Prowler (vuln) alternatives

Looking for an alternative tool to replace Prowler (vuln)? During the review of Prowler (vuln) we looked at other open source tools. Based on their category, tags, and text, these are the ones that have the best match.

Top 3

Archery (vulnerability assessment and management)
OpenVAS (vulnerability scanner)
Dagda (vulnerability scanner for Docker containers)

These tools are ranked as the best alternatives to Prowler (vuln).

Alternatives (by score)

100

Archery

Introduction

Archery is a tool that helps to collect data about vulnerabilities within an environment. Instead of focusing on the actual scanning, it allows managing findings in a web-based interface. This includes options like reporting, searching, and dashboards. It can interact with other tools, including the well-known vulnerability scanners.

Project details

Archery is written in Python.

Strengths and weaknesses

+ More than 500 GitHub stars
+ The source code of this software is available

Typical usage

Penetration testing
Vulnerability management
Vulnerability scanning
Vulnerability testing

Archery review

OpenVAS

Introduction

OpenVAS is an open source vulnerability scanner that emerged from when Nessus became closed source in October of 2005.

Project details

OpenVAS is written in C.

Strengths and weaknesses

+ The source code of this software is available
+ Well-known tool

Typical usage

Penetration testing
Security assessment
Vulnerability scanning

OpenVAS review

Dagda

Introduction

The main reasons to use Dagda is the detection of vulnerable or malicious components within your containerized environment.

Project details

Dagda is written in Python.

Strengths and weaknesses

+ The source code of this software is available

Typical usage

Malware detection
Malware scanning
Vulnerability management
Vulnerability scanning

Dagda review

Safety

Introduction

When having applications deployed in your environment, not all of those may be installed via a package manager. When your infrastructure grows, it becomes even harder to know which tools are properly patched and which ones are not. For Python applications, this is where Safety comes in that can help scan installed software components via pip. It will also look at any of the dependencies that are installed.

Project details

Safety is written in Python.

Strengths and weaknesses

+ More than 10 contributors
+ The source code of this software is available

Typical usage

Penetration testing
Security assessment
Security monitoring
Vulnerability scanning

Safety review

salt-scanner

Introduction

Salt-scanner is Linux vulnerability scanner based on Salt Open and Vulners audit API. It has Slack notifications and JIRA integration.

Project details

salt-scanner is written in Python.

Strengths and weaknesses

+ The source code of this software is available

- No releases on GitHub available

Typical usage

Penetration testing
Security assessment
Vulnerability scanning

salt-scanner review

VScan

Introduction

Vscan is a security tool to perform vulnerability scanning with Nmap. It leverages NSE scripts to provide some flexibility in terms of vulnerability detection and exploitation.

Project details

VScan is written in shell script.

Strengths and weaknesses

+ The source code of this software is available

Typical usage

Backdoor detection
Vulnerability scanning

VScan review

Vuls

Introduction

Vuls is a vulnerability scanner for Linux and FreeBSD. It is written in Go, agentless, and can use a remote login to find any software vulnerabilities. It has multiple levels of scanning, from a fast scan up to a deep scan with extensive analysis.

Project details

Vuls is written in Golang.

Strengths and weaknesses

+ More than 50 contributors
+ More than 5000 GitHub stars
+ The source code of this software is available

Typical usage

System hardening
Vulnerability scanning

Vuls review

Bash Scanner

Introduction

Bash Scanner is a security tool that does a quick scan to see if there are vulnerable packages. It uses an external service to validate.

Project details

Bash Scanner is written in shell script.

Strengths and weaknesses

+ Used language is shell script
+ The source code of this software is available

Typical usage

Security assessment
Security monitoring

Bash Scanner review

100

Intrigue Core

Introduction

Intrigue Core provides a framework to measure the attack surface of an environment. This includes discovering infrastructure and applications, performing security research, and doing vulnerability discovery.

Intrigue also allows enriching available data and perform OSINT research (open source intelligence). The related scans include DNS subdomain brute-forcing, email harvesting, IP geolocation, port scanning, and using public search engines like Censys, Shodan, and Bing.

Project details

Intrigue Core is written in Ruby.

Strengths and weaknesses

+ More than 500 GitHub stars
+ The source code of this software is available

Typical usage

Asset discovery
Attack surface measurement
Intelligence gathering
OSINT research
Penetration testing
Security assessment

Intrigue Core review

vulscan

Introduction

Vulscan is a vulnerability scanner which uses the well-known Nmap tool. By enhancing it with offline data from VulDB, it allows for detecting vulnerabilities. The database itself based on information from multiple sources.

Project details

vulscan is written in Lua.

Strengths and weaknesses

+ The source code of this software is available

- No releases on GitHub available

Typical usage

Penetration testing
Security assessment
Vulnerability scanning
Vulnerability testing

vulscan review

vulnix

Introduction

Tools like vulnix help with the detection of known weaknesses in packages by leveraging external resources. It can be used as an additional security layer on top of software patch management.

Project details

vulnix is written in Python.

