Tools

A tool for visual inspection of websites across a large list of hosts, producing an HTML report of screenshots grouped by similarity — an older but still-used alternative to gowitness/EyeWitness.

cat hosts.txt | aquatone

Finds hidden HTTP GET/POST parameters on a web endpoint by bruteforcing against a large parameter-name wordlist — the step before you know what to actually inject into.

arjun -u https://target.tld/api/endpoint

A Burp Suite extension that automatically tests every request with a lower-privileged session, surfacing broken access-control (authorisation) bugs without manually replaying each one.

Web technology profiler — identifies the CMS, analytics, ad networks, frameworks and hosting stack behind a site, plus historical technology-adoption lookups.

The standard web application security testing platform — intercepting proxy, repeater, intruder and a huge extension ecosystem (BApp Store). Community edition is free; Pro adds the active scanner.

Spiders a website and builds a custom wordlist from the words it finds — useful for generating a target-specific password/username dictionary rather than relying on rockyou alone.

cewl https://target.tld -d 2 -m 5 -w wordlist.txt

Automates detection and exploitation of OS command-injection vulnerabilities in web parameters, the command-injection equivalent of sqlmap.

commix --url="https://target.tld/ping?host=127.0.0.1"

A web content scanner that looks for existing (and hidden) objects by bruteforcing a wordlist against a target — one of the original tools in this space, still bundled in Kali.

dirb http://target/ /usr/share/wordlists/dirb/common.txt

Base64-wrapping a command and decoding it inline is a quick way past a filter that blocks certain characters in a command-injection point.

echo 'aWQ7d2hvYW1p' | base64 -d | bash

Takes screenshots of a large list of web services and organises them into a browsable report — the fastest way to triage which of a thousand open ports is actually worth looking at by hand.

eyewitness --web -f urls.txt -d report/

A fast, recursive content-discovery tool written in Rust — automatically dives into discovered directories without needing to be re-run manually, unlike gobuster/dirb.

feroxbuster -u https://target.tld -w wordlist.txt -x php,html,txt

A fast web fuzzer written in Go — content discovery, virtual-host fuzzing and parameter fuzzing, all through one flexible FUZZ-keyword syntax.

ffuf -u http://target/FUZZ -w wordlist.txt -mc all -fc 404

Decodes, brute-forces and re-signs Flask's itsdangerous-based session cookie, recovering the app's SECRET_KEY from a wordlist and letting you forge an arbitrary session.

flask-unsign --unsign --cookie "<session_cookie>" --wordlist rockyou.txt

Dictionaries of attack payloads and predictable filenames/paths for discovery and fuzzing (injection strings, common backup/config filenames, error-message patterns), maintained separately from SecLists.

Fetches known URLs for a domain from the Wayback Machine, Common Crawl, AlienVault OTX and urlscan.io — a broader net than waybackurls alone.

echo target.tld | gau

A fast Go-based bruteforcer for directories/files, DNS subdomains, virtual hosts and S3 buckets — the everyday content-discovery default for a lot of testers.

gobuster dir -u http://target -w wordlist.txt -x php,txt,bak

A Go-based web screenshot utility built for the same triage job as EyeWitness, using a headless Chrome for the capture and shipping as a single static binary.

gowitness scan file -f urls.txt

A Burp Suite extension (InQL) and standalone tooling for exploring and attacking GraphQL APIs — schema introspection, query generation and batching-attack helpers.

Fast full-text code search engine across half a million public Git repositories, useful for finding leaked secrets, specific library usage or vulnerable code patterns at scale.

An interactive, scriptable HTTPS proxy for inspecting and modifying traffic on the fly — the open-source alternative to Burp when you need Python scripting against the traffic stream itself.

mitmproxy --mode transparent

ProjectDiscovery's fast, multi-purpose HTTP probing tool — takes a list of hosts and reports which are alive, their titles, status codes, tech stack and more, in one pass.

cat subdomains.txt | httpx -title -tech-detect -status-code

Fast, multi-purpose HTTP toolkit for probing a large list of hosts/subdomains — status codes, titles, tech fingerprints and TLS data — as a recon pipeline stage.

cat subs.txt | httpx -title -tech-detect -status-code

A toolkit for testing, tampering with and cracking JSON Web Tokens — algorithm-confusion attacks, signature stripping, and a scan mode against a list of known JWT misconfigurations.

