Dev tools · alternatives · 2026
24 alternatives to JSProbeX
Pentesting tool to extract secrets & URLs from JS files
Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes. JSProbeX launched in 2024; newer entries below may have overtaken it.
- 1
hey guys, wanted to show one of my side projects i just made public. the idea is basically another osint tool for pentesters and bug bounty hunters. it watches certificate transparency logs and checks newly-seen domains for exposed stuff like .env files, open .git dirs, config files, db dumps and so on, and puts whatever it finds into a searchable db. you just search a domain (or part of one) and see what's exposed. it's read-only and free. one thing i've been thinking about adding is a way to register for certain keywords and get notified when something new shows up for that search. would…
Jul 2026 · search.cerast-intelligence.com · its alternatives →
- 2
Excited to share the project I've been working on for the past 7 months! We've seen nearly weekly attacks against the open source software supply chain. I saw the seeds of this trend start in the mid 2015s as an open source maintainer and I've watched it only get worse over the years. I finally decided to try to solve this problem. Socket is taking an entirely new approach to one of the hardest problems in security in a stagnant part of the industry that has historically been obsessed with just reporting on known vulnerabilities. Unlike other scanning tools, Socket actually analyzes the…
2022 · socket.dev · its alternatives →
- 3
- 4
2016 · corte.si · its alternatives →
- 5
Live extension analysis: Point us at a Chrome/Edge/Firefox extension (store URL or CRX). We spin up a safe sandbox and observe it in real time—permissions use, message passing, storage writes, network calls, remote code loading, and UI injections. Package scanning: Paste an npm/package URL or code. We do quick static + dynamic checks: install/postinstall scripts, obfuscation/eval, exfil endpoints, suspicious APIs, and typosquat/reputation signals. AI explainer: An LLM summarizes the behaviors and risk patterns in plain English (why it’s risky, what to verify,…
2025 · browsertotal.com · its alternatives →
- 6
Free defensive Log4Shell tools. Scan logs for CVE-2021-44228 JNDI exploitation attempts (including obfuscated payloads) and check whether a Log4j version is vulnerable.
2021 · log4shell.tools · its alternatives →
- 7WT
2016 · android.fallible.co · its alternatives →
- 8
Find the origin of any character in the DOM
2019 · fromjs.com · its alternatives →
- 9
This is a simple single-file python program that can find basic XSS (cross-site scripting) vulnerabilities in a target url. Most XSS discovery tools use a payload refelection strategy in which payloads are injected in url parameters and the GET response is inspected for places where the payload content is reflected. This is a very low precision XSS detection strategy because most reflection does not support execution. This program uses a different approach, and instead opens the target url in a browser, tests alert(...) payloads directly in the browser context, and listens for an alert being…
2024 · github.com · its alternatives →
- 10
JSPad▲64Collaborative code assessment platform for JavaScript devs
2021 · jspad.xyz · its alternatives →
- 11
A powerful automated security testing tool
2024 · geneau.gumroad.com · its alternatives →
- 12
2021 · github.com · its alternatives →
- 13
WebSlurp▲9The Fastest Way to Test API Security Inside Chrome DevTools
Jul 2026 · webslurp.github.io · its alternatives →
- 14
I built this after seeing multiple teams accidentally ship API keys in their frontend code. The problem: Modern web development moves fast. You're vibe-coding, shipping features, and suddenly your AWS keys are sitting in a tag visible to anyone who opens DevTools. I've personally witnessed this happen to at least 3-4 production apps in the past year alone. KeyLeak Detector runs through your site (headless browser + network interception) and checks for 50+ types of leaked secrets: AWS/Google keys, Stripe tokens, database connection strings, LLM API keys (OpenAI, Claude, etc.), JWT…
Nov 2025 · github.com · its alternatives →
- 15
Add OSINT & Threat tooltips to all pages. Use any REST API!
2017 · github.com · its alternatives →
- 16AM
I made an open source, MIT license Typescript library based on some of the latest research that generates prompt injection attacks. It is a super minimal/lightweight and designed to be super easy to use. Keen to hear your thoughts and please be responsible and only pen test systems where you have permission to pen test!
2025 · prompt-injector.blueprintlab.io · its alternatives →
- 17
BoringSSL and nghttp2. Matches JA3N, JA4, and JA4_R fingerprints. Supports HTTP/2, async/await, and works with Cloudflare-protected sites. Not trying to compete with curl_cffi - just a learning project that turned into something functional.
Nov 2025 · github.com · its alternatives →
- 18
Guardscript monitors every few minutes any changes made to your Javascript files and sends you a notification with the changes made. You can then detect any malicious modification by analyzing these results.
2019 · guardscript.com · its alternatives →
- 19JC
2011 · jspkg.com · its alternatives →
- 20
A crate to protect against malicious JSON payloads. - ADD-SP/json-threat-protection.rs
2024 · github.com · its alternatives →
- 21
Obfuscates JavaScript files using amazing javascript-obfuscator. - tomasz-oponowicz/grunt-javascript-obfuscator
2016 · github.com · its alternatives →
- 22
I made FingerprinterJS, a small library with no dependencies that creates browser fingerprints from signals like canvas, WebGL, audio, fonts, userAgent, and screen info. It’s written in TypeScript, lets you enable/disable collectors, add custom data, and includes a simple suspicious-activity score. Would love feedback.
2025 · github.com · its alternatives →
- 23
Privacy-first, browser-native developer utilities.
Dec 2025 · toolwizardhub.com · its alternatives →
- 24AS
Free and instant penetration testing for rest APIs. Please try and let me know what do you think? https://www.apisec.ai/free-api-pen-test
2022 · its alternatives →
Also compare
- Osint tool that finds exposed files on domains alternatives
- Socket – Secure your JavaScript supply chain alternatives
- JA3.pro alternatives
- Mitmproxy 1.0 released, now with a web interface alternatives
- BrowserTotal: A framework for analyzing browser security posture alternatives
- I built a tool that detects bad cases of the Log4j vulnerability alternatives
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →