Vulnerability Scanning

Nuclei

Go

Featured

Fast vulnerability scanner driven by YAML templates. Thousands of community-contributed detection templates.

sqlmap

Python

Automatic SQL injection and database takeover tool. Detects and exploits SQL injection flaws.

WPScan

Ruby

WordPress security scanner. Enumerates plugins, themes, users, and checks for known vulnerabilities.

OpenVAS

C

Featured

Full-featured vulnerability scanner. 50,000+ NVTs, credentialed scanning, compliance checks.

XSStrike

Python

Advanced XSS detection suite. Fuzzing engine, context analysis, and WAF detection/bypass capabilities.

Commix

Python

Automated OS command injection exploitation tool. Tests web apps for command injection vulnerabilities.

testssl.sh

Shell

Command-line tool for checking TLS/SSL ciphers, protocols, and cryptographic flaws on any port.

Trivy

Go

Comprehensive vulnerability scanner for containers, filesystems, git repos, and Kubernetes with SBOM generation.

Grype

Go

Vulnerability scanner for container images and filesystems that matches installed packages against known CVEs.

Semgrep

OCaml

Lightweight static analysis engine for finding bugs and enforcing code standards across 30+ languages with custom rules.

DalFox

Go

Parameter analysis and XSS scanner with automatic payload generation, DOM-based detection, and pipeline support.

Retire.js

JavaScript

Scanner for detecting use of JavaScript libraries with known vulnerabilities in web applications.

OSV-Scanner

Go

Google's dependency vulnerability scanner using the OSV.dev database across multiple language ecosystems.

Lynis

Shell

Security auditing and hardening tool for Linux/macOS with compliance testing for HIPAA, ISO27001, and PCI DSS.

afrog

Go

Fast vulnerability scanner with custom PoC support for CVEs, default credentials, and command injection.

Vuls

Go

Agentless vulnerability scanner for Linux and FreeBSD with CVE detection.

Infection Monkey

Python

Automated adversary emulation platform for validating network security controls.

boofuzz

Python

Network protocol fuzzing framework and successor to the Sulley fuzzer.

garak

Python

NVIDIA's LLM vulnerability scanner. Tests language models for prompt injection, jailbreaks, data leakage, and harmful outputs.

Osmedeus

Go

Automated reconnaissance and vulnerability scanning workflow engine. Chains recon, scanning, and exploitation into configurable pipelines.

DeepAudit

Python

Multi-agent AI code auditing system with automated sandbox PoC verification. Has discovered 49 CVEs across 17 open-source projects.

Titus

Go

High-performance secrets scanner by Praetorian with CLI, Go library, Burp extension, and Chrome extension. 487 detection rules.