{
 "schemaVersion": 1,
 "generated": "2026-10-30",
 "dataLicense": "CC BY-SA 4.0",
 "license": "CC BY-SA 4.0",
 "notice": "Data from Open Source Everything (https://opensourceeverything.org), licensed CC BY-SA 4.0: use it freely, credit the site, link to the page, and share changes under the same license. Listings were drafted with AI assistance and are managed by the r/TrueOpenSource moderators; check a project's own page before relying on a fact.",
 "id": "security-testing",
 "name": "Security testing and password recovery",
 "page": "https://opensourceeverything.org/g/security-testing/",
 "category": "selfhost",
 "categoryName": "Home servers & security",
 "job": "Testing your own systems the way an attacker would",
 "closedApps": [
  "Burp Suite Pro",
  "Metasploit Pro",
  "Passware"
 ],
 "coverage": "partial",
 "alternatives": [
  {
   "id": "metasploit-framework",
   "name": "Metasploit Framework",
   "page": "https://opensourceeverything.org/p/metasploit-framework/",
   "summary": "Metasploit is a toolkit that lets security professionals test computers and networks by simulating how an attacker would break in. It is aimed at security testers and IT staff who check their own systems for weaknesses.",
   "kind": "developer_tool",
   "setup": "advanced",
   "setupWhy": "Made for developers: you use it from code or the command line.",
   "platforms": [
    "mac",
    "linux"
   ],
   "license": "BSD-3-Clause",
   "licenseClass": "open",
   "licenseNeedsCheck": true,
   "stars": 39248,
   "forks": null,
   "status": "active",
   "verified": false,
   "latestRelease": null,
   "code": "https://github.com/rapid7/metasploit-framework",
   "website": "https://www.metasploit.com",
   "download": null,
   "release": null,
   "family": null,
   "familyChildren": [],
   "howToHelp": null,
   "project": "metasploit-framework",
   "rank": 1,
   "fit": "partial",
   "note": "Covers attacker-style testing, but not password recovery or Burp/Passware-style web or password tools.",
   "why": "Does part of the job · Advanced setup",
   "score": 39.8
  },
  {
   "id": "zap",
   "name": "ZAP",
   "page": "https://opensourceeverything.org/p/zap/",
   "summary": "ZAP is a free tool that searches websites and web apps for security weaknesses, so developers and testers can find problems before attackers do. It is aimed at programmers, testers and security professionals.",
   "kind": "developer_tool",
   "setup": "advanced",
   "setupWhy": "Made for developers: you use it from code or the command line.",
   "platforms": [],
   "license": "Apache-2.0",
   "licenseClass": "open",
   "licenseNeedsCheck": false,
   "stars": 16047,
   "forks": null,
   "status": "active",
   "verified": false,
   "latestRelease": null,
   "code": "https://github.com/zaproxy/zaproxy",
   "website": "https://www.zaproxy.org",
   "download": null,
   "release": null,
   "family": null,
   "familyChildren": [],
   "howToHelp": null,
   "project": "zap",
   "rank": 2,
   "fit": "partial",
   "note": "Covers web app testing only; no password recovery features mentioned.",
   "why": "Does part of the job · Advanced setup",
   "score": 37.1
  },
  {
   "id": "hashcat",
   "name": "hashcat",
   "page": "https://opensourceeverything.org/p/hashcat/",
   "summary": "hashcat is a free program that tests how strong a password is by trying huge numbers of guesses quickly, and it can recover lost passwords from their stored scrambled forms. It is for security testers, IT staff, and people recovering their own passwords.",
   "kind": "developer_tool",
   "setup": "advanced",
   "setupWhy": "Made for developers: you use it from code or the command line.",
   "platforms": [
    "windows",
    "mac",
    "linux",
    "android"
   ],
   "license": "MIT",
   "licenseClass": "open",
   "licenseNeedsCheck": true,
   "stars": 27158,
   "forks": null,
   "status": "active",
   "verified": false,
   "latestRelease": null,
   "code": "https://github.com/hashcat/hashcat",
   "website": "https://hashcat.net",
   "download": null,
   "release": null,
   "family": null,
   "familyChildren": [],
   "howToHelp": null,
   "project": "hashcat",
   "rank": 3,
   "fit": "partial",
   "note": "Covers password testing only; no web or network attack tools like Burp or Metasploit.",
   "why": "Does part of the job · Advanced setup",
   "score": 36.3
  },
  {
   "id": "nuclei",
   "name": "Nuclei",
   "page": "https://opensourceeverything.org/p/nuclei/",
   "summary": "Nuclei is a free command-line tool that checks websites, servers and networks for known security weaknesses. It is aimed at security professionals and IT teams, who write or reuse simple text-based templates to define each check.",
   "kind": "developer_tool",
   "setup": "advanced",
   "setupWhy": "Made for developers: you use it from code or the command line.",
   "platforms": [
    "windows",
    "mac",
    "linux"
   ],
   "license": "MIT",
   "licenseClass": "open",
   "licenseNeedsCheck": false,
   "stars": 32313,
   "forks": 3947,
   "status": "active",
   "verified": false,
   "latestRelease": {
    "name": "v3.11.1",
    "date": "2026-08-08T12:21:32Z"
   },
   "code": "https://github.com/projectdiscovery/nuclei",
   "website": "https://docs.projectdiscovery.io/tools/nuclei",
   "download": null,
   "release": "https://github.com/projectdiscovery/nuclei/releases/tag/v3.11.1",
   "family": null,
   "familyChildren": [],
   "howToHelp": {
    "contributingGuide": "https://github.com/projectdiscovery/nuclei/blob/HEAD/CONTRIBUTING.md",
    "goodFirstIssues": null,
    "helpWanted": null,
    "plugins": null
   },
   "project": "nuclei",
   "rank": 4,
   "fit": "partial",
   "note": "Scans for known weaknesses; no password recovery or proxy tools.",
   "why": "Does part of the job · Advanced setup",
   "score": 35
  },
  {
   "id": "mitmproxy",
   "name": "mitmproxy",
   "page": "https://opensourceeverything.org/p/mitmproxy/",
   "summary": "mitmproxy is a tool that sits between your computer and the internet so you can see the web traffic your apps send and receive. It is aimed mainly at programmers and security testers who want to inspect or test their own software.",
   "kind": "developer_tool",
   "setup": "advanced",
   "setupWhy": "Made for developers: you use it from code or the command line.",
   "platforms": [
    "windows",
    "mac",
    "linux"
   ],
   "license": "MIT",
   "licenseClass": "open",
   "licenseNeedsCheck": false,
   "stars": 46427,
   "forks": null,
   "status": "active",
   "verified": false,
   "latestRelease": null,
   "code": "https://github.com/mitmproxy/mitmproxy",
   "website": "https://mitmproxy.org",
   "download": null,
   "release": null,
   "family": null,
   "familyChildren": [],
   "howToHelp": null,
   "project": "mitmproxy",
   "rank": 5,
   "fit": "partial",
   "note": "Covers intercepting web traffic; no password recovery or attack suite.",
   "why": "Does part of the job · Advanced setup",
   "score": 34
  }
 ],
 "source": "https://opensourceeverything.org/g/security-testing/",
 "group": "Security testing and password recovery",
 "replaces": [
  "Burp Suite Pro",
  "Metasploit Pro",
  "Passware"
 ]
}