Dev tools · alternatives · 2026
24 alternatives to Pākiki Proxy – An intercepting proxy for penetration testing
Hey HN, I've been working on an intercepting proxy for penetration testing over the last few years in my spare time. Some points of difference from the existing tools: * The UIs are built using the native platform frameworks, meaning they look and behave like other applications on the desktop. * It has a fully embedded and integrated Python scripting engine. * It’s fully native meaning it’s nicer on system resources. * It has a number of built in scripts to automate reconnaissance, content discovery, authorisation checks, etc. * The core of it is open source. I'm really keen to get any…
Pākiki Proxy is an intercepting proxy designed for penetration testing and security work. Built with native platform frameworks, it provides a desktop application experience while offering an embedded Python scripting… Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes. Pākiki Proxy – An intercepting proxy for penetration testing launched in 2023; newer entries below may have overtaken it.
- 1
- 2
Hey all, wanted to share my recent weekend hack project. I wanted to improve upon the existing space for looking up information about IP addresses and ASNs. The backend is written in Rust and pulls BGP data every 8 hours from the RIPE RIS project to build up a routing table and also adds geolocation information. The frontend is using React and Tailwind. Would love any feedback or suggestions on what to improve.
2023 · ip.guide · its alternatives →
- 3
Hi HN, I'm Tyler Flint, one of the creators of qtap. For a while now, my team and I at Qpoint.io have been grappling with the challenge of understanding what's actually happening inside the encrypted traffic leaving our production systems. Modern apps rely heavily on third-party APIs (think payment processors, data providers, etc.), but once TLS kicks in, figuring out exactly what data is being sent, identifying PII exposure, or debugging integration issues becomes incredibly difficult without resorting to complex and often brittle solutions. Traditional approaches like forward proxies…
2025 · github.com · its alternatives →
- 4PI
2020 · pixielabs.ai · its alternatives →
- 5
The AI-powered AppSec platform that identifies vulnerabilities with comprehensive penetration tests and provides actionable remediation insights.
2024 · beaglesecurity.com · its alternatives →
- 6
Benchmark proxies for reliable, target-specific scraping
Aug 2026 · scrapeops.io · its alternatives →
- 7TY
Hi HN, Some misbehaving networks drop WireGuard packets either by accident or on purpose. Commonly the latter is done with simple DPI rules that block the handshake initiation [1], but it could be applied to other message types as well. We thought it would be great if there was tool for folks to use as a quick litmus test to see if this happening for them, without having to configure a client to send data through a random, functional WireGuard tunnel to an untrusted remote host. So we built probe.sh. How it works: - The probe.sh web app is an Elixir Phoenix app that spawns a few gen_udp…
2024 · probe.sh · its alternatives →
- 8
OP here. I built this because I recently caught myself almost pasting a block of logs containing AWS keys into Claude. The Problem: I need the reasoning capabilities of cloud models (GPT/Claude/Gemini), but I can't trust myself not to accidentally leak PII or secrets. The Solution: A Chrome extension that acts as a local middleware. It intercepts the prompt and runs a local BERT model (via a Python FastAPI backend) to scrub names, emails, and keys before the request leaves the browser. A few notes up front (to set expectations clearly): Everything runs 100% locally. Regex detection…
Dec 2025 · github.com · its alternatives →
- 9
- 10
This is a simple single-file python program that can find basic XSS (cross-site scripting) vulnerabilities in a target url. Most XSS discovery tools use a payload refelection strategy in which payloads are injected in url parameters and the GET response is inspected for places where the payload content is reflected. This is a very low precision XSS detection strategy because most reflection does not support execution. This program uses a different approach, and instead opens the target url in a browser, tests alert(...) payloads directly in the browser context, and listens for an alert being…
2024 · github.com · its alternatives →
- 11AS
Hiya HN! Just released Artillery Probe - a Swiss army knife for testing HTTP from the CLI. Think mini-curl with better UX for common use-cases, plus a couple of extra features. Would love for you to try it and give some feedback! https://www.artillery.io/blog/swiss-army-knife-for-http-testing and: npm install artillery@latest What does it do? - First of all, it's a HTTP client! It does all the usual stuff you'd expect from a HTTP client... HTTP methods, request bodies, custom headers, forms, Basic Auth etc. - Got some JSON or XML back? It'll pretty-print it, and syntax…
2022 · its alternatives →
- 12
Check whether your public IP has been observed participating in a residential proxy network. A free tool powered by Spur Intelligence.
