# Vuln scanners

- [Tenable Nessus](/pentesting-notes/r3dcl1ff/webapp-pentest/vuln-scanners/tenable-nessus.md)
- [Sn1per](/pentesting-notes/r3dcl1ff/webapp-pentest/vuln-scanners/sn1per.md)
- [OpenVAS](/pentesting-notes/r3dcl1ff/webapp-pentest/vuln-scanners/openvas.md)
- [nuclei](/pentesting-notes/r3dcl1ff/webapp-pentest/vuln-scanners/nuclei.md): Best vulnscan for webApp pentesting
- [Black Widow](/pentesting-notes/r3dcl1ff/webapp-pentest/vuln-scanners/black-widow.md): BlackWidow is a python based web application spider to gather subdomains, URL's, dynamic parameters, email addresses and phone numbers from a target website.
- [Cariddi](/pentesting-notes/r3dcl1ff/webapp-pentest/vuln-scanners/cariddi.md): Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more
- [BBOT](/pentesting-notes/r3dcl1ff/webapp-pentest/vuln-scanners/bbot.md): Alternative to Sn1per, nice tool but heavily dependent on API keys (shodan,zoomeye,censys..)most of which are paid
