Application Security
Tools that find, prevent and fix weaknesses in software: static and dynamic testing, software composition analysis, API checks and runtime protection. Use Offensive Security & Pentesting for active exploitation of apps you are authorized to test.
Strix
Open-source AI penetration-testing agents for apps and APIs, validating findings with PoCs plus an optional managed cloud.
HackerOne
Commercial CTEM platform for bug bounty, vulnerability disclosure, validation and remediation workflows with researcher and AI-assisted testing.
Vulnerability ManagementFreemium
Snyk
Developer security platform for finding and fixing issues in application code, open-source dependencies, containers and infrastructure as code.
Application SecurityFreemium
OpenAI Daybreak Red Team
Daybreak Red Team is a paid early-access platform used to pentest web applications with a coordinated team of agents for authorized security teams.
Hermes Security
Hermes Security is a free open-source plugin used to review a local repository for security bugs for developers and AppSec teams who run Hermes Agent.
Application SecurityFreeOpen source
BLA (Blind LLM Agents)
BLA (Blind LLM Agents) is a free open-source CLI and MCP server used to protect release artifacts from AI reverse-engineering agents for software authors.
Application SecurityFreeOpen source
zizmor
zizmor is a free open-source static analyzer used to find and fix security flaws in GitHub Actions workflows for developers and DevSecOps teams.
Patchstack
Patchstack is a freemium security platform used to monitor vulnerabilities and block exploits for WordPress site owners, agencies, and plugin developers.
Application SecurityFreemium
Hacktron AI
Hacktron is an AI offensive security platform for continuous red teaming, white-box pentests with source code, and security review of every pull request.
Cariddi
Cariddi is a free, open-source Go crawler that takes a list of domains and scans the pages it finds for endpoints, secrets, API keys, tokens and file types.
Codex Security CLI
Codex Security CLI is a freemium, open-source tool used to find, validate, and fix code vulnerabilities for dev teams, with usage on a ChatGPT or API account.
Application SecurityFreemiumOpen source
Shannon
Shannon is a freemium AI pentester used to read web app source code and run real exploits that prove its findings for AppSec and pentest teams.
DefectDojo
DefectDojo is an open-source vulnerability management platform used to import, deduplicate, and track scanner findings for AppSec and DevSecOps teams.
Interactsh
Interactsh is a free out-of-band interaction server used to catch DNS and HTTP callbacks during vulnerability tests for pentesters on authorized targets.
Commix
Commix is a free command-injection exploitation tool used to detect and exploit OS command injection flaws in web apps for pentesters on authorized targets.
Application SecurityFreeOpen source
wafw00f
wafw00f is a free WAF fingerprinting tool used to detect which web application firewall sits in front of a site for recon and AppSec testers.
Application SecurityFreeOpen sourceWhatWeb
WhatWeb is a free web scanner used to identify technologies, frameworks, and plugins on websites for recon and application security practitioners.
dirsearch
dirsearch is a free web path scanner used to discover hidden directories and files on web servers for pentesters assessing authorized targets.
Application SecurityFreeOpen source
CodeQL
CodeQL is a freemium static analysis engine used to query source code as a database for security bugs for developers and application security teams.
Application SecurityFreemiumDalfox
Dalfox is a free XSS scanner used to find and verify cross-site scripting flaws in web parameters for pentesters and bug bounty hunters on authorized targets.
Application SecurityFreeOpen source
gosec (Securego)
gosec is a free static analysis tool used to inspect Go source code for security problems such as injection and weak crypto for Go developers and AppSec teams.
Application SecurityFreeOpen source
Bandit (PyCQA)
Bandit is a free static analysis tool used to find common security issues in Python source code for Python developers and application security teams.
Application SecurityFreeOpen source
Caido
Caido is a freemium web security auditing toolkit used to intercept, replay, and automate HTTP traffic for web pentesters and application security engineers.
Application SecurityFreemium
XBOW
XBOW is a paid autonomous offensive security platform used to pentest apps and APIs and prove findings with working exploits for security teams.
Grype
Grype is a free open-source vulnerability scanner from Anchore used to find known flaws in container images, filesystems, and SBOMs for DevSecOps teams.
