Tools & libraries for security work
Open-source tools we actually run, grouped by the job they do.
What is in here
Free, open-source security tooling: XSS and injection scanners, OSINT and reconnaissance utilities, exploitation frameworks, and infrastructure-security tooling. Every entry links straight to its original source repository so you can read the code before you run it.
How to choose one
Start from the job, not the tool. For finding reflected and stored XSS, a fuzzer and a crawler answer different questions. For reconnaissance, passive collection and active probing carry very different risk to the target. The category on each card tells you which job it belongs to.
Before you run anything
These are real offensive tools. Run them only against systems you own or have written permission to test. Unauthorised scanning is illegal in most jurisdictions, and noisy tools will get your address blocked long before they get you results. Test in a lab first.
We link to each project's own repository and credit its authors. We do not host or repackage anyone else's code, and nothing here is affiliated with or endorsed by the tool authors unless stated.
Related: Security articles · CVE tracker · Video walkthroughs