddnstwistelceef/dnstwistReview coming soon (opens GitHub in a new tab)Reconnaissance / Web securitystars5,7652025-04-15Not ratednettackerowasp/nettackerReview coming soon (opens GitHub in a new tab)Reconnaissance / Web security / Vulnerability scanningstars5,6872026-10-23Not ratedtun2socksxjasonlyu/tun2socksReview coming soon (opens GitHub in a new tab)Web security / Networkstars5,5522026-10-11Not ratedaltairaltair-graphql/altairReview coming soon (opens GitHub in a new tab)Web securitystars5,4342026-10-23Not ratedagentic-bug-hunterawarexone/agentic-bug-hunterReview coming soon (opens GitHub in a new tab)Reconnaissance / Web securitystars5,4172026-10-23Not ratedladonk8gege/ladonReview coming soon (opens GitHub in a new tab)Web security / Network / Cryptography and passwordsstars5,3372025-03-24Not rateddalfoxhahwul/dalfoxReview coming soon (opens GitHub in a new tab)Web securitystars5,3282026-10-22Not ratedclaude-bughunterelementalsouls/claude-bughunterReview coming soon (opens GitHub in a new tab)Web securitystars5,2632026-10-23Not ratedawesomexsss0md3v/awesomexssReview coming soon (opens GitHub in a new tab)Web security / Exploits and PoCsstars5,1532024-10-30Not ratedgaulc/gauReview coming soon (opens GitHub in a new tab)Web security / Reconnaissancestars5,1422026-10-12Not ratedsecurity-study-planjassics/security-study-planReview coming soon (opens GitHub in a new tab)Containers and cloud / Web securitystars5,1072026-10-10Not ratedwebhackersweaponshahwul/webhackersweaponsReview coming soon (opens GitHub in a new tab)Web security / Learning and practice labsstars5,1002026-09-07Not ratedw3afandresriancho/w3afReview coming soon (opens GitHub in a new tab)Web securitystars4,9132023-02-22Not ratedopenvas-scannergreenbone/openvas-scannerReview coming soon (opens GitHub in a new tab)Vulnerability scanning / Web securitystars4,8852026-10-21Not ratedopenapi-directoryapis-guru/openapi-directoryReview coming soon (opens GitHub in a new tab)Web security / Containers and cloud / Reverse engineeringstars4,5842026-04-20Not ratedmalicious-pdfjonaslejon/malicious-pdfReview coming soon (opens GitHub in a new tab)Web securitystars4,4962026-10-17Not ratedlinkfindergerbenjavado/linkfinderReview coming soon (opens GitHub in a new tab)Web securitystars4,4702024-04-13Not ratedaxiompry0cc/axiomReview coming soon (opens GitHub in a new tab)Network / Web securitystars4,4402024-09-30Not ratedweb-attack-cheat-sheetriramar/web-attack-cheat-sheetReview coming soon (opens GitHub in a new tab)Learning and practice labs / Web securitystars4,4372026-09-04Not ratedafrogzan8in/afrogReview coming soon (opens GitHub in a new tab)Web securitystars4,4362026-10-24Not ratedhaeoverspace-labs/haeReview coming soon (opens GitHub in a new tab)Web securitystars4,4012026-10-10Not ratedapplicationinspectormicrosoft/applicationinspectorReview coming soon (opens GitHub in a new tab)Web security / AppSec and DevSecOpsstars4,3982026-09-15Not ratedweb-security-learningchybeta/web-security-learningReview coming soon (opens GitHub in a new tab)Web securitystars4,3052021-10-02Not ratedkscanlcvvvv/kscanReview coming soon (opens GitHub in a new tab)Web security / Cryptography and passwordsstars4,3002023-08-22Not ratedexphubzhzyker/exphubReview coming soon (opens GitHub in a new tab)Web security / Vulnerability scanningstars4,2912021-04-04Not ratedesp32-divcifertech/esp32-divReview coming soon (opens GitHub in a new tab)Network / Web securitystars4,2282026-09-22Not ratedtamperchromegoogle/tamperchromeReview coming soon (opens GitHub in a new tab)Web securitystars4,2272026-02-26