Dependency-Track
Dependency-Track is a free platform used to analyze SBOMs and track component and vulnerability risk in the software supply chain for AppSec teams.
Application SecurityFreeOpen source
mitmproxy
mitmproxy is a free open-source interactive HTTPS proxy used to intercept, inspect, modify, and replay web and app traffic for testers and developers.
Application SecurityFreeOpen sourceDVWA (Damn Vulnerable Web Application)
DVWA is a free open-source intentionally vulnerable PHP web app used to practice common web attacks at set difficulty levels for students and new testers.
OWASP Juice Shop
OWASP Juice Shop is a free open-source deliberately insecure web app used to practice finding and exploiting web flaws for students and security trainers.
Echidna
Echidna is a free open-source smart contract fuzzer used to break user-defined invariants in Ethereum contracts for auditors and security engineers.
Foundry
Foundry is a free open-source Solidity development and testing toolkit used to build, fuzz, and debug smart contracts for auditors and developers.
Slither
Slither is a free open-source static analyzer for Solidity and Vyper used to find smart contract vulnerabilities before deployment for auditors.
Gitleaks
Gitleaks is a free open-source secret scanner used to detect hardcoded passwords, API keys, and tokens in git repos and files for security and dev teams.
Application SecurityFreeOpen source
Checkov
Checkov is a free static analysis tool used to find misconfigurations in infrastructure as code and open source packages for cloud and DevSecOps teams.
Promptfoo
Promptfoo is a freemium open-source CLI and library used to evaluate and red-team LLM applications and agents for developers and security teams.
Verno Labs
Verno Labs is a paid AI agent security platform used to red-team and monitor AI agents you are authorized to test, built for enterprise security teams.
Gobuster
Fast open-source Go tool for directory, DNS, virtual-host and cloud-bucket brute-forcing during authorized web and infrastructure assessments.
ffuf
Fast open-source web fuzzer written in Go for directory, virtual-host and parameter discovery during authorized web assessments.
Nikto
Nikto is a free open-source web server scanner that checks authorized targets for dangerous files, misconfigurations and outdated software.
WPScan
WPScan is a freemium WordPress security scanner with a free CLI for authorized assessments, plus paid API plans for commercial vulnerability intelligence.
Offensive Security & PentestingFreemium
Tenzai
Commercial agentic AI penetration-testing platform that runs continuous, end-to-end application tests with reproducible exploit evidence for enterprises.
GitGuardian
GitGuardian detects and remediates leaked secrets across code, CI/CD and collaboration tools, with a free plan for small teams and paid business tiers.
Application SecurityFreemium
TruffleHog
TruffleHog finds and verifies leaked secrets across git, cloud storage and CI artefacts, with a free open-source scanner and commercial TruffleHog Enterprise.
Application SecurityFreemiumOpen source
SonarQube
SonarQube analyses code for bugs, vulnerabilities and code smells across many languages, with a free Community Build and commercial Server or Cloud editions.
Application SecurityFreemiumOpen source
Nuclei
ProjectDiscovery’s template-driven vulnerability scanner for fast, community-powered checks across web apps, APIs, networks and cloud assets.
Semgrep
Semgrep is a fast, open-source static analysis engine that finds bugs and security issues in code with pattern rules and ready-made rule packs.
Application SecurityFreemiumOpen source
Cloudflare
Cloudflare is a global connectivity and security cloud offering CDN, WAF, DDoS protection and Zero Trust access on one network edge.
Application SecurityFreemium
Aikido Security
Commercial AppSec platform for SAST, SCA, secrets, cloud posture and DAST, with runtime protection and automated remediation.
Application SecurityFreemium
Wiz
Commercial cloud and AI security platform that maps code, cloud and runtime into a security graph to prioritise exploitable risk.
Cloud SecurityPaid
ZAP (Zed Attack Proxy)
Open-source web application scanner and intercepting proxy for finding vulnerabilities manually or in automated CI pipelines.
Application SecurityFreeOpen source
Burp Suite
Commercial web application security toolkit centred on an intercepting proxy, with a free Community Edition and paid Professional and DAST editions.
Application SecurityFreemium