Best ParamSpider Alternatives & Competitors in 2026

Tolmo

Autonomous AI agent platform for pentesting, discovery, and remediation.

StealthNet AI

AI agent fleet for autonomous pentesting across external, API, web & vishing surfaces.

NetSPI Platform

PTaaS platform combining human pentesters with AI for continuous security testing.

Alt Security Autonomous Pentesting Platform

AI-autonomous pentesting platform for continuous web, API & AI app testing.

hakrawler

A fast web crawler for discovering endpoints and assets within web applications during security reconnaissance.

Google Search Operators: The Complete List (44 Advanced Operators)

A reference guide listing 44 advanced Google search operators for enhanced search filtering and precision in information gathering activities.

Buster

Advanced email reconnaissance tool leveraging public data.

Git Scanner Framework

A bash-based framework for discovering and extracting exposed .git repositories from web servers during penetration testing and bug bounty activities.

GoLinkFinder

A fast and minimal JS endpoint extractor

s3reverse

A format conversion tool for S3 buckets designed to assist bug bounty hunters and security testers in standardizing bucket data during reconnaissance activities.

Pentesting Payloads

A web-based payload repository that generates ready-to-use exploits for pentesting

XBOW Captcha Bypass Tool

AI-powered automated penetration testing platform for vulnerability discovery

FireCompass AI-powered Pen Testing

AI-powered automated pen testing & continuous red teaming platform

PlexTrac Pentest Reporting

Pentest reporting & exposure mgmt platform for vulnerability remediation

Faraday Faraday All-in-One

Modular offensive security platform for continuous monitoring and testing

Ampcus Agentic AI

Autonomous AI system for continuous penetration testing and exploit validation

Terra Agentic AI Platform

AI-powered continuous pentesting platform with agentic automation

Cobalt Offensive Security Platform

PTaaS platform for managing pentests, DAST, and attack surface monitoring.

Redbot Security AI Security Testing

Manual penetration testing service targeting AI/ML systems and LLM vulnerabilities.

Ridge Security RidgeSphere

Centralized mgmt console for multiple RidgeBot deployments across MSSP clients.

Vulneri Pentest

Continuous pentest platform simulating real attacks across web, cloud, and network assets.

Webray RayBox

Automated penetration testing appliance covering recon-to-exploitation attack chain.

KinoSec Zeus

Autonomous AI black-box pentesting platform with exploit chaining and PoC generation.

CodeWall AI-Powered Pentesting

Autonomous AI agent platform for continuous pentesting with verified exploits.

Plainsea Agentic Penetration Testing Platform

Agentic AI platform for continuous, full-lifecycle penetration testing.

Strike PTaaS

Hybrid PTaaS platform combining AI scanning with expert hacker validation.

BloodHound

BloodHound is a Javascript web application that uses graph theory to analyze Active Directory and Azure environments, revealing hidden relationships and potential attack paths through visual mapping.

SecLists

SecLists is a comprehensive repository of security testing lists including usernames, passwords, URLs, fuzzing payloads, and web shells used during penetration testing and security assessments.

x8

x8 is a hidden parameters discovery suite that automatically identifies undocumented parameters in web applications and APIs for security testing purposes.

Habu Hacking Toolkit

A Python-based network hacking toolkit that implements various attack and reconnaissance techniques for educational purposes and network security learning.

Allseek

Open-source autonomous penetration testing platform.

SprayingToolkit

A collection of Python scripts for password spraying attacks against Lync/S4B & OWA, featuring Atomizer, Vaporizer, Aerosol, and Spindrift tools.

Weakpass

A comprehensive collection of wordlists for bruteforcing and password cracking, covering various hashing algorithms and sizes.

o365-attack-toolkit

A toolkit to attack Office365, including tools for password spraying, password cracking, token manipulation, and exploiting vulnerabilities in Office365 APIs and services.

o365recon

A reconnaissance tool that retrieves information from Office 365 and Azure Active Directory using a valid credential.

Active Directory Control Paths

A tool for analyzing and visualizing control relationships and privilege escalation paths within Active Directory environments using graph-based representations.

Legion

An open source network penetration testing framework with automatic recon and scanning capabilities.

Offensive Docker

An image with commonly used tools for creating a pentest environment easily and quickly, with detailed instructions for launching in a VPS.

Raccoon

Offensive security tool for reconnaissance and information gathering with a wide range of features and future roadmap.

BurpSmartBuster

A Burp Suite plugin that performs intelligent content discovery by analyzing current requests to identify directories, files, and variations based on the application's structure.

Maigret The Commissioner

Online Telegram bot for collecting information on individuals from various websites.

Nimbostratus

A proof-of-concept toolkit for fingerprinting and exploiting Amazon Web Services cloud infrastructures using the boto library.

Enumerate IAM Permissions

A security assessment tool that identifies AWS IAM permissions by systematically testing API calls to determine the actual scope of access granted to specific credentials.

Domain

Setup script for Regon-ng

screenshoteer

A command-line tool for capturing automated screenshots of websites and mobile applications with support for multiple browsers and device emulations.

gowitness

A Go-based command-line tool that uses Chrome Headless to automatically capture screenshots of web pages for reconnaissance and analysis purposes.

Gospider

A Go-based web spider tool for automated crawling and data collection from web resources across multiple protocols and formats.

parameth

A brute force parameter discovery tool for identifying hidden GET and POST parameters in web applications during security assessments.