Library

Library index

Hosted MCP: grok mcp add --transport http vulns-co https://vulns.co/mcp, codex mcp add vulns-co --url https://vulns.co/mcp, or claude mcp add --transport http vulns-co https://vulns.co/mcp. Install notes.

• subfinder - Fast passive subdomain enumeration that aggregates 30+ public sources. The default first step of almost every recon workflow.
• amass - In-depth attack-surface mapping and asset discovery. Slower and heavier than subfinder but finds more via active enumeration and its graph DB.
• assetfinder - Tiny, fast passive subdomain finder. Great as an extra source to pipe into anew alongside subfinder.
• dnsx - Fast, multi-purpose DNS toolkit: resolve, probe records, and filter live hosts from a subdomain list.
• puredns - Fast DNS resolver and subdomain bruteforcer built on massdns, with wildcard filtering that keeps results clean.
• shuffledns - massdns wrapper for active bruteforce and resolution with wildcard handling. Alternative to puredns.
• httpx - Fast, multi-purpose HTTP toolkit. Probes for live hosts and pulls status, title, tech, CDN, and more. The bridge between recon and scanning.
• naabu - Fast SYN/CONNECT port scanner focused on reliability. Feeds open ports into httpx/nuclei.
• nmap - The classic network scanner. Service/version detection, NSE scripts, and OS fingerprinting. Slow but authoritative.
• rustscan - Ultra-fast port scanner that pipes open ports straight into nmap for follow-up enumeration.
• ffuf - Fast web fuzzer for directories, files, vhosts, and parameters. The de-facto content discovery tool.
• feroxbuster - Recursive content discovery in Rust. Auto-recurses into found directories and is fast out of the box.
• gobuster - Directory/file, DNS, and vhost bruteforcer. Simple and reliable.
• katana - Next-gen crawler with headless mode and JS parsing. Extracts URLs and endpoints for further testing.
• gau - getallurls - pulls known URLs from the Wayback Machine, Common Crawl, OTX, and URLScan. Instant historical URL corpus.
• waybackurls - Fetches URLs a domain has served, from the Wayback Machine. Classic passive URL source.
• hakrawler - Fast, simple web crawler for gathering URLs and JS endpoints. Pipe-friendly.
• nuclei - Template-based vulnerability scanner with thousands of community templates for CVEs, misconfigs, exposures, and takeovers. The workhorse of modern bug bounty.
• jaeles - Signature-based web application scanner. Powerful custom signature format for targeted checks.
• arjun - HTTP parameter discovery suite. Finds hidden query/body parameters by inference - great before hunting injection.
• paramspider - Mines parameters from the Wayback Machine to build a list of testable URLs with query strings.
• dalfox - Fast, powerful XSS scanner and parameter analyzer. Verifies reflections and builds working payloads.
• sqlmap - The definitive automatic SQL injection and database takeover tool. Deep detection and exploitation across many DBMSes.
• gf - A wrapper around grep with reusable pattern packs (xss, sqli, ssrf, lfi, redirect). Instantly slices URL lists into likely-vulnerable candidates.
• qsreplace - Replaces query-string values in a list of URLs with a supplied value. Essential glue for building fuzz targets.
• anew - Appends only new, unique lines to a file (and prints them). The one-line dedup that makes pipelines idempotent.
• unfurl - Pulls out and formats parts of URLs (domains, paths, params, keys). Handy for building custom wordlists from URL corpora.
• gowitness - Screenshots web pages using headless Chrome and stores results in a searchable report. Fast way to triage large host lists.
• getJS - Extracts JavaScript file URLs from a set of pages - the first step of JS recon for secrets and hidden endpoints.
• LinkFinder - Parses JavaScript files with regex to discover endpoints and paths. Reveals API routes hidden in bundles.
• wpscan - WordPress security scanner - enumerates plugins, themes, users, and known vulnerabilities. Needs an API token for vuln data.
• s3scanner - Scans for open S3 buckets (and other cloud storage) and dumps their permissions. Fast cloud misconfig discovery.
• interactsh - Out-of-band interaction gathering (OOB/OAST). Catches blind SSRF, RCE, and XXE via DNS/HTTP callbacks. Self-hostable.
• notify - Streams tool output to Slack/Discord/Telegram. Wire it into pipelines to get pinged on new findings.
• Burp Suite - The industry-standard intercepting proxy for manual web testing. Community edition is free; Pro adds the active scanner and automation.
• Caido - A modern, lightweight web proxy and pentest toolkit - a fast alternative to Burp with a clean workflow and scriptable automation.
• trufflehog - Scans git history, filesystems, and URLs for leaked credentials - and actually verifies them live against 800+ APIs, so you get confirmed secrets, not regex noise.
• gitleaks - Fast secret detection across git history and files with a strong default ruleset. Ideal for scanning cloned target repos and exposed .git folders.
• jsluice - Extracts URLs, paths, and secrets from JavaScript by parsing the AST (not regex) - far more accurate than LinkFinder for modern bundles.
