In-depth attack surface mapping and asset discovery tool.
Primary recon tool for subdomain and infrastructure enumeration.
OWASP CRS
Core Rule Set for ModSecurity and compatible WAFs — generic attack detection rules.
OWASP Juice Shop
Intentionally insecure modern web app for training — covers OWASP Top 10 and more.