# Femida

Femida is a Dynamic Application Security Testing product. It runs on-premises. Pricing is free.

Femida is a Python automation tool that integrates with Burp Suite to detect blind XSS vulnerabilities in web applications through HTTP request analysis.

Checked October 2026.

## What is Femida?

Femida is a Python-based automation tool designed to identify blind XSS vulnerabilities in web applications. The tool integrates with Burp Suite as a proxy to intercept and analyze HTTP requests for potential blind cross-site scripting attack vectors.

The tool operates through command-line interface and focuses specifically on automating the detection process for blind XSS vulnerabilities, which are typically harder to identify through manual testing methods. Femida processes HTTP traffic captured through Burp Suite to systematically search for injection points where blind XSS payloads could be executed.

As an open-source tool available on GitHub, Femida can be installed using pip package manager. The tool is designed for security researchers and penetration testers who need to streamline their blind XSS vulnerability assessment workflows during web application security testing.

Tags: Open Source, XSS

## Where it fits in your security program (NIST CSF 2.0)

- [Identify](https://cybersectools.com/guides/building-identify-program-small-team): helps you know your assets and your risks.

## Quick facts

- Category: [Application Security](https://cybersectools.com/categories/application-security) · [Dynamic Application Security Testing](https://cybersectools.com/categories/dast)
- Deployment: On-Premises
- Company size fit: Startup, SMB, Mid-Market
- Pricing model: Free
- GitHub stars: 284
- Website: github.com

## Where it ranks

Femida is not a pick on the current [Best DAST Solutions for Business](https://cybersectools.com/shortlists/best-dast-solutions).

## Femida FAQ

### What is Femida?

Femida is a product in the Dynamic Application Security Testing category. It covers Open Source and XSS.

### What is the pricing for Femida?

Femida is free. Download and setup instructions are at https://github.com/wish-i-was/femida/.

### What are alternatives to Femida?

Alternatives to Femida listed on CybersecTools:

1. [Fortra BeSTORM](https://cybersectools.com/tools/fortra-bestorm) - Black box fuzzer and DAST product for application security testing (Commercial)
2. [EnProbe Cybersecurity](https://cybersectools.com/tools/enprobe-cybersecurity) - Cloud-based vulnerability assessment tool for web application security (Commercial)
3. [AppCheck SPA Scanner](https://cybersectools.com/tools/appcheck-spa-scanner) - DAST scanner for Single Page Applications using headless browser technology (Commercial)
4. [Halo Security Application Scanning](https://cybersectools.com/tools/halo-security-application-scanning) - DAST tool for detecting web app vulnerabilities like SQL injection and XSS (Commercial)
5. [Intruder Web Application Scanning](https://cybersectools.com/tools/intruder-web-application-scanning) - DAST tool for scanning web apps and APIs for OWASP Top 10 vulnerabilities (Commercial)

Compare all Femida alternatives at [https://cybersectools.com/alternatives/femida](https://cybersectools.com/alternatives/femida)

### What deployment and organization size does Femida fit?

Femida is available as on-premises software. It is listed for startups, small businesses and mid-market companies. It is free.

## Compare Femida with similar solutions

- [Femida vs Fortra BeSTORM](https://cybersectools.com/compare/femida-vs-fortra-bestorm)
- [Femida vs EnProbe Cybersecurity](https://cybersectools.com/compare/enprobe-cybersecurity-vs-femida)
- [Femida vs AppCheck SPA Scanner](https://cybersectools.com/compare/appcheck-spa-scanner-vs-femida)

All alternatives to Femida: [/alternatives/femida](https://cybersectools.com/alternatives/femida)

---

Source: https://cybersectools.com/tools/femida

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on Femida: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md