Tools & Commands

A running list of the tools used across this knowledge base, grouped by job.

Capture & discovery

Tool	Purpose
Playwright	codegen (record flows), HAR capture, headless browser automation
Burp Suite	Proxy, Repeater, Intruder, API extension points
mitmproxy / mitmdump	Scriptable proxy, traffic dump, replay
Postman / Insomnia	Manual request crafting, collection import from OpenAPI
katana / gau / waybackurls	Endpoint & historical URL discovery
ffuf / gobuster / dirsearch	Route & directory fuzzing
arjun	Hidden HTTP parameter discovery
Kiterunner	API route discovery from wordlists

Replica & testing

Tool	Purpose
FastAPI / Flask / Express	Build the local behavioral replica
pytest / curl scripts	Automated parity & matrix checks
wfuzz / ffuf	Parameter + payload fuzzing
nuclei	Template-based detection (has API templates)
GraphQL tools	clairvoyance, graphql-cop, InQL, graphw00f

Enterprise / commercial (2026 shortlist)

Tool	Key differentiator
Levo.ai	eBPF discovery, zero-data model, context-aware testing
Traceable.ai	Runtime behavioral analytics & threat detection
42Crunch	OpenAPI conformance & policy enforcement
Akto	Traffic-based inventory, CI/CD-friendly
Salt Security	Shadow API discovery, business-logic analysis
APIsec	Automated API pentesting (no manual scripting)
StackHawk	DAST for APIs in CI/CD
Invicti / Rapid7 / Qualys	Enterprise DAST with API modules

Install & run with bun

This site itself is built with bun — fast, single binary, tiny static output:

# dev server
bun run dev

# static build (output in dist/)
bun run build

# preview the build
bun run preview

# serve the static dist/ folder from any box (no Node server needed)
bunx serve dist

Tip

For self-hosting on low-end hardware, ship the static build (dist/) — pure HTML/CSS/JS, no runtime, no database. Serve it with any static file server.