dast

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

The ZAP by Checkmarx Core project

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision

⚙️ A curated list of dynamic analysis tools and linters for all programming languages, binaries, and more.

ZAP Add-ons

A collection of ZAP scripts and tips provided by the community - pull requests very welcome!

The AI Agent for Cyber Security.

A free, open-source alternative to Burp Suite: an intercepting proxy and web app security testing suite with Repeater, Intruder, Collaborator and a built-in OWASP ZAP scanner. Linux, AGPL-3.0.

xAST评价体系，让安全工具不再“黑盒”. The xAST evaluation benchmark makes security tools no longer a "black box".

A GitHub Action for running the ZAP Full scan

A GitHub Action for running the ZAP Baseline scan

SecHub provides a central API to test software with different security tools.

Runs a scan using Dastardly by Burp Suite against a target site and creates a JUnit XML report for the scan on completion.

API Security Vulnerability Scanner designed to help you secure your APIs.

A unified DevSecOps Framework that allows you to go from iterative, collaborative Threat Modeling to Application Security Test Orchestration

OWASP PTK - application security browser extension.

Security operations toolkit for AI coding agents. Give Claude Code 25+ skills to catch vulnerabilities, scan containers, detect secrets, and enforce policies automatically.

Sasori is a dynamic web crawler powered by Puppeteer, designed for lightning-fast endpoint discovery.

Self-hosted bug-bounty platform — verification-first recon & DAST, continuous monitoring. Your data stays on your machine.

Moxy is an open-source DAST tool designed for modern web application security testing. It provides an easy-to-use interface with agentic capabilities to assist and automate pentesting workflows.