Pentesting & DAST in Security & Identity

Burp Suite

portswigger.net

Popular

PortSwigger's intercepting proxy and scanner; the standard toolkit for web application pentesting.

app

ZAP

zaproxy/zaproxy

Popular

Free open-source web app scanner and intercepting proxy (formerly OWASP ZAP), now backed by Checkmarx.

16.1k1w ago

Nuclei

projectdiscovery/nuclei

Popular

Fast template-based vulnerability scanner with thousands of community YAML templates for CVEs and misconfigs.

32.5k1w ago

Nmap

nmap/nmap

Popular

Classic network discovery and port scanner with a scripting engine for service and vulnerability detection.

13.9k1w ago

Metasploit

rapid7/metasploit-framework

Popular

Rapid7's exploitation framework with thousands of modules for exploits, payloads and post-exploitation.

39.3k5d ago

Caido

caido.io

Rising

Modern, lightweight Rust-based web security auditing toolkit; a rising Burp Suite alternative.

app

sqlmap

sqlmapproject/sqlmap

Automates detection and exploitation of SQL injection flaws across major database engines.

38.9k1w ago

ffuf

ffuf/ffuf

Fast web fuzzer for discovering hidden content, parameters and virtual hosts.

17k1mo ago

Wireshark

wireshark/wireshark

Popular

The standard network protocol analyzer for capturing and inspecting packets.

10.1k6d ago

Kali Linux

kali.org

Popular

Debian-based penetration testing distribution bundling hundreds of security tools.

platform

BloodHound

SpecterOps/BloodHound

Maps Active Directory and Entra ID attack paths as a graph; used by both red and blue teams.

3.5k2w ago

Strix

usestrix/strix

New

Open-source autonomous AI agents that find and validate vulnerabilities by running real attacks against apps.

74.6k2d ago

RustScan

bee-san/RustScan

Very fast port scanner that finds open ports in seconds, then hands them to Nmap for service detection.

20.7k1.2k/wk1w ago-19%

MobSF

MobSF/Mobile-Security-Framework-MobSF

Automated security testing for Android, iOS and Windows apps: static and dynamic analysis plus malware checks.

22.2k1d ago

bbot

blacklanternsecurity/bbot

The recursive internet scanner for hackers.

11.1k10.2k/wk1d ago-3%

Shannon

KeygraphHQ/shannon

New

Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real…

51.2k3.7k/wk1w ago+176%


1	Burp SuitePopular PortSwigger's intercepting proxy and scanner; the standard toolkit for web application pentesting.	No public repository or package of its own to measure
2	ZAPPopular Free open-source web app scanner and intercepting proxy (formerly OWASP ZAP), now backed by Checkmarx.	16.1k	n/a	n/a	1w ago	77
3	NucleiPopular Fast template-based vulnerability scanner with thousands of community YAML templates for CVEs and misconfigs.	32.5k	n/a	n/a	1w ago	82
4	NmapPopular Classic network discovery and port scanner with a scripting engine for service and vulnerability detection.	13.9k	n/a	n/a	1w ago	76
5	MetasploitPopular Rapid7's exploitation framework with thousands of modules for exploits, payloads and post-exploitation.	39.3k	n/a	n/a	5d ago	84
6	CaidoRising Modern, lightweight Rust-based web security auditing toolkit; a rising Burp Suite alternative.	No public repository or package of its own to measure
7	sqlmap Automates detection and exploitation of SQL injection flaws across major database engines.	38.9k	n/a	n/a	1w ago	84
8	ffuf Fast web fuzzer for discovering hidden content, parameters and virtual hosts.	17k	n/a	n/a	1mo ago	77
9	WiresharkPopular The standard network protocol analyzer for capturing and inspecting packets.	10.1k	n/a	n/a	6d ago	73
10	Kali LinuxPopular Debian-based penetration testing distribution bundling hundreds of security tools.	No public repository or package of its own to measure
11	BloodHound Maps Active Directory and Entra ID attack paths as a graph; used by both red and blue teams.	3.5k	n/a	n/a	2w ago	65
12	StrixNew Open-source autonomous AI agents that find and validate vulnerabilities by running real attacks against apps.	74.6k	n/a	n/a	2d ago	89
13	RustScan Very fast port scanner that finds open ports in seconds, then hands them to Nmap for service detection.	20.7k	1.2k	-19%	1w ago	56
14	MobSF Automated security testing for Android, iOS and Windows apps: static and dynamic analysis plus malware checks.	22.2k	n/a	n/a	1d ago	79
15	bbot The recursive internet scanner for hackers.	11.1k	10.2k	-3%	1d ago	60
16	ShannonNew (detected automatically) Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real…	51.2k	3.7k	+176%	1w ago	63


