README.md

open-source-web-scanners

A list of open source web security scanners on GitHub and GitLab (just added), ordered by Stars. It does not provide in-depth analysis - for more analysis or a wider range of tools, see the links below.

Note that some large projects have multiple repos - in which case the second most relevant repo is included immediately after.

General Purpose Web Scanners

Tools which can find a range of 'unknown' vulnerabilities on any websites.

Main Site	Last Commit	Committers	Stars
ZAP
- ZAP Extensions
Hetty
W3af
Arachni
Astra
Skipfish
Sitadel
Taipan
Wapiti
Vega
Tuplar
Ugly-duckling
Jawfish
Browserker

Infrastructure Web Scanners

Tools which can find a range of 'known' vulnerabilities on any websites.

Main Site	Last Commit	Committers	Stars
Nuclei
- Nuclei Templates
Tsunami
Nikto
Striker
Jaeles
- Jaeles-Signatures
Yasuo
Observatory
Spaghetti

Fuzzers / Brute Forcers

Tools which focus on throwing 'bad stuff' at things - the user typically has to work out if it sticks.

Main Site	Last Commit	Committers	Stars
dirsearch
Ffuf
gobuster
Wfuzz
feroxbuster
rustbusterv
vaf

CMS Web Scanners

Tools which can find a range of 'known' vulnerabilities on one or more CMS websites.

Main Site	Last Commit	Committers	Stars
WPscan
Volnx
Droopescan
CMSScan
JoomScan
Clusterd

API Web Scanners

Tools which focus on web APIs.

Main Site	Last Commit	Committers	Stars
Cherrybomb
Automatic API Attack Tool
Acto

Specialised Scanners

Tools which focus on specific types of vulnerabilities.

Main Site	Last Commit	Committers	Stars
Sqlmap
Commix
Xsscrapy
Domdig

Links

• Free for Open Source Application Security Tools - includes commercial tools as well
• Vulnerability Scanning Tools - covers more tools, includes commercial tools as well
• Linux Security Tools - covers more tools and evaluates more criteria
• Web Hackers Weapons - covers more tools
• Arsenal of cloud native security tools

Contribute

PR's welcomed.

Template line for GitHub projects (replace USER_REPO):

| []() | [![Last Commit](https://img.shields.io/github/last-commit/USER_REPO)](https://github.com/USER_REPO/commits) | [![Contributors](https://img.shields.io/github/contributors/USER_REPO)](https://github.com/USER_REPO/graphs/contributors) | [![Stars](https://img.shields.io/github/stars/USER_REPO)](https://github.com/USER_REPO/stargazers) |

Template line for GitLab projects (replace USER_REPO):

| []() | [![Last Commit](https://badgen.net/gitlab/last-commit/USER_REPO)](https://gitlab.com/USER_REPO/-/commits/master) | [![Contributors](https://badgen.net/gitlab/contributors/USER_REPO/)](https://gitlab.com/USER_REPO/-/graphs/master) | [![Stars](https://badgen.net/gitlab/stars/USER_REPO/)](https://gitlab.com/USER_REPO/-/starrers) |