Sep 2026 · haveibeenproxied.com · its alternatives →
- 13
Inspekt▲98AI-powered API proxy for automated debugging and security
Mar 2026 · inspekt-api.vercel.app · its alternatives →
- 14
Hey everyone. I built an MTProto proxy for Telegram aimed at bypassing active DPI censorship like the Russian TSPU. I chose Zig because it's perfect for writing fast network daemons and makes it incredibly easy to port low-level C bypass techniques like TCP desync and packet fragmentation. Would love to get some feedback or contributors!
Apr 2026 · github.com · its alternatives →
- 15
Proves vulnerabilities before reporting them.
Aug 2026 · dashboard-seven-self-13.vercel.app · its alternatives →
- 16
This is a small PoC Python project for web server access logs analyzing to classify and dynamically block bad bots, such as L7 (application-level) DDoS bots, web scrappers and so on. We'll be happy to gather initial feedback on usability and features, especialy from people having good or bad experience wit bots. *Requirements* The analyzer relies on 3 Tempesta FW specific features which you still can get with other HTTP servers or accelerators: 1. JA5 client fingerprinting (https://tempesta-tech.com/knowledge-base/Traffic-Filtering-b...). This is a HTTP and TLS layers…
2025 · github.com · its alternatives →
- 17
Every other gateway is detect-and-block. You don't get a security grade. You don't get red team in CI. We built the one that does. PromptGuard is a proxy: change your base URL (one line with our SDK, or a few lines without), and every request gets checked for prompt injection, PII leaks, jailbreaks, and abuse. 20+ threat vectors, 39+ PII types. We also ship a red team suite and an autonomous agent that mutates attacks to find bypasses - you get a grade (A-F) and a GitHub Action that runs these tests on every PR. So you see where you're weak before you ship. Works with OpenAI, Anthropic,…
Dec 2025 · promptguard.co · its alternatives →
- 18
What PII-Shield does: It's a K8s sidecar (or CLI tool) that pipes application logs, detects secrets using Shannon entropy (catching unknown keys like "sk-live-..." without predefined patterns), and redacts them deterministically using HMAC. Why deterministic? So that "pass123" always hashes to the same "[HIDDEN:a1b2c]", allowing QA/Devs to correlate errors without seeing the raw data. Key features: 1. JSON Integrity: It parses JSON, sanitizes values, and rebuilds it. It guarantees valid JSON output for your SIEM (ELK/Datadog). 2. Entropy Detection: Uses context-aware entropy…
May 2026 · github.com · its alternatives →
- 19AM
I made an open source, MIT license Typescript library based on some of the latest research that generates prompt injection attacks. It is a super minimal/lightweight and designed to be super easy to use. Keen to hear your thoughts and please be responsible and only pen test systems where you have permission to pen test!
2025 · prompt-injector.blueprintlab.io · its alternatives →
- 20CC
If you had to build a context window manager in 24h, would you stick to the existing model or come up with something better? Here's what I did: 1. Built a proxy that intercepts Codex's calls to OpenAI and rewrites them on the fly. 2. Replayed 3,807 rounds of SWE-bench Verified traces through it: avg prompt 44k → 6k tokens (-87%). 3. Posted it to HN to get the next reduction applied to my confidence interval — starting with the inevitable "How about accuracy?" npx -y pando-proxy · github.com/human-software-us/pando-proxy
Apr 2026 · npmjs.com · its alternatives →
- 21
Test proxies instantly from the web. No signup, no catches.
2025 · hypeproxies.com · its alternatives →
- 22CM
whenever I click through to a site managed through cloudflare I end up seeing a screen asking me to identify myself. This has happened often enough especially with HN articles that I just close some articles outright and read the discussion on HN instead. As an experiment I setup cloudflare for website of mine which gets majority of its traffic from Pakistan (where I am located). This is what I see https://dl.dropbox.com/u/8037186/cloudflare.png It basically shows cloudflare marking 100% of traffic from Pakistan as known threats. I would be interested to find out if its a common problem…
2012 · dl.dropbox.com · its alternatives →
- 23
An experimental AntiBot, AntiCrawl reverse proxy for serving simple static content. - pulkitsharma07/OnlyHumans-Proxy
2024 · github.com · its alternatives →
- 24
ProxyHub▲10Tunnel, inspect & mock localhost - no backend needed
Apr 2026 · proxyhub.app · its alternatives →
Also compare
- Proxyman alternatives
- IP Guide – Info on IP addresses, Networks, and ASNs alternatives
- Using eBPF to see through encryption without a proxy alternatives
- Pixie, Instant Kubernetes-Native Application Observability Using EBPF alternatives
- Beagle Security for Enterprises alternatives
- Proxy Tester by ScrapeOps alternatives
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →