Cybersecurity tools directory
158 reviewed tools with install guidance, safe example commands and legal-use notes. Every record links to the official website, documentation and source; use tools only on systems you own or are authorised to test.
Arjun finds hidden HTTP parameters on web endpoints by testing wordlists efficiently.
Burp Suite is a web application security testing platform built around an intercepting proxy, available in a free Commun...
Caido is a lightweight web security auditing toolkit with an intercepting proxy, replay and automation features.
Dalfox is an open-source XSS scanner and parameter analyser written in Go.
Gobuster brute-forces URIs (directories and files), DNS subdomains and virtual host names using wordlists.
Interactsh is an open-source ProjectDiscovery tool that captures out-of-band DNS, HTTP and SMTP interactions, used to co...
Katana is a fast, configurable web crawler from ProjectDiscovery.
Nikto is an open-source web server scanner that checks for dangerous files, outdated server software and common misconfi...
Nuclei is a fast, template-driven vulnerability scanner where checks are written as readable YAML templates.
ZAP (Zed Attack Proxy) is a free, open-source web application scanner and intercepting proxy maintained by the ZAP commu...
WPScan is a WordPress security scanner that identifies the core version, plugins and themes and matches them against a v...
Wapiti is a black-box web vulnerability scanner that crawls a site and fuzzes forms and parameters to find issues such a...
Wfuzz is a Python web fuzzer that replaces FUZZ placeholders in any part of a request with payloads.
WhatWeb identifies the technologies a website uses, such as the web server, CMS, JavaScript libraries and frameworks.
XSStrike is a Python cross-site scripting detection suite with fuzzing and context analysis.
dirsearch is a command-line web path scanner that brute-forces directories and files on a web server.
feroxbuster is a fast, recursive content-discovery tool written in Rust.
ffuf is a fast web fuzzer used to discover hidden directories, files, virtual hosts and parameters.
httpx is a multi-purpose HTTP toolkit from ProjectDiscovery that probes lists of hosts to see which run web services and...
mitmproxy is an interactive HTTP/HTTPS intercepting proxy for inspecting and modifying traffic between a client and a se...
sqlmap automates the detection and exploitation of SQL injection flaws in a web application's parameters.