Member-only story
Here’s 24 web-application hacking tools:
Jan 3, 2025
- Burp Suite — Framework.
- 2. ZAP Proxy — Framework.
- 3. Dirsearch — HTTP bruteforcing.
- 4. Nmap — Port scanning.
- 5. Sublist3r — Subdomain discovery.
- 6. Amass — Subdomain discovery.
- 7. SQLmap — SQLi exploitation.
- 8. Metasploit — Framework.
- 9. WPscan — WordPress exploitation.
- 10. Nikto — Webserver scanning.
- 11. HTTPX — HTTP probing.
- 12. Nuclei — YAML based template scanning.
- 13. FFUF — HTTP probing.
- 14. Subfinder — Subdomain discovery.
- 15. Masscan — Mass IP and port scanner.
- 16. Lazy Recon — Subdomain discovery.
- 17. XSS Hunter — Blind XSS discovery.
- 18. Aquatone — HTTP based recon.
- 19. LinkFinder — Endpoint discovery through JS files.
- 20. JS-Scan — Endpoint discovery through JS files.
- 21. GAU — Historical attack surface mapping.
- 22. Parameth — Bruteforce GET and POST parameters.
- 23. truffleHog — Find credentials in GitHub commits.
