Tools

A curated set of tools referenced throughout our lessons — all free or free-tier, and all industry-standard for the job they do.

Interception Proxies

The standard proxy for intercepting, inspecting, and replaying HTTP requests — used throughout the testing sections in our lessons.

A free, open-source alternative to Burp with a built-in automated scanner and a gentler learning curve.

Automates detecting and exploiting SQL injection — useful for confirming a finding quickly once you understand the manual technique.

A fast web fuzzer for discovering hidden endpoints, parameters, and files via brute-force wordlists.

Template-based vulnerability scanning across a huge, community-maintained set of known issue patterns.

A straightforward web server scanner that flags outdated software, dangerous files, and common misconfigurations.

The standard tool for network discovery and port scanning — foundational for mapping what a target actually exposes.

A packet analyzer for inspecting raw network traffic — useful for understanding protocols at a level HTTP tools don't show you.

A browser-based "Swiss Army knife" for encoding, decoding, and transforming data — extremely handy for quick payload crafting.

Decode and inspect JSON Web Tokens directly in your browser — pairs well with our JWT Vulnerabilities lesson.

A fast password recovery tool used to demonstrate why weak hashing algorithms and weak passwords are dangerous together.

A GUI client for crafting and replaying API requests — useful for the API-focused testing methodology across our lessons.

Check whether an email address has appeared in a known data breach — a good practical demonstration of credential exposure.