Security Tools

Free, open-source tooling built out of real engagement needs - used by our consultants and shared with the community.

JoshRecon

Python · builtwith

A lightweight Python-based reconnaissance tool that fingerprints a website technology stack using the builtwith library. Point it at any URL and get a clean, colour-coded readout of what is running under the hood — PHP, WordPress, jQuery and more.

Detects CMS, frameworks & libraries in seconds

Simple one-line usage: python joshrecon.py <url>

Colourful, readable terminal output

GitHub Tutorial

JoshXSS

Python

JoshXSS automates the process of finding reflected Cross-Site Scripting vulnerabilities in URLs and parameters, using smart payload injection and response analysis to cut through the noise.

Scans URLs with GET parameters for reflected XSS

Injects payloads into each parameter automatically

Detects reflection & basic context (HTML, JS, etc.)

Smart reflection matching with optional keyword triggers

+2 more features

GitHub Tutorial

Josh API Analyzer

Python · SQLite

An API-focused security testing platform that helps penetration testers, security researchers and VAPT teams assess APIs faster. Capture traffic, analyze vulnerabilities, manually test requests, fuzz endpoints, manage authentication tokens and generate professional reports — all from one tool.

API-first VAPT with 25 selectable vulnerability detectors (OWASP API Top 10 2023 + extended)

Capture traffic from browser, Python apps or HAR files

Automated detection: BOLA/IDOR, broken auth, BFLA, SQLi, XSS, SSRF, JWT, business logic, race conditions

Repeater for manual verification

+8 more features

GitHub

Need a custom security tool?

We build purpose-driven security tools for specific engagement needs.

Request a VAPT Talk to a Security Expert