ffuf

automated web assets enumeration & scanning [DEPRECATED]

Burp Extension that copies a request and builds a FFUF skeleton

Simple enumeration script which utilises different Kali tools

Kharon is an automated web-server ctf scanner which perform basic tasks of webserver pentesting. Written in Python.

[WIP] Extensible LLM-powered wordlist generator for penetration testing. Creates intelligent, context-aware wordlists using AI to understand seed word relationships. Highly configurable with support for multiple wordlist types and LLM providers.

Interactive Python menu for ffuf directory, file, vhost, and GET parameter enumeration

High-speed asynchronous web endpoint and directory discovery tool built with Python.

WebRekon — A CTF reconnaissance and web analysis tool that automates enumeration, organizes findings, and guides players through their next investigation steps.

LLM-driven automated penetration testing pipeline — subdomain → probing → endpoints → fuzz → JS audit → auth analysis → API scoring → unauth API verification. Evidence-backed, multi-format reports, Tool Cards, Planner/Verifier/Reporter contracts.

Automate Initial CTF Scanning

A comprehensive, Docker-based security scanning toolkit for web applications. Run multiple industry-standard security tools with a single command.

Intelligent fuzzing tool integrating LLM-driven wordlist selection, automated FUZZ mode detection, GPT-generated payloads, multi-threaded scanning, and advanced response filters modeled after ffuf.

GUNGNIR by Syed Zada Abrar (Andrax Pentester) — A parallel intelligence-driven bug bounty platform. 8 native modules, 26 attack chain patterns, custom pipelines, finding lifecycle, web UI with auth. Never misses its target.

collection of Python scripts for automating tasks in CTFs

🛰️ Async FastAPI orchestration engine unifying Nmap, FFUF, Subfinder & httpx behind one REST API for automated reconnaissance pipelines.

AI-powered FFUF wrapper using free Hugging Face Qwen/Qwen2.5-1.5B-Instruct local Ai model — no paid API key required.

DirX is a high-performance directory brute-force tool designed for fast and precise web reconnaissance. Powered by async scanning, it offers status filters, response exclusion, proxy support, and real-time progress with ETA, helping pentesters and bug bounty hunters discover hidden endpoints efficiently.

A Python script for web fuzzing in penetration testing. Replace 'FUZZ' in the target URL with payloads from a wordlist, customize headers, and filter responses by status codes, length, and size. Inspired by FFUF, this tool aids security assessments with a user-friendly command-line interface. Developed by Wiktor Nowakowski.

lets you lanch common pentesting tools with presets all in one place