python3 jwt_tool.py <token> -T

Brute-forces the HMAC secret used to sign a JWT (HS256/HS384/HS512), turning a weak signing key into a fully forgeable token.

jwt-cracker eyJhbGciOi... abcdefghijklmnopqrstuvwxyz 6

A fast web crawler from ProjectDiscovery built for security testing — headless-browser-aware, JavaScript-parsing crawl that feeds URLs straight into fuzzing or nuclei.

katana -u https://target.tld -jc -d 3

An open-source web server scanner that checks for thousands of dangerous files/programs, outdated server software and other misconfigurations — fast and deliberately noisy.

nikto -h https://target.tld

ProjectDiscovery's fast, template-driven vulnerability scanner — thousands of community-maintained YAML templates cover CVEs, misconfigurations and exposed panels across a target list in one pass.

nuclei -u https://target.tld -t cves/ -severity critical,high

OWASP's collection of concise, defensive "how to actually do this correctly" references (auth, session management, input validation, crypto storage) rather than attack techniques.

A free, open-source web application security scanner from OWASP — intercepting proxy, active/passive scanning and automation API, the open-source counterpart to Burp Suite.

Automates padding oracle attacks against CBC-mode ciphertext (cookies, tokens) when an application leaks a distinguishable error for bad padding.

perl padbuster.pl http://target/ <encrypted> 8 -cookies "auth=<value>"

PortSwigger's Burp Suite extension for finding hidden, unlinked parameters and headers — including the ones that unlock web-cache-poisoning bugs.

Mines URLs with parameters straight out of the Wayback Machine for a target domain — a fast way to build an attack surface list without touching the live site at all.

paramspider -d target.tld

A huge, actively maintained collection of payloads and bypass techniques for practically every vulnerability class — the reference every web pentester keeps a tab open to.

Fast OSINT-focused web crawler that extracts URLs, emails, social-media handles, subdomains and files (with metadata) from a target site as it crawls.

python3 photon.py -u https://example.com -l 3 --wayback

Source-code search engine that lets you grep the indexed web for a snippet — a tracking ID, a JS library string or a signature left by a specific web shell/skimmer.

No jq installed? Python's json.tool module is on every box that has Python and does the same job for a quick read.

curl -s https://api.target.tld/data | python3 -m json.tool

Automates detecting and exploiting SQL injection vulnerabilities, including database fingerprinting, data extraction and, where the DBMS allows it, OS command execution.

sqlmap -u 'http://target/?id=1' --batch --dbs

Checks a server's TLS/SSL configuration from the command line — supported protocols and ciphers, certificate details, and known vulnerabilities like Heartbleed or POODLE — no browser or Qualys quota needed.

./testssl.sh https://target.tld

High-throughput HTTP request engine (Python-scripted) built for large brute-force jobs and race-condition testing that would be too slow through a regular intercepting proxy.

Chains tomnomnom's waybackurls with ProjectDiscovery's httpx to turn archived history into a live-host check in one pipeline.

echo example.com | waybackurls | httpx -silent

Free sandboxed URL scanner that renders a page, records every request it makes, and archives screenshots and the DOM — used to safely inspect a suspicious link before clicking it.

Identifies and fingerprints which web application firewall (if any) is protecting a target site, based on response behaviour to a set of probes.

wafw00f https://example.com

Browser extension and API that fingerprints the technology stack of a website (CMS, JS frameworks, server software, analytics) from passive page signals.

Pulls every URL the Wayback Machine has ever archived for a domain — a quick, passive way to surface old endpoints, parameters and forgotten paths that are still live.

echo target.tld | waybackurls

CLI website fingerprinting tool with 1800+ plugins identifying CMS, JS libraries, web servers and embedded devices from HTTP responses.

whatweb -a 3 https://example.com

A black-box WordPress security scanner — enumerates plugins, themes and users, and checks versions against a maintained vulnerability database.

wpscan --url https://target.tld --enumerate vp,vt,u

A cross-site scripting detection suite that fuzzes parameters with a context-aware payload generator, rather than firing a static payload list at everything.

python3 xsstrike.py -u "https://target.tld/search?q=test"

Generates payloads that exploit unsafe Java object deserialization across a wide range of common libraries — the standard reference tool for Java deserialisation attacks.

java -jar ysoserial.jar CommonsCollections6 "id" > payload.bin