Offensive Security Tools
Powerful free online offensive security tools for ethical hacking and penetration testing. SQL injection scanners, XSS payload generators, subdomain finders, port scanners, WAF detectors, CMS detectors, JWT attack toolkits, SSRF generators, and more offensive hacking tools.
- 98Total Tools
- 46Offensive Security
- 52Defensive Security
- 21Workflows
Offensive SecurityIntermediateSubdomain FinderDiscover subdomains of a target domain using various sources and enumeration techniques.subdomain-finderAPIOffensive SecurityAdvancedWeb Shell FinderDetect web shell uploads on target systems.webshell-finderAPIOffensive SecurityAdvancedSQLi Payload GeneratorGenerate SQL Injection payloads for various DBMS with tamper scripts.sqli-scannerAPIOffensive SecurityAdvancedXSS Payload GeneratorGenerate context-aware XSS payloads with WAF bypass.xss-scannerAPIOffensive SecurityBasicPort ScannerScan open ports on a target host via Shodan InternetDB.port-scannerAPIOffensive SecurityIntermediateDirectory BruteforcerDiscover hidden directories and files on web servers.directory-bruteforcerAPIOffensive SecurityBasicDNS LookupQuery complete DNS records (A, AAAA, MX, NS, TXT, CNAME, SOA, CAA).dns-lookupAPIOffensive SecurityBasicWHOIS LookupQuery domain registration info via RDAP/WHOIS.whois-lookupAPIOffensive SecurityIntermediateWAF DetectorDetect Web Application Firewall on target systems.waf-detectorAPIOffensive SecurityBasicCMS DetectorIdentify the Content Management System used by the target.cms-detectorAPIOffensive SecurityIntermediateTech Stack AnalyzerIdentify technologies used by target websites.tech-stack-analyzerAPIOffensive SecurityBasicHeader AnalyzerAnalyze HTTP security headers from the target.header-analyzerAPIOffensive SecurityIntermediateGoogle Dork GeneratorGenerate Google dork queries to find sensitive information.google-dork-generatorAPIOffensive SecurityIntermediateShodan Dork GeneratorGenerate Shodan search queries for target reconnaissance.shodan-dork-generatorAPIOffensive SecurityAdvancedSSRF Map GeneratorGenerate SSRF payloads (IPv4, IPv6, hex, octal, DNS rebinding).ssrf-map-generatorAPIOffensive SecurityBasicReverse IP LookupFind other domains hosted on the same IP address.reverse-ipAPIOffensive SecurityAdvancedLFI / RFI Payload GeneratorGenerate Local File Inclusion (LFI), Remote File Inclusion (RFI), and Path Traversal payloads.lfi-payload-generatorAPIOffensive SecurityAdvancedCmd Injection GeneratorGenerate Command Injection payloads (basic, reverse shell, data exfiltration).cmd-injection-generatorAPIOffensive SecurityAdvancedSSTI Payload GeneratorGenerate Server-Side Template Injection payloads for Jinja2, Twig, Freemarker, and more.ssti-payload-generatorAPIOffensive SecurityAdvancedXXE Payload GeneratorGenerate XML External Entity (XXE) payloads for file read, SSRF, OOB, and RCE.xxe-payload-generatorAPIOffensive SecurityIntermediateOpen Redirect GeneratorGenerate Open Redirect payloads for various bypass techniques.open-redirect-generatorAPIOffensive SecurityAdvancedNoSQLi Payload GeneratorGenerate NoSQL Injection payloads for MongoDB, CouchDB, and REST APIs.nosqli-payload-generatorAPIOffensive SecurityAdvancedLDAPi Payload GeneratorGenerate LDAP Injection payloads for authentication bypass and blind extraction.ldapi-payload-generatorAPIOffensive SecurityAdvancedXPathi Payload GeneratorGenerate XPath Injection payloads for XML query manipulation.xpathi-payload-generatorAPI
Showing 46 of 46 tools