1	Burp SuitePopular PortSwigger's intercepting proxy and scanner; the standard toolkit for web application pentesting.	No public repository or package of its own to measure
2	ZAPPopular Free open-source web app scanner and intercepting proxy (formerly OWASP ZAP), now backed by Checkmarx.	16.1k	n/a	n/a	1w ago	77
3	NucleiPopular Fast template-based vulnerability scanner with thousands of community YAML templates for CVEs and misconfigs.	32.5k	n/a	n/a	1w ago	82
4	NmapPopular Classic network discovery and port scanner with a scripting engine for service and vulnerability detection.	13.9k	n/a	n/a	1w ago	76
5	MetasploitPopular Rapid7's exploitation framework with thousands of modules for exploits, payloads and post-exploitation.	39.3k	n/a	n/a	5d ago	84
6	CaidoRising Modern, lightweight Rust-based web security auditing toolkit; a rising Burp Suite alternative.	No public repository or package of its own to measure
7	sqlmap Automates detection and exploitation of SQL injection flaws across major database engines.	38.9k	n/a	n/a	1w ago	84
8	ffuf Fast web fuzzer for discovering hidden content, parameters and virtual hosts.	17k	n/a	n/a	1mo ago	77
9	WiresharkPopular The standard network protocol analyzer for capturing and inspecting packets.	10.1k	n/a	n/a	6d ago	73
10	Kali LinuxPopular Debian-based penetration testing distribution bundling hundreds of security tools.	No public repository or package of its own to measure
11	BloodHound Maps Active Directory and Entra ID attack paths as a graph; used by both red and blue teams.	3.5k	n/a	n/a	2w ago	65
12	StrixNew Open-source autonomous AI agents that find and validate vulnerabilities by running real attacks against apps.	74.6k	n/a	n/a	2d ago	89
13	RustScan Very fast port scanner that finds open ports in seconds, then hands them to Nmap for service detection.	20.7k	1.2k	-19%	1w ago	56
14	MobSF Automated security testing for Android, iOS and Windows apps: static and dynamic analysis plus malware checks.	22.2k	n/a	n/a	1d ago	79
15	bbot The recursive internet scanner for hackers.	11.1k	10.2k	-3%	1d ago	60
16	ShannonNew (detected automatically) Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real…	51.2k	3.7k	+176%	1w ago	63

Pentesting & DAST

Burp Suite

ZAP

Nuclei

Nmap

Metasploit

Caido

sqlmap

ffuf

Wireshark

Kali Linux

BloodHound

Strix

RustScan

MobSF

bbot

Shannon

Comparison

Pentesting & DAST

Burp Suite

ZAP

Nuclei

Nmap

Metasploit

Caido

sqlmap

ffuf

Wireshark

Kali Linux

BloodHound

Strix

RustScan

MobSF

bbot

Shannon

Comparison

Search TechInTrends

Pentesting & DAST

Burp Suite

ZAP

Nuclei

Nmap

Metasploit

Caido

sqlmap

ffuf

Wireshark

Kali Linux

BloodHound

Strix

RustScan

MobSF

bbot

Shannon

Comparison

Pentesting & DAST

Burp Suite

ZAP

Nuclei

Nmap

Metasploit

Caido

sqlmap

ffuf

Wireshark

Kali Linux

BloodHound

Strix

RustScan

MobSF

bbot

Shannon

Comparison