ffuf alternatives: 8 open-source security testing tools
Metrics as of , from the GitHub or GitLab API of each repository. Refreshed monthly.
About ffuf
ffuf is a listed security testing tool: Go command-line web fuzzer for content, virtual host and parameter discovery using wordlists.
Order: Listed tools in the same category, with tools in the same primary language (GitHub API) first, then by GitHub stars. Each line gives one fact from the tool's own documentation where it differs from what ffuf's documentation states, with its source.
8 alternatives to ffuf
Trivy: Scan targets: Container images, filesystems, remote Git repositories, virtual machine images, Kubernetes. source: README
Nuclei: Scan targets: Target URLs and hosts, from a single target or a list file. source: README
Gitleaks: Scan targets: Secrets such as passwords, API keys and tokens in git repositories, files and stdin. source: README
OSV-Scanner: Scan targets: Project dependencies, checked against the OSV database. source: README
sqlmap: Scan targets: Web application parameters: GET, POST, cookie, User-Agent and Referer values. source: Docs: Features
Promptfoo: Scan targets: LLM apps, through red teaming and vulnerability scanning. source: README
ZAP: Scan targets: Web applications. source: README
Nikto: Scan targets: Web servers: potentially dangerous files or programs, outdated server components. source: Docs: Overview & Description
Repository metrics
| sqlmap | 38,4921 | 2026-01-0111.10 | 2026-09-201 | GPL-2.0-or-later | Python | active |
|---|---|---|---|---|---|---|
| Trivy | 38,0091 | 2026-08-141v0.74.0 | 2026-09-221 | Apache-2.0 | Go | active |
| Nuclei | 31,4311 | 2026-08-081v3.11.1 | 2026-09-221 | MIT | Go | active |
| Gitleaks | 29,4281 | 2026-03-211v8.30.1 | 2026-07-221 | MIT | Go | active |
| Promptfoo | 25,3711 | 2026-09-1810.123.1 | 2026-09-221 | MIT | TypeScript | active |
| ffuf | 16,7031 | 2026-09-091v2.3.0 | 2026-09-091 | MIT | Go | active |
| ZAP | 15,8041 | 2025-12-151v2.17.0 | 2026-09-171 | Apache-2.0 | Java | active |
| OSV-Scanner | 11,0731 | 2026-09-141v2.6.0 | 2026-09-221 | Apache-2.0 | Go | active |
| Nikto | 10,7361 | 2026-07-3112.6.1 | 2026-08-151 | GPL-3.0-only | Perl | active |
1 Fetched from the GitHub or GitLab API on . Hover a value for its own date.