Nuclei alternatives: 8 open-source security testing tools
Metrics as of , from the GitHub or GitLab API of each repository. Refreshed monthly.
About Nuclei
Nuclei is a listed security testing tool: Template-based vulnerability scanner that runs YAML templates over HTTP, DNS, TCP, SSL and other protocols from a CLI.
Order: Listed tools in the same category, with tools in the same primary language (GitHub API) first, then by GitHub stars. Each line gives one fact from the tool's own documentation where it differs from what Nuclei's documentation states, with its source.
8 alternatives to Nuclei
Trivy: Scan targets: Container images, filesystems, remote Git repositories, virtual machine images, Kubernetes. source: README
Gitleaks: Scan targets: Secrets such as passwords, API keys and tokens in git repositories, files and stdin. source: README
ffuf: Scan targets: Web servers: content paths, virtual hosts, GET parameters and POST data. source: README
OSV-Scanner: Scan targets: Project dependencies, checked against the OSV database. source: README
sqlmap: Scan targets: Web application parameters: GET, POST, cookie, User-Agent and Referer values. source: Docs: Features
Promptfoo: Scan targets: LLM apps, through red teaming and vulnerability scanning. source: README
ZAP: Scan targets: Web applications. source: README
Nikto: Scan targets: Web servers: potentially dangerous files or programs, outdated server components. source: Docs: Overview & Description
Repository metrics
| sqlmap | 38,4921 | 2026-01-0111.10 | 2026-09-201 | GPL-2.0-or-later | Python | active |
|---|---|---|---|---|---|---|
| Trivy | 38,0091 | 2026-08-141v0.74.0 | 2026-09-221 | Apache-2.0 | Go | active |
| Nuclei | 31,4311 | 2026-08-081v3.11.1 | 2026-09-221 | MIT | Go | active |
| Gitleaks | 29,4281 | 2026-03-211v8.30.1 | 2026-07-221 | MIT | Go | active |
| Promptfoo | 25,3711 | 2026-09-1810.123.1 | 2026-09-221 | MIT | TypeScript | active |
| ffuf | 16,7031 | 2026-09-091v2.3.0 | 2026-09-091 | MIT | Go | active |
| ZAP | 15,8041 | 2025-12-151v2.17.0 | 2026-09-171 | Apache-2.0 | Java | active |
| OSV-Scanner | 11,0731 | 2026-09-141v2.6.0 | 2026-09-221 | Apache-2.0 | Go | active |
| Nikto | 10,7361 | 2026-07-3112.6.1 | 2026-08-151 | GPL-3.0-only | Perl | active |
1 Fetched from the GitHub or GitLab API on . Hover a value for its own date.