OWTF alternatives

Looking for a better tool, or simply want to learn about alternatives? There is typically more than one option.

Alternatives (by tag)

100

Alternative: BetterCAP

BetterCAP is a complete, modular, portable and easily extensible MitM tool and framework. It is maintained well and appreciated by many.

Project details

BetterCAP is written in Ruby.

Strengths

  • + More than 25 contributors
  • + More than 2000 GitHub stars
  • + The source code of this software is available

Typical usage

  • bypassing security measures
  • penetration test
  • security assessment

BetterCAP project page

60

Alternative: Bowcaster

Project details

Bowcaster is written in Python.

Strengths

  • + The source code of this software is available

Weaknesses

  • - No updates for a while

Typical usage

  • exploit development
  • penetration test

Bowcaster project page

76

Alternative: Kitty

Kitty is a modular and extensible fuzzing framework written in Python. It is inspired by OpenRCE's Sulley and Michael Eddington's Peach Fuzzer tool.

Project details

Kitty is written in Python.

Strengths

  • + The source code of this software is available

Typical usage

  • application fuzzing

Kitty project page

78

Alternative: Metasploit Framework

Metasploit is a framework that consists of tools to perform security assignments. It focuses on the offensive side of security and leverages exploit modules.

Project details

Metasploit Framework is written in Ruby.

Strengths

  • + More than 400 contributors
  • + More than 9000 stars
  • + Many maintainers
  • + The source code of this software is available
  • + Supported by a large company
  • + Well-known tool

Typical usage

  • penetration test
  • security assessment
  • vulnerability scanning

Metasploit Framework project page

97

Alternative: Pocsuite

Pocsuite is a remote vulnerability testing and development framework. It can be used by penetration testers and vulnerability researchers.

Project details

Pocsuite is written in Python.

Strengths

  • + More than 10 contributors
  • + More than 500 GitHub stars
  • + The source code of this software is available

Typical usage

  • vulnerability testing

Pocsuite project page

70

Alternative: Viper

Viper is a binary analysis and management framework for security researchers. It provides a way to organization your collection of malware samples and exploits.

Viper organizes the malware samples and exploits you found over time. It calls itself "Metasploit for malware researchers". Viper has a terminal interface to store, search and analyze files. As it is a framework, is also allows you to create your plugins.

64

Alternative: Dockerscan

Dockerscan is a Docker toolkit for security analysis which includes attacking tools. It is more focused on side of the offensive than defensive.

Project details

Dockerscan is written in Python.

Strengths

  • + More than 500 GitHub stars
  • + The source code of this software is available

Typical usage

  • information gathering
  • security assessment
  • vulnerability scanning

Dockerscan project page

60

Alternative: evilredis

The evilredis tool is an offensive security program for pentesting Redis databases. It can scan the target and perform different actions on it.

Project details

evilredis is written in Node.js.

Strengths

  • + The source code of this software is available

Typical usage

  • security assessment
  • vulnerability scanning

evilredis project page

64

Alternative: Pyersinia

Pyersinia is a tool like Yersinia and can perform network attacks such as spoofing ARP, DHCP DoS , STP DoS, and more. It is written in Python and uses Scapy.

Project details

Pyersinia is written in Python.

Strengths

  • + The source code of this software is available

Typical usage

  • network analysis
  • penetration test
  • security assessment

Pyersinia project page

64

Alternative: RouterSploit

RouterSploit is a framework to test exploitation of embedded devices. It can be used as part of penetrating testing assignments or security assessments.

Project details

RouterSploit is written in Python.

Strengths

  • + More than 25 contributors
  • + More than 4000 GitHub stars
  • + The source code of this software is available

Typical usage

  • penetration test
  • self-assessment
  • software testing
  • vulnerability scanning

RouterSploit project page

76

Alternative: APT2 (apt2)

APT2 is a tool written by Adam Compton and Austin Lane to help pentesters automate mundane scanning tasks. It leverages scan results from Nexpose, Nessus, or Nm

APT2 stands for Automated Penetration Testing Toolkit.

APT2 performs a scan with Nmap or can import the results of a scan from Nexpose or Nessus. The processed results will be used in the second phase. This phase launches exploit and enumeration modules. It helps pentesters to automate assessments and tasks.

Suggested components to have installed: convert, dirb, hydra, java, john, ldapsearch, msfconsole, nmap, nmblookup, phantomjs, responder, rpcclient, secretsdump.py, smbclient, snmpwalk, sslscan, xwd

Project details

APT2 is written in Python.

Strengths

  • + The source code of this software is available

Typical usage

  • penetration test
  • security assessment

APT2 project page

70

Alternative: BeEF

The Browser Exploitation Framework (or BeEF) is a penetration testing tool that focuses on the web browser.

BeEF is used by penetration testers to assess the security of a system by leveraging the web browser. This makes the tool different to many other tools, as it ignores the security on network or system level. It uses command modules from within the web browser to perform requested attacks against the system.

100

Alternative: Faraday

Faraday is collaboration tool for pentest assignments and vulnerability management. It allows integration with a number of other security tools.

Project details

Faraday is written in Python.

Strengths

  • + Commercial support available
  • + More than 1000 GitHub stars
  • + The source code of this software is available

Typical usage

  • collaboration
  • penetration test
  • security assessment
  • vulnerability scanning

Faraday project page

60

Alternative: InstaRecon

InstaRecon is a security tool that can help with the reconnaissance phase of a penetration test. It can collect a number of data points with limited input.

Project details

InstaRecon is written in Python.

Strengths

  • + The source code of this software is available

Typical usage

  • penetration test
  • reconnaissance

InstaRecon project page

56

Alternative: p0f

P0f is a security tool that utilizes passive traffic fingerprinting mechanisms to identify the systems behind any incidental TCP/IP communications.

This tool is a great addition to nmap, especially if that reveals not reliable data or none at all. Due to the passive way of working, it won't be detected nor influences any connection.

- Version 3 of p0f is a full rewrite
- The idea for p0f dates back to June 10, 2000
- Tool can run in foreground or as a daemon process

Common uses for p0f include reconnaissance during penetration tests; routine network monitoring; detection of unauthorized network interconnects in corporate environments; providing signals for abuse-prevention tools; and miscellaneous forensics.

Project details

Strengths

  • + Project is mature (10+ years)
  • + The source code of this software is available
  • + Well-known tool

p0f project page

89

Alternative: SearchSploit

Exploit-DB's CLI search tool to find any exploits from the database. The tool is written in shell script and maintained by Offensive Security.

Project details

SearchSploit is written in shell script.

Strengths

  • + Used language is shell script

Weaknesses

  • - Full name of author is unknown

Typical usage

  • information gathering
  • penetration test

SearchSploit project page

78

Alternative: Sn1per

Sn1per is security scanner that can be used during a penetration test to enumerate and scan for vulnerabilities.

Project details

Sn1per is written in Python, shell script.

Strengths

  • + More than 10 contributors
  • + More than 1000 GitHub stars
  • + The source code of this software is available

Weaknesses

  • - Unknown project license

Typical usage

  • penetration test
  • reconnaissance

Sn1per project page