Web Application

Content discovery, fuzzing, SQL injection and web exploitation. · 27 commands

Gobuster

Fast directory/DNS/vhost brute-forcer.

ffuf

Fuzz Faster U Fool — high-speed web fuzzer.

DIRB

Classic recursive web content scanner.

feroxbuster

Fast, recursive content discovery in Rust.

Wfuzz

Web application fuzzer for content & parameters.

sqlmap

Automatic SQL injection detection & exploitation.

Commix

Automated command-injection exploitation.

Dalfox

Fast parameter-analysis XSS scanner.

XSSer

Automated framework to detect & exploit XSS.

JoomScan

Joomla vulnerability/enumeration scanner.

CMSeeK

Detect CMS and enumerate version/plugins.

Burp Suite

The industry-standard web proxy & testing suite.

OWASP ZAP

Free, full-featured web app scanner & proxy.

dirsearch

Advanced web path brute-forcer.

Katana

Next-gen crawling & spidering framework.

hakrawler

Fast web crawler for endpoint discovery.

Arjun

HTTP parameter discovery tool.

ParamSpider

Mine parameters from web archives.

XSStrike

Advanced XSS detection with payload fuzzing.

jwt_tool

Test and tamper JSON Web Tokens.

droopescan

Scanner for Drupal, SilverStripe & more.

gospider

Fast Go web spider.

gf (grep-friendly)

Pattern wrapper to find interesting URLs.

qsreplace

Replace query-string values in URLs.

anew

Append only new, unique lines to a file.

CRLFuzz

Scan for CRLF injection vulnerabilities.

Jaeles

Signature-based web vulnerability scanner.