we5ter/scanners-box

★ 8,891Audience · developerComplexity · 1/5LicenseSetup · easy

Mindmap

mindmap
  root((scanners-box))
    Tool Categories
      Subdomain discovery
      SQL injection
      XSS detection
      Malware analysis
    Modern Areas
      AI vulnerability scan
      Smart contract audit
      LLM app testing
    Tool Metadata
      GitHub links
      Star counts
      License badges
    Audience
      Security researchers
      Pen testers

mindmap root((scanners-box)) Tool Categories Subdomain discovery SQL injection XSS detection Malware analysis Modern Areas AI vulnerability scan Smart contract audit LLM app testing Tool Metadata GitHub links Star counts License badges Audience Security researchers Pen testers

Click or tap to explore — scroll the page freely

Things people build with this

USE CASE 1

Find a subdomain enumeration tool suited to an authorized penetration test of a web application.

USE CASE 2

Discover open-source SQL injection or XSS scanners to audit your own application for security weaknesses.

USE CASE 3

Browse AI-powered vulnerability scanners to evaluate automated security testing for your pipeline.

USE CASE 4

Find tools for auditing smart contract security before deploying a blockchain application.

Getting it running

Difficulty · easy Time to first run · 5min

Non-commercial use only, no derivatives allowed, Creative Commons Attribution-NonCommercial-NoDerivatives 4.0.

In plain English

Scanners Box, also called scanbox, is a curated collection of open-source security scanning tools gathered from GitHub. It does not contain any scanning software of its own. Instead it is a reference directory of over 300 tools, organized by category, that security professionals and researchers can browse to find tools suited to specific tasks. The collection is organized into more than 20 categories. These include tools for discovering subdomains of a target website, tools for detecting SQL injection vulnerabilities in databases, tools that check for weak or default passwords on web applications, and tools for finding cross-site scripting (XSS) flaws. There are also sections covering vulnerability scanners for common middleware and server software, tools for analyzing mobile app packages, tools for examining binary executable files, and tools for detecting malware. More recent additions reflect newer areas of security work. There are sections for scanners that use AI models to find vulnerabilities, tools for testing AI applications themselves (such as those checking for prompt injection or data leakage in large language models), tools for scanning smart contracts used in blockchain applications, and tools for red team vs. blue team exercises, which simulate attacker and defender roles. Each entry in the list links to the original GitHub repository for that tool and includes badges showing the main programming language, star count, last commit date, and license. The collection explicitly excludes well-known tools like nmap, Metasploit, and similar widely distributed frameworks, focusing instead on less visible specialized tools. The project is available in both English and Chinese and is licensed under Creative Commons Attribution-NonCommercial-NoDerivatives 4.0. The full README is longer than what was shown.

Copy-paste prompts

Prompt 1

I'm doing an authorized security assessment and need a subdomain scanner. Based on scanners-box, which tools should I evaluate, and what are the tradeoffs between them?

Prompt 2

Using tools from the scanners-box XSS section, how do I test my own web application for cross-site scripting vulnerabilities in a safe, controlled way?

Prompt 3

I need to audit an Android APK for security issues. Which tools from the scanners-box mobile app section cover binary analysis, and how do I run one?

Prompt 4

I want to add automated security scanning to my CI pipeline. Based on the scanners-box SQL injection and weak-password categories, which open-source tools integrate well with GitHub Actions?

Open on GitHub → Explain another repo

← we5ter on gitmyhub — every repo by this author, as a profile.

Verify against the repo before relying on details.