Strengths and weaknesses

+ The source code of this software is available

Typical usage

Vulnerability scanning

vulnix review

CMSmap

Introduction

CMSmap helps saving time in the process of detecting what CMS is used for a given web application. It performs reconnaissance and can do additional vulnerability scanning.

Project details

CMSmap is written in Python.

Strengths and weaknesses

+ The source code of this software is available

Typical usage

Application testing
Information gathering
Vulnerability scanning
Web application analysis

CMSmap review

100

Lynis

Introduction

Lynis is an open source security auditing tool that is available since 2007 and created by Michael Boelen. Its primary goal is to evaluate the security defenses of systems running Linux or other flavors of Unix. It provides suggestions to install, configure, or correct any security measures.

Project details

Lynis is written in shell script.

Strengths and weaknesses

+ More than 50 contributors
+ Commercial support available
+ More than 4000 GitHub stars
+ Used language is shell script
+ Very low number of dependencies
+ Project is mature (10+ years)
+ The source code of this software is available

Typical usage

IT audit
Penetration testing
Security assessment
System hardening
Vulnerability scanning

Lynis review

100

Nmap

Introduction

Nmap is short for "Network Mapper". It is a free and open source utility for network discovery and security auditing. It was release in September of 1997 by Gordon Lyon, commonly known under his pseudonym "Fyodor".

Project details

Nmap is written in C, C++, Lua, Python.

Strengths and weaknesses

+ Project is mature (10+ years)
+ The source code of this software is available
+ Well-known author
+ Well-known tool

- Software usage is restricted (e.g. commercially)

Typical usage

Network scanning
Vulnerability scanning

Nmap review

Tulpar

Introduction

Tools like Tulpar can be useful to test new or existing web applications. In the former case, it could be helpful to test a new project before it is deployed into production. This could be done by the developer or a security professional. If some web application is already in production, then it might be a good tool to perform regular testing on known vulnerabilities. In this case, it is typically a pentester or security specialist that does the testing.

Project details

Strengths and weaknesses

+ The source code of this software is available

Typical usage

Application security
Application testing
Web application analysis

Tulpar review

Vane

Introduction

Vane is a forked project of the now non-free popular WordPress vulnerability scanner WPScan.

Project details

Vane is written in Ruby.

Strengths and weaknesses

+ More than 25 contributors
+ The source code of this software is available

Typical usage

Application security
Web application analysis

Vane review

Whitewidow

Introduction

Whitewidow is a security tool to perform automated SQL vulnerability scans. It can be used during penetration tests or for security assessments.

Project details

Whitewidow is written in Ruby.

Strengths and weaknesses

+ More than 500 GitHub stars
+ The source code of this software is available

Typical usage

Application security
Penetration testing
Vulnerability scanning

Whitewidow review

arch-audit

Introduction

Arch-audit is a small utility that scans the system for known vulnerabilities on Arch Linux. It can be used by users of the Linux distribution to know when to update and what packages have weaknesses. With Arch Linux being a rolling distribution, this may improve the interval or timing of software patching.

Project details

arch-audit is written in Rust.

Strengths and weaknesses

+ The source code of this software is available

Typical usage

Software management
Vulnerability scanning

arch-audit review

BDA (Big Data Audit)

Introduction

Hadoop and Spark are one of the few applications that encounter a lot of data. Securing data starts at securing these applications. BDA helps to perform a vulnerability scan on them and discover any configuration weaknesses.

Project details

BDA is written in Python.

Strengths and weaknesses

+ The source code of this software is available

Typical usage

Application testing
Vulnerability scanning
Vulnerability testing

BDA review

flunym0us

Introduction

Flunym0us is a security scanner for WordPress and Moodle installations. The tool tests the security of the installation by performing enumeration attempts.

Project details

flunym0us is written in Python.

Strengths and weaknesses

+ The source code of this software is available

Typical usage

Vulnerability scanning
Web application analysis

flunym0us review

JexBoss

Introduction

JexBoss is a security tool to verify and exploit vulnerabilities in JBoss applications. It can be used for security assignments and pentests.

Project details

JexBoss is written in Python.

Strengths and weaknesses

+ The source code of this software is available

- No releases on GitHub available

Typical usage

Application security
Application testing
Penetration testing
Vulnerability scanning

JexBoss review

Wapiti

Introduction

Wapiti is typically used to audit web applications.

Project details

Wapiti is written in Python.

Strengths and weaknesses

+ The source code of this software is available
+ Well-known tool

Typical usage

Application fuzzing
Vulnerability scanning
Web application analysis

Wapiti review

p0f

Introduction

This tool is a great addition to nmap, especially if that reveals not reliable data or none at all. Due to the passive way of working, it won't be detected nor influences any connection.

- Version 3 of p0f is a full rewrite
- The idea for p0f dates back to June 10, 2000
- Tool can run in foreground or as a daemon process

Common uses for p0f include reconnaissance during penetration tests; routine network monitoring; detection of unauthorized network interconnects in corporate environments; providing signals for abuse-prevention tools; and miscellaneous forensics.