RED TEAM
Burp Suite Professional / Community Edition
Commercial and community web application testing workbench.
Proprietary PortSwigger terms; Community Edition has separate terms.
Reviewed Oct 12, 2026
Ω / LINKS / METADATA ONLY
Application security.
Reviewed project metadata and official links for red, blue, purple, and cross-team security work.
This is a dated, editorially reviewed seed. Links go to upstream projects or vendors. A listing is not authorization, safety certification, legal advice, or a recommendation to deploy a tool. Confirm scope, licensing, current maintenance, and your organization's rules before use.
BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM
DefectDojo Community Edition
Application-security finding management, deduplication, and remediation workflow.
BSD-3-Clause for the open-source Community repository; commercial editions differ.
Reviewed Oct 12, 2026
RED TEAM
feroxbuster
Recursive web content discovery for defined targets.
MIT
Reviewed Oct 12, 2026
RED TEAM
ffuf
Web content and input-surface discovery for defined targets.
MIT
Reviewed Oct 12, 2026
BLUE TEAM · RED TEAM
Nikto
Web-server exposure and configuration assessment tooling.
GPL-3.0-only code; databases and LibWhisker have separate terms.
Reviewed Oct 12, 2026
PURPLE TEAM · RED TEAM
Nuclei
Template-based exposure validation after explicit scope and authorization.
MIT
Reviewed Oct 12, 2026
RED TEAM
sqlmap
Specialist SQL injection validation and database assessment tooling.
GPL v2 or later with project clarifications and exceptions.
Reviewed Oct 12, 2026
CROSS-TEAM · RED TEAM
Wapiti
Black-box web and API application security scanner.
GPL-2.0
Reviewed Oct 12, 2026
BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM
ZAP by Checkmarx
Intercepting proxy and web application security testing platform.
Apache-2.0
Reviewed Oct 12, 2026