Dev tools · alternatives · 2026
24 alternatives to The HTTP Garden – A Parser Vulnerability Research Tool
I wrote this tool during an internship at Narf Industries in 2023. It's a REPL that allows for quickly developing, testing, and fuzzing for HTTP request smuggling attack payloads. I started the internship having never worked with web servers, and have now found over 100 HTTP implementation bugs. I attribute this mostly to the ease of experimentation in the Garden. REPL-oriented fuzzing is just a really good interface for finding parsing bugs. It's pretty neat to able to run a differential fuzzer, categorize and display all the discovered discrepancies, then let a human pick through them and…
The HTTP Garden is a REPL tool for developing, testing, and fuzzing HTTP request smuggling payloads. Built during a 2023 internship at Narf Industries, it enables researchers to quickly experiment with HTTP parsing… Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes. The HTTP Garden – A Parser Vulnerability Research Tool launched in 2024; newer entries below may have overtaken it.
- 1
Beautiful, cross-platform & open-source tools for debugging, testing and building with HTTP(S), on Windows, Linux & Mac.
2019 · httptoolkit.tech · its alternatives →
- 2
Hey HN, Henry here from Cactus. We open-sourced Needle, a 26M parameter function-calling (tool use) model. It runs at 6000 tok/s prefill and 1200 tok/s decode on consumer devices. We were always frustrated by the little effort made towards building agentic models that run on budget phones, so we conducted investigations that led to an observation: agentic experiences are built upon tool calling, and massive models are overkill for it. Tool calling is fundamentally retrieval-and-assembly (match query to tool name, extract argument values, emit JSON), not reasoning. Cross-attention…
May 2026 · github.com · its alternatives →
- 3
Articles in this series Part I. Iterative ServersPart II. Forking ServersPart III. Pre-forking ServersPart IV. Threaded ServersPart V. Pre-threaded ServersPart VI: poll-based serverPart VII: epoll-…
2019 · unixism.net · its alternatives →
- 4
Hurl, run and test HTTP requests with plain text and curl. Hurl can run fast automated integration tests.
2021 · hurl.dev · its alternatives →
- 5DR
I'd like to invite everyone to try out DontBeEvil.rip, an experimental search engine for developers. tl;dr $ alias rip="curl -G -H 'Accept: text/plain' --url https://dontbeevil.rip/search --data-urlencode " $ rip 'q=Heartbleed bug' DontBeEvil.rip is a year long experiment to see if a small team can build a developer-focused search engine that is self-sustaining on $10 monthly subscriptions. It works by only indexing high-quality resources that are relevant to developers. You won't get useless listicles because we'll never crawl them. Relevant urls are harvested from HN,…
2022 · its alternatives →
- 6
I recently dipped my toes into bug bounty hunting and finding security flaws in web applications. As a friend of UNIX shells I was building a repertoire of command line tools to make and analyze HTTP requests. Fortunately there are already many suitable tools like curl, jq, different fuzzers and some really nice tools for specific tasks by Tom Hudson [1]. However, I disliked that the existing fuzzers were monoliths where I had no easy way of creating custom behavior or analyses. They commonly do a multitude of things: Create multiple requests using one or more wordlist, sending the request,…
2024 · github.com · its alternatives →
- 7
Hi everyone, I recently published a small open-source project. It’s a minimal network packet analyzer written in Go — designed more like a learning toy than a replacement for Wireshark. It currently supports parsing basic protocols like TLS, DNS, and HTTP, and includes a tiny fuzzing engine to test payload responses. You can inspect raw packet content directly from the terminal. The output is colored for readability, and the code structure is kept simple and clear. The entire program is very small — just about 400 lines of Go code. I know it’s not anywhere near Wireshark’s level, and I still…
2025 · github.com · its alternatives →
- 8
Hi, I created httpdbg, a tool for Python developers to easily debug HTTP(S) client requests in Python programs. I developed it because I needed a tool that could help me trace the HTTP requests sent by my tests back to the corresponding methods in our API client. The goal of this tool is to simplify the debugging process, so I designed it to be as simple as possible. It requires no external dependencies, no setup, no superuser privileges, and no code modifications. I'm sharing it with you today because I use it regularly, and it seems like others have found it useful too—so it might be…
2024 · github.com · its alternatives →
- 9
Black-box fuzzer that fuzzes APIs based on OpenAPI specification. Find bugs for free! - matusf/openapi-fuzzer
2021 · github.com · its alternatives →
- 10IB
Senior full stack software engineer with 8+ years shipping production systems in React, Node.js, Python, and Rails. Previously a Product Engineer at Ghost. Based in South Korea.
2021 · ronaldlangeveld.com · its alternatives →
- 11
My simple Swiss Army knife for http/https troubleshooting and profiling. - trimstray/htrace.sh
2019 · github.com · its alternatives →
- 12
FlowLens▲134Hi HN, We often run into this with coding agents like Claude Code: debugging turns into copy-pasting logs, writing long explanations, and sharing screenshots. FlowLens is an MCP server plus a Chrome extension that captures browser context (video, console, network, user actions, storage) and makes it available to MCP-compatible agents like Claude Code. You can try it here: https://magentic.ai/flowlens Any feedback—good, bad, or brutal—is welcome.
Dec 2025 · magentic.ai · its alternatives →
- 13AS
Hiya HN! Just released Artillery Probe - a Swiss army knife for testing HTTP from the CLI. Think mini-curl with better UX for common use-cases, plus a couple of extra features. Would love for you to try it and give some feedback! https://www.artillery.io/blog/swiss-army-knife-for-http-testing and: npm install artillery@latest What does it do? - First of all, it's a HTTP client! It does all the usual stuff you'd expect from a HTTP client... HTTP methods, request bodies, custom headers, forms, Basic Auth etc. - Got some JSON or XML back? It'll pretty-print it, and syntax…
2022 · its alternatives →
- 14UT
Hey HN, I wanted to get more familiar with C programming, *nix socket programming and C compilation, so I wrote this "web" ""server"". It's running on a tiny SBC in my office, and there's as little as possible between you and it. Happy for you to try and break it, hopefully with something more interesting than a DoS though :) Please let me know if you find any issues.
2025 · unsafehttp.benren.au · its alternatives →
- 15
BoringSSL and nghttp2. Matches JA3N, JA4, and JA4_R fingerprints. Supports HTTP/2, async/await, and works with Cloudflare-protected sites. Not trying to compete with curl_cffi - just a learning project that turned into something functional.
Nov 2025 · github.com · its alternatives →
- 16
I built this because I wanted my own directory of public companies running bug bounty programs — where I could see their infrastructure in one place and have a real idea of where to start poking holes. Neobotnet collects intel data from companies on HackerOne and Bugcrowd — subdomains, DNS records, web servers with status codes, indexed/crawled URLs, JS files, and exposed secrets/paths (still building this last part). The data is already there when you need it. No scans to run. Currently tracking 41 companies, 63,878 web servers, and 1.8M+ URLs. Long term I want to expand this to…
Mar 2026 · neobotnet.com · its alternatives →
- 17
My little fuzzing framework inspired by grinder. Contribute to susperius/PyFuzz2 development by creating an account on GitHub.
2015 · github.com · its alternatives →
- 18
We've been trying to evaluate web scraping companies, but when you look at their benchmarks, you can't verify anything, and they mostly exist to prove the company is successful. They put somewhere between 98% and 100% because they pick their own urls, define success their own way, and don't publish the harness. We also saw companies like scrapfly astroturf websites like scrapeway and call them independent. So, we built an open source benchmark that we want to represent the frontier of web data. We're trying to look across all major anti-bot providers and industries, to build a comprehensive…
Jul 2026 · github.com · its alternatives →
- 19
Hi HN -- I built HTTP:COLON, a small, open-source web tool for quickly checking a site’s HTTP response headers and learning what they mean as you go. Link: https://httpcolon.dev/ What it does - Enter a URL and fetch its response headers - Groups common headers into handy buckets (cache, content, security) - Includes short docs/tooltips for headers and directives so you can look things up while debugging. I find hovering on highlighted headers quite useful! Supports different HTTP methods (GET/POST/PUT/DELETE) Deep links - You can link directly to a host,…
Jan 2026 · httpcolon.dev · its alternatives →
- 20
This is a small PoC Python project for web server access logs analyzing to classify and dynamically block bad bots, such as L7 (application-level) DDoS bots, web scrappers and so on. We'll be happy to gather initial feedback on usability and features, especialy from people having good or bad experience wit bots. *Requirements* The analyzer relies on 3 Tempesta FW specific features which you still can get with other HTTP servers or accelerators: 1. JA5 client fingerprinting (https://tempesta-tech.com/knowledge-base/Traffic-Filtering-b...). This is a HTTP and TLS layers…
2025 · github.com · its alternatives →
- 21IW
It's inspired by this comment I made: https://news.ycombinator.com/item?id=26599746. I actually saw several comments with HTTP URL posted, and that was the only one I bothered to comment on. So I thought that this is something better suited for bots than human. I hacked this together over yesterday and today: https://github.com/fishy/https-bot. Basically it uses the Firebase API (https://github.com/HackerNews/API) to find comments with HTTP URLs in them, try the HTTPS version, compare the contents, post back a comment if the contents are…
2021 · its alternatives →
- 22
Hey folks, I am finally posting a Show HN post for a project I have been working on for several months now, and it's in a state where I already get a lot of value myself, so I am happy to share broadly. The pitch line is: "Skybear.NET is a managed platform automating Synthetic HTTP API testing." At the moment, the main source file format supported for your API tests are Hurl.dev files [1]. Hurl is a CLI tool wrapping `curl` and it's really awesome. At least check that out :) I am not affiliated directly with the Hurl CLI tool, and the platform I am building provides full Hurl compatibility.…
2024 · skybear.net · its alternatives →
- 23
The first open-source AI-driven tool for automatically generating system-level test cases (also known as fuzzing) for web/enterprise applications. Currently targeting whitebox and blackbox testing of Web APIs, like REST, GraphQL and RPC (e.g., gRPC and Thrift). - WebFuzzing/EvoMaster
2020 · github.com · its alternatives →
- 24
Stop half-done APIs! Cherrybomb is a CLI tool that helps you avoid undefined user behaviour by auditing your API specifications, validating them and running API security tests. - blst-security/cherrybomb
2022 · github.com · its alternatives →
Also compare
- HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup alternatives
- Needle: We Distilled Gemini Tool Calling into a 26M Model alternatives
- ZeroHTTPd: A web server to teach Linux performance, with benchmarks alternatives
- Hurl – Run and test HTTP requests with plain text, curl and Rust alternatives
- DontBeEvil.rip: Search, for developers (API, expressions, CLI) alternatives
- Pfuzz, a web fuzzer following the Unix philosophy alternatives
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →