Alternatives
Products that do what Pfuzz, a web fuzzer following the Unix philosophy does
I recently dipped my toes into bug bounty hunting and finding security flaws in web applications. As a friend of UNIX shells I was building a repertoire of command line tools to make and analyze HTTP requests. Fortunately there are already many suitable tools like curl, jq, different fuzzers and some really nice tools for specific tasks by Tom Hudson [1]. However, I disliked that the existing fuzzers were monoliths where I had no easy way of creating custom behavior or analyses. They commonly do a multitude of things: Create multiple requests using one or more wordlist, sending the request,…
- 1OF
2021 · github.com
- 2TH
I wrote this tool during an internship at Narf Industries in 2023. It's a REPL that allows for quickly developing, testing, and fuzzing for HTTP request smuggling attack payloads. I started the internship having never worked with web servers, and have now found over 100 HTTP implementation bugs. I attribute this mostly to the ease of experimentation in the Garden. REPL-oriented fuzzing is just a really good interface for finding parsing bugs. It's pretty neat to able to run a differential fuzzer, categorize and display all the discovered discrepancies, then let a human pick through them and…
2024 · github.com
- 3PA
2015 · github.com
- 4AW
Hey HN, I wanted to show you a product a small team and I have been working on for 4 years. https://jam.dev It’s called Jam and it prevents product managers (like I used to be) from being able to create vague and un-reproducible bug tickets (like I used to create). It’s actually really hard as a non-engineer to file useful bug tickets for engineers. Like, sometimes I thought I included a screenshot, but the important information the engineer needed was what was actually right outside the boundary of the screenshot I took. Or I'd write that something "didn't work" but the engineer…
2024
- 5IM
0github.com is a pull request viewer that color-codes every diff line/token by how much human attention it probably needs. Unlike PR-review bots, we try to flag not just by "is it a bug?" but by "is it worth a second look?" (examples: hard-coded secret, weird crypto mode, gnarly logic, ugly code). To try it, replace github.com with 0github.com in any pull-request URL. Under the hood, we split the PR into individual files, and for each file, we ask an LLM to annotate each line with a data structure that we parse into a colored heatmap. Examples:…
Oct 2025 · 0github.com
- 6SL
Or more precisely, my little site maker... It is a personal tool that I thoroughly enjoyed making, and enjoy using to write my website . A caveat before any more; nobody was supposed to promote this insanity. Like, terrible things have been done involving inotify and xdotool. But. It showed up on HN some months ago. That too while it was still, shall we say, fermenting. It got "done" some time thence, and of course one could not let the half-past just be. So here we are, for better or worse. Thank you HN mods for helping me repost! _\\// The README explains all, animated GIFs and…
2023 · github.com
- 7UJ
Hello HN! I became frustrated with the unpredictible/poor match quality and opaqueness of "relevance scores" in existing fuzzy and fulltext search libs, so I tried something different and this is the result. The main selling point is the result quality / ordering, with best-in-class memory overhead and excellent performance being bonuses. The API is pretty stable at this point, but looking for feedback before committing to 1.0. TL;DR The test corpus is a 4MB json file with 162k words/phrases, so give it a second for initial download. You can also drag/drop your own…
2022 · github.com
- 8PS
I originally was just messing with pi-autoresearch. Gave it a sample task to build the most portable coding agent. First cut was 6 KB of shell. Great for one-shots, unusable interactively. I was shocked it actually worked. Started building up -- adding features — but with a self-imposed rule: no new dependencies, and sub 500 LOC. This thing had to be truly portable. Just sh, curl, awk. System primitives only. Which means I did some genuinely disgusting things in awk, including JSON parsing and the OpenAI Responses tool loop with reasoning items carried across turns. It's now ~400 lines. In…
Apr 2026 · pu.dev
- 9AT
Hi everyone, I recently published a small open-source project. It’s a minimal network packet analyzer written in Go — designed more like a learning toy than a replacement for Wireshark. It currently supports parsing basic protocols like TLS, DNS, and HTTP, and includes a tiny fuzzing engine to test payload responses. You can inspect raw packet content directly from the terminal. The output is colored for readability, and the code structure is kept simple and clear. The entire program is very small — just about 400 lines of Go code. I know it’s not anywhere near Wireshark’s level, and I still…
2025 · github.com
- 10IW
Hello everyone! I'm currently in a journey to learn and improve my Elixir and Go skills (my daily job uses C++) and looking through my backlog for projects to take on I decided Elixir is the perfect language to write a highly-parallel BitTorrent tracker. So I have spent my free time these last 3 months writing one! Now I think it has enough features to present it to the world (and a docker image to give it a quick try). I know some people see trackers as relics of the past now that DHT and PEX are common but I think they still serve a purpose in today's Internet (purely talking about public…
2025 · github.com
- 11
Hello everyone. I've been working on this experimental editor called Huzzah. I've been working almost exclusively with coding agents since January of this year, and over the past few months I began to feel utterly exhausted by them. They're great, but I'm finding it more and more tedious to write full sentences for every change I want. Not only that, but it seems there's a complexity limit for codebases - beyond a certain point the agent begins confusing itself. I'd like to go back to writing code, but I don't want to go all the way back to fully manual coding. So I've come up with this…
17d ago · danielvaughn.dev
- 12HR
2021 · hurl.dev
- 13UD
Hey HN, I built uncurl.dev to scratch my own itch: I kept getting curl commands in API docs, bug reports, or Slack messages and wanted a quick way to visualize, run, and debug them without firing up Postman or writing code to dissect them. It was also sometimes painful to create a test page specifically for non-tech users to consume an API. I originally vibe-coded this over a weekend just to make it easier for myself to debug API requests shared as curl commands. It slowly grew into something I found surprisingly useful in my workflow, so I decided to clean it up and share it. uncurl.dev…
2025 · uncurl.dev
- 14SA
Hello all :) I made this BBS for fun and thought you all would enjoy it. It's not perfect, but it's been a fun exercise! see it: https://asciinema.org/a/Emg6SWrXMV6cehfQxrw1GRu75 try it: ssh -p 2223 shhhbb.com host it: https://github.com/donuts-are-good/shhhbb/releases/latest why? Every year I challenge myself in some new way, this year it is to push one project per week. You might recognize my static site generator [0] or my releaser for go [1] from previous posts as one of these weekly projects. If you want to join me in doing this, it's…
2023 · donuts-are-good.github.io
- 15TL
Hi HN, I spent the past year building this in my spare time because I got tired of enterprise security tools that cost $50K/year and don't understand Linux. TheProtector is a comprehensive security monitoring tool that actually runs on the systems we use (Linux) instead of being a Windows-first afterthought. Built it entirely on a $500 laptop because I believe good security shouldn't require unlimited budgets. Features: - Real-time process, network, and file monitoring - YARA malware detection with custom rules - eBPF kernel monitoring (when available) - Behavioral baseline…
2025 · github.com
- 16MS
Author here! Some context: I published this 48 hours ago and it was auto-listed on MCPMarket (the MCP tools directory). Got 700+ organic downloads with zero marketing—developers were actively searching for exactly this solution. The "Git Accelerator" optimization story: Initially used a file walker that took 6.6s on Chromium. Profiling showed 90% was filesystem I/O. The fix: git ls-files returns 480k paths in ~200ms. Added smart heuristics for untracked files (only scan dirs <50k files), bringing total to 0.46s. Why this matters: Agents can't wait 10 seconds for search. Sub-500ms makes…
Jan 2026 · github.com
- 17FF
Oct 2025 · github.com
- 18FA
2016 · mail.python.org
- 19PS
I started writing this mostly for the Pi but ended up building it to support multiple Linux OSs. It's intended to be just that, a small dashboard providing real-time details on the usage. Still a work in progress and was done for fun, there's a demo as well :). MIT license. https://pydash.net or http://k3oni.github.io/pydash
2014
- 20PT
2022 · easylang.online
- 21QD
Hi HN, I'm Tyler Flint. Eight months ago we shared qtap here (https://news.ycombinator.com/item?id=43928118). Today we're releasing DevTools - a browser-based interface that gives you the Chrome Network tab experience for server-side HTTP/S traffic. The problem: You're debugging a production issue. An external dependency is returning errors. Your logs say "request failed" but not what was actually sent. Adding debug logging means redeploying and restarting services - which takes time and often changes the conditions you're trying to debug. tcpdump shows encrypted blobs.…
Jan 2026 · qpoint.io
- 22EC
Hey all, As a CEO of a growing startup I don't get to code as often as I like and when I do, I try not to annoy my team with my terrible code :) So to scratch the itch, I've built some of side projects related to what our company does. The latest is embedcurl.com I see a lot of API docs and blogs posting curl commands that are really hard to read and I figured I could make them easier to read and add some niceties like easier copy/paste, tooltips on flags, etc. They also gracefully degrade if javascript isn't enabled back to a element. The parsing is done in Python with shlex and…
2013
- 23IB
BoringSSL and nghttp2. Matches JA3N, JA4, and JA4_R fingerprints. Supports HTTP/2, async/await, and works with Cloudflare-protected sites. Not trying to compete with curl_cffi - just a learning project that turned into something functional.
Nov 2025 · github.com
- 24FI
I've been contemplating applying for HackerSchool, so I was looking at the application and saw the piece about FizzBuzz. I'd somehow never heard of this before. It is a trivial task in a conventional language, so I thought I would have some fun on a long internet-less train ride back to Rochester. "Piet is a programming language in which programs look like abstract paintings" http://www.dangermouse.net/esoteric/piet.html Doesn't it look kinda beautiful? http://benbrittain.com/imgs/fizzbuzzLarge.png here is a picture of the execution so you can see what is actually code.…
2012
Ranked by how close each launch is in meaning, then by votes. Refine with a description →