Open-source alternatives to Testssl.sh

reconftw is an attack surface management framework and reconnaissance workflow orchestrator designed to automate the discovery, mapping, and monitoring of external digital assets. It operates as a modular tool-chain pipeline that coordinates a sequence of security tools to perform intelligence gathering and vulnerability scanning. The project distinguishes itself through a cloud-native deployment model that parallelizes scanning workloads across a fleet of remote VPS instances to bypass local resource constraints. It utilizes container-based environment isolation to ensure consistent executio

Nettacker is an automated penetration testing framework designed to orchestrate reconnaissance, port scanning, and vulnerability detection. It functions as a network reconnaissance tool and vulnerability scanner that identifies open ports, fingerprints services, and checks systems against databases of known security flaws. The framework distinguishes itself by combining a web application crawler for discovering hidden paths via fuzzing with a vulnerability management system that persists scan results in a database to track historical assessments. It also includes specialized capabilities for

Subfinder is a security reconnaissance framework designed for subdomain enumeration and attack surface management. It functions as a discovery engine that identifies and maps internet-exposed infrastructure, cloud-hosted assets, and network ranges to maintain a comprehensive inventory of an organization's digital footprint. The project distinguishes itself through a modular, template-driven scanning engine that executes security checks against discovered assets. It leverages cloud-native asset discovery to query provider APIs and infrastructure metadata, while supporting distributed agent orc

RealiTLScanner is a TLS configuration scanner and network security auditor designed to identify security settings across IP addresses and domains. It functions as a target discovery tool that analyzes TLS configurations to find compatible endpoints and evaluate server security postures. The project distinguishes itself as a geolocation-enhanced network scanner, appending geographic location data and country codes to discovered security configurations using a local location database. This allows for the geographic mapping of servers by combining TLS scan results with GeoIP data. The tool supp

This project is a mobile network security auditor and IMSI catcher detector designed to identify fake base stations and surveillance hardware attempting to intercept mobile traffic. It functions as a radio interface analyzer and cellular tower mapping tool, monitoring connections to detect unauthorized network infrastructure. The system distinguishes itself by combining real-time threat level monitoring with the ability to identify silent SMS and stealth communications used for device tracking. It analyzes ciphering status to detect forced network downgrades to weaker encryption standards and

htrace.sh is a command-line diagnostic suite designed for profiling web traffic, auditing security configurations, and analyzing network connectivity for remote endpoints. It functions as a shell-based orchestration tool that wraps standard system utilities to perform modular diagnostic tasks and infrastructure analysis. The tool distinguishes itself by providing a unified interface for both HTTP request debugging and automated security scanning. Users can customize request parameters, including headers, methods, and proxy settings, to simulate specific client behaviors. It further automates

RustScan is a high-speed TCP network scanner written in Rust, designed for security reconnaissance and network mapping. It functions as an automated port discovery engine that identifies open ports on remote hosts using IPv6 addresses, CIDR ranges, or bulk input files. The tool is built for rapid surface area discovery, utilizing parallel port processing and OS-aware performance optimizations to identify active services. It allows for scan precision tuning through adjustable connection timeout thresholds and concurrent request controls to balance speed and accuracy. The system integrates wit

This project is a collection of bash automation scripts and command-line utilities designed to automate common tasks and retrieve information from web APIs. It serves as a toolkit for developer references, network diagnostics, and media access directly from the terminal. A central component of the suite is a GitHub Gist manager that handles the full lifecycle of code snippets. This includes cloning and syncing Gists into local directories for offline access, organizing content through hashtags, and searching through snippet descriptions and file contents using regular expressions. The toolki

Flan is a containerized network vulnerability scanner and security auditor. It identifies open ports and service versions across a network to detect known security weaknesses and misconfigurations. The system is designed to run within isolated container environments, utilizing configuration maps to manage target lists and secrets. It includes a dedicated mechanism for archiving scan output files and security analysis data to remote S3 buckets for long-term storage. The tool generates formatted vulnerability summaries and security reports in multiple document formats for technical analysis. I

Sn1per is a vulnerability management platform and penetration testing orchestrator designed to automate reconnaissance, vulnerability scanning, and exploit verification. It functions as a dockerized security toolkit that coordinates multiple tools into a unified automated pipeline to identify security flaws across network and web assets. The platform features an attack surface manager for discovering internet-facing assets through OSINT, DNS enumeration, and certificate transparency. It distinguishes itself with an AI-powered security analyzer that uses large language models to summarize scan

ZMap is a fast single packet network scanner designed for Internet-wide network surveys.

This project is an open-source intelligence reconnaissance framework and recursive attack surface mapper. It functions as a containerized security scanner designed to map public-facing infrastructure, perform subdomain enumeration, and automate the gathering of open-source intelligence. The system employs a recursive discovery engine to iteratively explore target infrastructure, utilizing a plugin-based module architecture to extend scanning capabilities. It integrates third-party APIs for data enrichment and applies YARA rules across discovered assets to identify specific vulnerability patte

This project is a curated knowledge base and technical reference for shell scripting, focused on performing common system tasks using only built-in shell features. It serves as a guide for implementing logic and automation without relying on external binaries or dependencies, ensuring scripts remain portable across standard Unix-like environments. The repository distinguishes itself by emphasizing native shell functions and syntax to minimize process forking and improve execution performance. It provides idiomatic patterns for complex string transformations, pattern matching, and data flow ma

LinEnum is a suite of security utilities for auditing Linux systems, scanning for privilege escalation paths, and enumerating local vulnerabilities. It functions as a system security audit tool, a local enumeration utility, and a scanner for identifying misconfigurations that could allow a user to gain root access. The project includes specialized auditing for containerized environments, specifically detecting Docker and LXC signatures to identify potential escape vectors to the host system. Its broader capabilities cover the analysis of kernel versions, the identification of SUID binaries a

