Life & fun · alternatives · 2026
24 alternatives to whack.sh
Whack the moles your current scanner can't see.
Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes.
- 1
Heyhack Scan▲271SaaS pen-testing that surpasses the level of ethical hackers
2022 · auth.heyhack.com · its alternatives →
- 2
- 3
- 4
- 5
Phantom Analyzer▲169A real-time website scanner to see what trackers are lurking
2020 · usefathom.com · its alternatives →
- 6
This is a simple single-file python program that can find basic XSS (cross-site scripting) vulnerabilities in a target url. Most XSS discovery tools use a payload refelection strategy in which payloads are injected in url parameters and the GET response is inspected for places where the payload content is reflected. This is a very low precision XSS detection strategy because most reflection does not support execution. This program uses a different approach, and instead opens the target url in a browser, tests alert(...) payloads directly in the browser context, and listens for an alert being…
2024 · github.com · its alternatives →
- 7
Dastardly▲57A lightweight web app security scanner for your CI pipelines
2022 · portswigger.net · its alternatives →
- 8TY
Hi HN, Some misbehaving networks drop WireGuard packets either by accident or on purpose. Commonly the latter is done with simple DPI rules that block the handshake initiation [1], but it could be applied to other message types as well. We thought it would be great if there was tool for folks to use as a quick litmus test to see if this happening for them, without having to configure a client to send data through a random, functional WireGuard tunnel to an untrusted remote host. So we built probe.sh. How it works: - The probe.sh web app is an Elixir Phoenix app that spawns a few gen_udp…
2024 · probe.sh · its alternatives →
- 9
qsa.sh ▲107External security scan of your own IP, in your terminal
Jul 2026 · qsa.sh · its alternatives →
- 10RD
2017 · recdnsfp.github.io · its alternatives →
- 11
CDK Insights▲75Catch security issues in your AWS CDK before deployment
Apr 2026 · cdkinsights.dev · its alternatives →
- 12
- 13
I built this after seeing multiple teams accidentally ship API keys in their frontend code. The problem: Modern web development moves fast. You're vibe-coding, shipping features, and suddenly your AWS keys are sitting in a tag visible to anyone who opens DevTools. I've personally witnessed this happen to at least 3-4 production apps in the past year alone. KeyLeak Detector runs through your site (headless browser + network interception) and checks for 50+ types of leaked secrets: AWS/Google keys, Stripe tokens, database connection strings, LLM API keys (OpenAI, Claude, etc.), JWT…
Nov 2025 · github.com · its alternatives →
- 14
WraithScan▲10I'm an ex-StarCraft II pro who retired back in 2014 and have been developing since then. I made a free web app security platform for vibe coders and small businesses/startups. WraithScan (https://wraithscan.com) has a double meaning... as you can guess cloaked wraiths + comsat scanning but also is a web scanner for detecting attack vectors for your web app. Cloaked wraiths are seen as cheesy these days, right? Anyways, it tests for the following vulnerabilities: - SQL injection - XSS - Open redirects - Exposed .env / backup files - Misconfigured CORS - Misconfigured…
2025 · wraithscan.com · its alternatives →
- 15
Detect any website's tech stack with a single API call
Feb 2026 · detectzestack.com · its alternatives →
- 16
WPCheckr▲6Next-Gen WordPress security scanner. Scan DEEP. Scan FREE
Dec 2025 · wpcheckr.com · its alternatives →
- 17
Kameleo 5.1 ships Fingerprint Inspector, a DevTools-style panel that shows exactly which fingerprinting calls a site makes, patched into Blink instead of monkey
Aug 2026 · kameleo.io · its alternatives →
- 18
Online automated vulnerability scanner to secure firewalls, servers, web applications, and apis. Try 14 days for free.
2020 · hostedscan.com · its alternatives →
- 19
I've published an open specification for a detection method I'm calling RQ4 (Request Context Fingerprinting). It analyzes whether HTTP request headers are logically consistent with real browser behavior - not just what headers are present, but whether they make sense together given the request context.
Mar 2026 · github.com · its alternatives →
- 20
Free website security scanner 20+ checks, instant PDF report
May 2026 · pulseshield.co.uk · its alternatives →
- 21
Free security scan that tells you exactly how to fix it
Jun 2026 · its alternatives →
- 22
Scan any website for security issues in 10 seconds. Free.
Feb 2026 · guardscan.dev · its alternatives →
- 23
Snooper's charter fuzzer Chrome extension . Contribute to twak/hot-fuzz development by creating an account on GitHub.
2016 · github.com · its alternatives →
- 24
Test your browser fingerprint across 7 detection layers with 80+ data points. Find out if websites can track you and get recommendations to improve your privacy.
Dec 2025 · anti-detect.com · its alternatives →
Also compare
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →