12,233 tools · Updated daily · Most free, no account
Free Security Tools
Latest added scans
SeverityScan nameAdded
CriticalGeneric Command Injection Vulnerability ScannerA command injection vulnerability occurs when an attacker is able to pass malicious input to a program and have that input executed as an OS command. This can allow attackers to run operation system-level command execution. Command injection is often possible due to insecure coding practices that do not properly validate or sanitize user input.
1 day agoInfoPHP End-of-Life Detection ScannerThis scanner detects the use of PHP versions in digital assets. It identifies instances where PHP versions have surpassed their End-of-Life (EOL) and no longer receive security updates.
4 days agoCriticalCVE-2026-109618 PHP2Shell ScannerCVE-2026-109618 PHP2Shell Scanner - Remote Code Execution (RCE) vulnerability in PHP
5 days agoCriticalCVE-2026-111497 Node2Shell ScannerDetects CVE-2026-111497 (Node2Shell), a Brotli decompression buffer overflow affecting Node.js applications that may lead to memory corruption, denial of service, or remote code execution.
6 days agoCriticalCVE-2026-88771 Scanner (Version Based)CVE-2026-88771 Scanner - Remote Code Execution (RCE) vulnerability in Citrix NetScaler ADC and Gateway
9 days agoNeed to run all checks at once?
Start Full Scan →- Free URL Fuzzer Online Discovers hidden endpoints, files, and directories via automated path fuzzing.
- SQL Injection Vulnerability Scanner Detects SQL injection flaws across inputs, parameters, and API endpoints.
- XSS Scanner Identifies reflected, stored, and DOM-based cross-site scripting vulnerabilities.
- Subdomain Finder Online Discovers the subdomains of a target domain and maps its attack surface.
- SSRF Vulnerability Scanner Detects server-side request forgery vulnerabilities.
- LFI / RFI Vulnerability Scanner Finds local and remote file inclusion flaws.
- Command Injection Scanner Finds OS command execution vulnerabilities.
- SSL/TLS Supported Cipher Checker Analyzes supported ciphers and flags weak encryption protocols.
- WAF Detection Scanner Identifies which web application firewall protects a target.
- Technology Detection Scanner Maps the full tech stack CMS, frameworks, server software.
- PCI-DSS 6.4.3 Compliance Checker Validates payment page script integrity under PCI-DSS v4.0.