This project is a community-driven directory that serves as a comprehensive index of command-line tools, frameworks, and resources. It functions as a curated knowledge base designed to help users discover software for enhancing terminal environments and streamlining daily development tasks. The collection is maintained through an open-source contribution model, where community members manually verify and organize resources into structured categories. This collaborative approach ensures the directory remains a reliable reference for finding specialized utilities, alternative shell implementati

This project is a static analysis tool and linter designed to improve the quality, reliability, and portability of shell scripts. By performing deep structural analysis, it identifies common programming pitfalls, syntax errors, and security vulnerabilities before scripts are executed. It functions as an automated code reviewer that enforces best practices and helps developers maintain consistent, robust code across different operating environments. The tool distinguishes itself through its dialect-aware grammar resolution, which adapts its parsing logic based on the specific shell interpreter

Dalfox is an automated web application security tool specifically designed for discovering and verifying cross-site scripting vulnerabilities. It functions as an XSS vulnerability scanner that analyzes HTTP parameters and DOM structures to identify reflected, stored, and blind injection points. The project distinguishes itself by providing a Model Context Protocol server and a REST API, allowing artificial intelligence agents and remote interfaces to trigger and manage security scans programmatically. It utilizes a payload mutation engine and fingerprinting strategies to execute WAF evasion t

Mac-CLI is a collection of terminal commands and utilities designed for automating system management, hardware monitoring, and software configuration on macOS. It serves as a developer utility and automation tool for manipulating files, managing version control, and auditing installed packages from the command line. The project provides hardware monitoring capabilities to track real-time battery health, CPU temperature, and fan speeds. It also includes system automation tools for managing power states, disk usage, and network settings through a unified interface. The utility covers several f

This project is a shell plugin that provides real-time command suggestions to accelerate terminal input. By hooking into the command line editor and utilizing a strategy-based prediction engine, it generates completions derived from command history, shell completion data, or custom user-defined sources. The tool distinguishes itself by rendering suggestions as a visual ghost layer directly within the terminal buffer using ANSI-styled overlays. To maintain a responsive command-line environment, it performs all prediction calculations in the background, ensuring that heavy computation does not

Tsunami Security Scanner is a network vulnerability scanner and security auditor designed to identify high-severity flaws across network assets. It functions as an asynchronous security probe engine that utilizes automated probes and specialized detection logic to find critical weaknesses and prioritize remediation efforts. The project is distinguished by a plugin-based scanning engine, which uses a modular architecture of interchangeable detection plugins to identify vulnerabilities. This extensibility allows for the development and integration of custom security plugins to expand the variet

Micro8 is a security auditing knowledge base and penetration testing resource library. It serves as a curated collection of guides and documentation focused on vulnerability assessment. The project provides educational content and study guides for manual source code review, domain escalation, and internal network auditing. It includes a toolkit of reference materials for analyzing network traffic logs and identifying brute-force patterns. The library covers technical domains including web penetration testing and privilege escalation. It organizes these materials through PDF-based knowledge r

Vuls is an agentless vulnerability scanner and CVE intelligence aggregator. It identifies security flaws in operating systems, containers, and network devices without requiring the installation of permanent software agents on target machines. The project distinguishes itself by cross-referencing software versions against multiple vulnerability databases, security advisories, and known exploit catalogs. It utilizes platform-based enumeration and lockfile analysis to detect vulnerabilities in network hardware, programming libraries, and website plugins. The tool covers a broad range of securit

Cameradar is a network scanning tool designed to discover publicly accessible IP cameras. It identifies active Real Time Streaming Protocol services by scanning IP ranges and using device fingerprints to determine specific hardware models. The tool performs security auditing through dictionary-based probing and brute force attacks to uncover valid streaming paths and authentication credentials. It validates discovered streams by verifying the receipt of real-time transport protocol data packets to eliminate false positives. The system supports a multi-stage discovery pipeline and can export

PRET is a network printer exploitation framework and security utility designed for discovering printing hardware and auditing firmware. It serves as a toolkit for penetrating printing infrastructure by manipulating printer-specific control languages and protocols. The project provides specialized capabilities for triggering remote code execution via buffer overflows and managing printer file systems using the Printer Job Language. It allows for the extraction of device metadata, such as firmware versions and memory resources, and the modification of hardware behaviors and system parameters.

kscan is a network security scanner and service fingerprinter used to discover active hosts and open ports. It functions as a network protocol analyzer and internal network mapper to identify reachable gateways and analyze the network surface area of target environments. The tool integrates external asset discovery by retrieving target hosts through external intelligence services and verifying their availability. It also operates as a credential brute force tool, testing authentication strength across multiple protocols using automated username and password dictionaries. The project covers n

PCredz is a network credential extraction tool and traffic analyzer designed to intercept passwords, hashes, and tokens from IPv4 and IPv6 traffic. It functions as both a real-time monitor for live network interfaces and a parser for saved packet capture files. The tool identifies sensitive information, including credit card numbers and authentication tokens, using protocol-aware parsing. It further acts as a password hash recovery utility by normalizing captured authentication hashes into specific syntaxes compatible with external recovery software. Capabilities include real-time traffic in

Hubble is an eBPF-based Kubernetes observability platform designed for network monitoring, security auditing, and flow inspection. It provides deep visibility into containerized traffic and cluster security by utilizing kernel-level hooks to collect network events. The system features a service map for visualizing communication patterns and dependencies between microservices and external endpoints. It incorporates identity-based flow labeling to track network traffic using Kubernetes labels rather than volatile IP addresses. The platform covers a broad range of monitoring capabilities, inclu