• kiterunner - Context-aware content discovery built for APIs. Uses real request templates (from 67k+ Swagger specs) instead of dumb path lists, catching routes that need specific methods/headers.
• x8 - High-signal hidden parameter discovery in Rust. Detects reflected, stored, and behavior-changing params with fewer false positives than brute forcers.
• smuggler - Detects HTTP request smuggling (CL.TE / TE.CL desync) against a target with minimal, safe probes. First stop before manual desync exploitation.
• h2csmuggler - Tests for HTTP/2 cleartext (h2c) smuggling to bypass reverse-proxy access controls and reach restricted internal endpoints.
• graphql-cop - Fast security auditor for GraphQL: checks introspection, batching, field suggestions, CSRF, and DoS-prone features in one pass.
• clairvoyance - Recovers a GraphQL schema even when introspection is disabled, by abusing field-suggestion error messages. Rebuilds the attack surface others can't see.
• jwt_tool - Swiss-army knife for JWTs: decode, tamper claims, and test the classic attacks - alg:none, key confusion (RS→HS), weak-secret cracking, and kid injection.
• ysoserial - Generates Java deserialization payloads from known gadget chains (CommonsCollections, etc.). The reference tool once you spot a Java object sink.
• uncover - Queries Shodan, Censys, FOFA, Quake, and more from one CLI to surface a target's internet-exposed hosts without scanning them yourself.
• asnmap - Maps an organization (or ASN/IP) to its owned CIDR ranges - the fastest way to expand scope from a company name to owned IP space.
• mapcidr - Expands, aggregates, and slices CIDR ranges into IP lists for scanning. Pairs with asnmap to turn owned ranges into scannable hosts.
• tlsx - Fast TLS grabber that pulls SANs, issuers, and cert metadata - a rich, often-overlooked source of new subdomains and internal hostnames.
• cero - Scrapes domain names straight out of TLS certificates across IP ranges/ports - great for finding hosts that never appear in passive sources.
• alterx - Generates smart subdomain permutations from patterns, so a resolver can find dev1/staging-api/etc. that pure bruteforce misses.
• subzy - Purpose-built subdomain takeover checker with an up-to-date fingerprint set and low false positives. Complements nuclei's takeover templates.
• wafw00f - Fingerprints which WAF/CDN sits in front of a target so you know what filtering you're up against before you start fuzzing.
• chisel - Fast TCP/UDP tunnel over HTTP, secured by SSH. The standard way to pivot through a foothold and reach internal services during authorized testing.
• ligolo-ng - Modern pivoting via a userland TUN interface - no SOCKS proxychains gymnastics. Cleaner and faster than legacy tunneling for reaching internal subnets.
• linPEAS - Exhaustive Linux privilege-escalation enumeration - surfaces misconfigs, creds, SUID, and kernel exploits, color-coded by likelihood. The go-to after a foothold.
• pspy - Watches processes, cron jobs, and file events in real time without root - perfect for catching privileged scripts and cron-triggered commands to hijack.
• waymore - Best-in-class historical URL collector. Pulls from Wayback, Common Crawl, AlienVault OTX, URLScan and VirusTotal, with response-body download if you want JS from the past.
• urlfinder - ProjectDiscovery's passive URL finder. Fast complement to gau/waymore when you already live in the PD suite.
• gospider - Fast Go crawler that also extracts JS, forms, robots, sitemaps and subdomains. Good when katana is too quiet or you want form fields.
• chaos - Client for ProjectDiscovery Chaos datasets. Instant subdomain lists for public programs already in the dataset; still verify they are in your scope.
• pdtm - ProjectDiscovery tool manager. Installs and updates the whole PD suite with one binary. Start here on a new box.
• masscan - Internet-scale port scanner. Use on your own ranges or in-scope clouds with a sane rate. Follow with nmap -sV on the hits.
• dirsearch - Mature content-discovery scanner with recursion, extensions, and built-in wordlists. Still a solid fallback next to ffuf.
• kxss - Finds query parameters that reflect in the response. Pipe gau/waymore into it, then hand the hits to dalfox or a manual DOM check.
• uro - URL deduplicator that collapses the same endpoint with different values. Shrinks gau/waymore output before gf/ffuf so you do not scan the same path 8k times.
• hakrevdns - Bulk reverse DNS. Feed it IP ranges from asnmap/mapcidr and catch hostnames that subdomain enum missed.
• git-dumper - Dumps an exposed .git directory from a web root and reconstructs the repo. Pair with trufflehog on the result.
• noseyparker - High-signal secret scanner with a datastore. Excellent on dumped .git, org mirrors, and huge JS folders where trufflehog is noisy.
• cloud_enum - Multi-cloud OSINT: public buckets, blobs, and apps named after the target. Confirm ownership before you report.
• testssl.sh - Plain-shell TLS tester: protocols, ciphers, Heartbleed-class checks, cert chain. Use when you need a readable TLS report, not a port scan.
• jq - JSON processor. Every API hunt ends in jq. Filter httpx/nuclei JSONL, reshape GraphQL, extract token fields.
