Suggest a tool

Open-source security testing tools: 18 compared

Open-source scanners and fuzzers used in application security testing.

18 tools are listed here, 3 of them with this as a secondary category. Each one is open source under an OSI-approved license and meets the inclusion rules. The table is sorted by GitHub stars, descending, on the fetch date. Select a column heading to sort by another column.

Metrics as of , from the GitHub or GitLab API of each repository. Refreshed monthly.

Security testing tools. Sorted by GitHub stars, descending. Select a column heading to change the sort.
sqlmap38,49212026-01-0111.102026-09-201GPL-2.0-or-laterPythonactive
Trivy38,00912026-08-141v0.74.02026-09-221Apache-2.0Goactive
Nuclei31,43112026-08-081v3.11.12026-09-221MITGoactive
Gitleaks29,42812026-03-211v8.30.12026-07-221MITGoactive
Promptfoo25,37112026-09-1810.123.12026-09-221MITTypeScriptactive
ffuf16,70312026-09-091v2.3.02026-09-091MITGoactive
ZAP15,80412025-12-151v2.17.02026-09-171Apache-2.0Javaactive
OSV-Scanner11,07312026-09-141v2.6.02026-09-221Apache-2.0Goactive
Nikto10,73612026-07-3112.6.12026-08-151GPL-3.0-onlyPerlactive
garak9,33012026-09-091v0.17.02026-09-161Apache-2.0Pythonactive
Bandit8,27812026-02-2511.9.42026-09-211Apache-2.0Pythonactive
AFL++6,76512026-09-021v5.03c2026-09-021AGPL-3.0Cactive
OWASP Nettacker5,61212026-08-2410.4.12026-09-221Apache-2.0Pythonactive
Honggfuzz3,38312024-07-201oss-fuzz2026-06-191Apache-2.0Cslow
RESTler2,94612025-01-301v9.3.12026-02-131MITPythonslow
Atheris1,67812025-11-2513.0.02026-06-171Apache-2.0Pythonslow
EvoMaster78212026-09-151v6.2.02026-09-221LGPL-3.0Kotlinactive
OWASP dependency-check5412025-02-171v12.1.02025-02-171Apache-2.0Javaarchived

1 Fetched from the GitHub or GitLab API on . Hover a value for its own date.

Comparisons in this category

Guide

Open-source security testing tools: how the list is sorted and what each covers