A Java 8+ Jar & Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger & More)

The ZAP core project

A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.

An Open Source Java Decompiler Gui for Procyon

Java bytecode engineering toolkit

BinNavi is a binary analysis IDE that allows to inspect, navigate, edit and annotate control flow graphs and call graphs of disassembled code.

Database Subsetting and Relational Data Browsing Tool.

The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)

TCP/UDP Non-HTTP Proxy Extension (NoPE) for Burp Suite.

jSQL Injection is a Java application for automatic SQL database injection.

Web and mobile application security training platform

Automated HTTP Request Repeating With Burp Suite

All-in-one plugin for Burp Suite for the detection and the exploitation of Java deserialization vulnerabilities

A Burp Suite extension to help pentesters to bypass WAFs or test their effectiveness using a number of techniques

J2EEScan is a plugin for Burp Suite Proxy. The goal of this plugin is to improve the test coverage during web application penetration tests on J2EE applications.

Personal expense manager

Finds unknown classes of injection vulnerabilities

A robust parser for C/C++ storing abstract syntax trees, control flow graphs and program dependence graphs in a neo4j graph database.

Java Message Exploitation Tool

Gerrit Code Review Tool Integration for the IntelliJ Platform

SHELLING - a comprehensive OS command injection payload generator

First IDE for Nmap Script (NSE) Development.

Add headers to all Burp requests to bypass some WAF products

A proof-of-concept Android application to detect and defeat some of the Cellebrite UFED forensic toolkit extraction techniques.

ZAP/Burp plugin that generate script to reproduce a specific HTTP request (Intended for fuzzing or scripted attacks)

psychoPATH - an advanced path traversal tool. Features: evasive techniques, dynamic web root list generation, output encoding, site map-searching payload generator, LFI mode, nix & windows support,…

The TLS-Scanner Module from TLS-Attacker