• HTTPie - Human HTTP client. Faster than curl for JSON APIs you are iterating on by hand. Not a fuzzer.
• mitmproxy - Interactive intercepting proxy with a Python addon API. Use when you want scripted mutation that Burp's UI is slow at, or HTTP/2 debugging.
• hashcat - GPU hash cracker. JWT HS256, NTLM, phpass, and the rest. Identify the mode first (the hash-id util on this site helps), then crack offline hashes you are authorized to recover.
• commix - Automated command-injection tester. Use after you have a reflected parameter that smells like a shell concat, not as a first spray.
• tplmap - Server-side template injection scanner and exploiter. Confirms the engine (Jinja, Twig, Freemarker, ...) then tries a sandbox escape. Manual confirmation still required.
• SecretFinder - Greps JS for API keys and endpoints. Noisy, but a fine first pass before jsluice on a big corpus.
• subjs - Fetches JavaScript file URLs from a list of hosts (HTML script tags). Pipe httpx live hosts into it, then jsluice.
• sourcemapper - Downloads and reconstructs original source from a .js.map. Turns a minified bundle into a readable tree for sink hunting.
• semgrep - Local SAST. Point it at reconstructed source maps or a dumped .git and hunt sinks (innerHTML, exec, pickle, yaml.load) with public rulesets.
• trivy - Scanner for container images, filesystems, IaC and secrets. Useful when the program includes Docker Hub images, GitHub repos, or Terraform.
• kube-hunter - Active Kubernetes attacker-view scanner. Only against clusters in scope. Looks for open APIs, kubelets, and dashboards.
• cloudflared - Cloudflare tunnel client. Handy as a stable ingress for OAST callbacks, local listeners, and sharing a Burp collaborator alternative you control.
• socat - Swiss-army TCP/UNIX relay. Port forwards, TLS wrappers, and 'I need this socket over there' jobs that ncat is awkward at.
• shodan - Official Shodan CLI. Search banners, SSL SANs, and org-owned IPs. Requires an API key. Stay inside program scope.
• github-subdomains - Enumerates subdomains mentioned in GitHub code search. Needs a GitHub token. Catches hostnames that never hit Certificate Transparency.
• dnsgen - Generates subdomain permutations from an existing list (dev, staging, -backup, region codes). Pipe into puredns, do not resolve blindly.
• whatweb - Web tech fingerprinting. Complements httpx -tech-detect when you want plugin-level CMS/platform IDs.
• interactsh-client - CLI client for interactsh. Generates unique callbacks and tails hits. Use instead of embedding a single collaborator host in every payload.
• ghauri - SQL injection detection and exploitation tool with a lighter footprint than sqlmap. Still a lab/owned-row tool on bounty programs: tight -p, no --batch spray.
• crlfuzz - Scans URLs for CRLF injection with encoded variants. Use on a focused URL list, not the whole program.
• ppmap - Prototype pollution scanner for URL gadgets. Pollution without a sink is weak; pair with the JS review playbook.
• Corsy - CORS misconfig scanner (reflection, null origin, substring). Confirm ACAC plus a cookie-auth API before you call it ATO.
• findomain - Fast passive subdomain finder (CT, APIs, cross-spot). Extra source to pipe into dnsx/httpx alongside subfinder.
• cdncheck - Identifies whether a hostname or IP is on a known CDN, cloud provider, or WAF. Use it after DNS and HTTP probing to separate third-party edges from hosts you might test.
• proxify - Runs a local HTTP and SOCKS proxy and can write the traffic you send through it to a log file. Use it to capture your own browsing or a proxy chain next to Burp or Caido, without a match-and-replace rule.
• vulnx - Searches public vulnerability records from the command line. The project was formerly named cvemap, and hunters use a vendor or product keyword while reading scope rather than sending traffic to a target.
• osv-scanner - Matches dependencies in a local source tree or lockfile against the OSV vulnerability database. Run it on a checkout you already have before you spend time on libraries that are already patched.
• grype - Matches a local SBOM, directory, or image against known vulnerabilities. Point it at an SBOM you generated yourself rather than using it as a live test against a program.
• syft - Builds a software bill of materials from a local directory, archive, or container image. Hunters use that SBOM to see which packages an artifact ships and to feed a local vulnerability matcher.
• zizmor - Statically audits GitHub Actions workflows, composite actions, Dependabot config, and pre-commit files. Run it offline on a workflow file you already have when CI permissions are in scope.
• retire.js - Scans a local tree for JavaScript and Node library versions with known vulnerabilities. Use it on files you already saved, such as a bundle pulled from the target, not as a remote test.
• graphw00f - Detects whether a URL is serving GraphQL and fingerprints the engine. Run it from a local clone, in detect and fingerprint mode only, and only on an in-scope host.
• xnLinkFinder - Pulls links and possible parameter names out of a local file, a saved response, or a URL list. Point it at JavaScript or a HAR you already collected instead of crawling a live host.
• ZAP - Desktop intercepting proxy and web application testing tool from the ZAP project. Launch the GUI for manual testing, and do not start an automated baseline or full scan from this entry.