security testing Archives

8 Useful Free and Open Source Security Testing Software

Here’s some useful software for performing security testing. Only free and open source software is eligible for inclusion here.

jwt_tool audits JSON Web Tokens, tests signature weaknesses, fuzzes token claims and checks authentication flaws in web applications.

Zarn is a lightweight Perl static security analysis tool using AST inspection and taint tracking to identify possible vulnerabilities.

Commix investigates OS command injection flaws in web applications, using several detection techniques and configurable HTTP test requests.

Dalfox tests web applications for cross-site scripting, with parameter discovery, XSS verification, WAF detection and scan reports.

Wfuzz tests web applications by injecting payloads into requests, combining wordlists and filtering responses during security assessments.

ZAP tests web application security with an intercepting proxy, automated scanning, authentication testing and extensible add-on ecosystem.

mitmproxy captures, inspects, modifies and replays web traffic, with terminal and browser interfaces, TLS interception and Python scripting.

ffuf fuzzes HTTP requests to discover hidden content, test web parameters and investigate responses with flexible wordlists and filters.

sqlmap automates SQL injection testing, with database fingerprinting, multiple detection techniques and security assessment options.

This post explores how static application security testing can have an essential role in protecting against malware attacks.