A list of open source web security scanners on GitHub and GitLab, ordered by Stars. It does not provide in-depth analysis - for more analysis or a wider range of tools, see the links below.
Note that some large projects have multiple repos - in which case the second most relevant repo is included immediately after and is indented.
Related: open-source-llm-scanners
Tools which can find a range of 'unknown' vulnerabilities on any websites.
| Main Site | Last Commit | Committers | Stars |
|---|---|---|---|
| ZAP |  |  |  |
| - ZAP Extensions |  |  |  |
| Hetty |  |  |  |
| W3af |  |  |  |
| Arachni |  |  |  |
| Astra |  |  |  |
| Wapiti |  |  |  |
| Skipfish |  |  |  |
| Sitadel |  |  |  |
| Taipan |  |  |  |
| Vega |  |  |  |
| Reaper |  |  |  |
| BrowserBruter |  |  |  |
| Tuplar |  |  |  |
| Ugly-duckling |  |  |  |
| Jawfish |  |  |  |
| Pākiki |  |  |  |
| ProKZee |  |  |  |
| Browserker |  |  |  |
Tools which can find a range of 'known' vulnerabilities on any websites.
| Main Site | Last Commit | Committers | Stars |
|---|---|---|---|
| Nuclei |  |  |  |
| - Nuclei Templates |  |  |  |
| Xray |  |  |  |
| Tsunami |  |  |  |
| Nikto |  |  |  |
| Striker |  |  |  |
| Jaeles |  |  |  |
| - Jaeles-Signatures |  |  |  |
| Yasuo |  |  |  |
| Observatory |  |  |  |
| Spaghetti |  |  |  |
Tools which focus on throwing 'bad stuff' at things - the user typically has to work out if it sticks.
| Main Site | Last Commit | Committers | Stars |
|---|---|---|---|
| dirsearch |  |  |  |
| Ffuf |  |  |  |
| gobuster |  |  |  |
| Wfuzz |  |  |  |
| feroxbuster |  |  |  |
| rustbusterv |  |  |  |
| vaf |  |  |  |
| radamsa |  |  |  |
| BrowserBruter | | | |
Tools which can find a range of 'known' vulnerabilities on one or more CMS websites.
Tools which focus on web APIs.
| Main Site | Last Commit | Committers | Stars |
|---|---|---|---|
| Cherrybomb |  |  |  |
| Akto |  |  |  |
| Automatic API Attack Tool |  |  |  |
| VulnAPI |  |  |  |
Tools which focus on specific types of vulnerabilities.
| Main Site | Last Commit | Committers | Stars |
|---|---|---|---|
| Sqlmap |  |  |  |
| XSStrike |  |  |  |
| Commix |  |  |  |
| Tplmap |  |  |  |
| Dalfox |  |  |  |
| Fuxploider |  |  |  |
| Ghauri |  |  |  |
| NoSQLMap |  |  |  |
| Xsscrapy |  |  |  |
| XSpear |  |  |  |
| Gxss |  |  |  |
| Domdig |  |  |  |
| O-Saft |  |  |  |
| CakeFuzzer |  |  |  |
| Takeover |  |  |  |
| LFIscanner |  |  |  |
| YA-LFI |  |  |  |
| YA-CORS |  |  |  |
PR's welcomed.
Template line for GitHub projects (replace USER_REPO):
| []() | [](https://github.com/USER_REPO/commits) | [](https://github.com/USER_REPO/graphs/contributors) | [](https://github.com/USER_REPO/stargazers) |
Template line for GitLab projects (replace USER_REPO):
| []() | [](https://gitlab.com/USER_REPO/-/commits/master) | [](https://gitlab.com/USER_REPO/-/graphs/master) | [](https://gitlab.com/USER_REPO/-/starrers) |
1,936 followers · starred Jan 2022
187 followers · starred Feb 2022
70 followers · starred Apr 2022
319 followers · starred Sep 2026
A list of open source web security scanners on GitHub and GitLab, ordered by Stars. It does not provide in-depth analysis - for more analysis or a wider range of tools, see the links below.
Note that some large projects have multiple repos - in which case the second most relevant repo is included immediately after and is indented.
Related: open-source-llm-scanners
Tools which can find a range of 'unknown' vulnerabilities on any websites.
| Main Site | Last Commit | Committers | Stars |
|---|---|---|---|
| ZAP | | | |
| - ZAP Extensions | | | |
| Hetty | | | |
| W3af | | | |
| Arachni | | | |
| Astra | | | |
| Wapiti | | | |
| Skipfish | | | |
| Sitadel | | | |
| Taipan | | | |
| Vega | | | |
| Reaper | | | |
| BrowserBruter | | | |
| Tuplar | | | |
| Ugly-duckling | | | |
| Jawfish | | | |
| Pākiki | | | |
| ProKZee | | | |
| Browserker | | | |
Tools which can find a range of 'known' vulnerabilities on any websites.
| Main Site | Last Commit | Committers | Stars |
|---|---|---|---|
| Nuclei | | | |
| - Nuclei Templates | | | |
| Xray | | | |
| Tsunami | | | |
| Nikto | | | |
| Striker | | | |
| Jaeles | | | |
| - Jaeles-Signatures | | | |
| Yasuo | | | |
| Observatory | | | |
| Spaghetti | | | |
Tools which focus on throwing 'bad stuff' at things - the user typically has to work out if it sticks.
| Main Site | Last Commit | Committers | Stars |
|---|---|---|---|
| dirsearch | | | |
| Ffuf | | | |
| gobuster | | | |
| Wfuzz | | | |
| feroxbuster | | | |
| rustbusterv | | | |
| vaf | | | |
| radamsa | | | |
| BrowserBruter | | | |
Tools which can find a range of 'known' vulnerabilities on one or more CMS websites.
Tools which focus on web APIs.
| Main Site | Last Commit | Committers | Stars |
|---|---|---|---|
| Cherrybomb | | | |
| Akto | | | |
| Automatic API Attack Tool | | | |
| VulnAPI | | | |
Tools which focus on specific types of vulnerabilities.
| Main Site | Last Commit | Committers | Stars |
|---|---|---|---|
| Sqlmap | | | |
| XSStrike | | | |
| Commix | | | |
| Tplmap | | | |
| Dalfox | | | |
| Fuxploider | | | |
| Ghauri | | | |
| NoSQLMap | | | |
| Xsscrapy | | | |
| XSpear | | | |
| Gxss | | | |
| Domdig | | | |
| O-Saft | | | |
| CakeFuzzer | | | |
| Takeover | | | |
| LFIscanner | | | |
| YA-LFI | | | |
| YA-CORS | | | |
PR's welcomed.
Template line for GitHub projects (replace USER_REPO):
| []() | [](https://github.com/USER_REPO/commits) | [](https://github.com/USER_REPO/graphs/contributors) | [](https://github.com/USER_REPO/stargazers) |
Template line for GitLab projects (replace USER_REPO):
| []() | [](https://gitlab.com/USER_REPO/-/commits/master) | [](https://gitlab.com/USER_REPO/-/graphs/master) | [](https://gitlab.com/USER_REPO/-/starrers) |
1,936 followers · starred Jan 2022
187 followers · starred Feb 2022
70 followers · starred Apr 2022
319 followers · starred Sep 2026