Lonkero — web scanner for pentesting

★ 1.1K

bountyyfi/lonkero is an open-source web security scanner built for professional penetration testing, written in Rust (1.85+ required), with a modular architecture and built-in ML layer. Reach for it when you need to map an attack surface before an engagement and see what's exposed; when a security team runs regular perimeter audits hunting known vulnerabilities; when you want one coherent tool instead of a pile of scripts; or when false-positive noise is killing your productivity. Under the hood: 125+ specialized scanners, v3.0 Intelligent Mode with tech detection and per-parameter risk scoring, proof-based XSS detection without Chrome (16 reflection contexts, ~200 ms per URL), Zero OOB blind SQL injection via Pearson correlation without external callbacks, ML Auto-Learning that improves over time, coverage for Next.js, GraphQL, gRPC, WebSocket, HTTP/3, and a browser extension. Deployed via CLI; the license is proprietary despite the public repository. The tool's direction is offensive security — finding vulnerabilities and building reports — not passive network monitoring (use dedicated network-monitoring tools in the catalog for that). Use only on systems you own or have written authorization to test; scanning third-party infrastructure without permission is illegal. Not a fit when you need a lightweight port scanner only, or an open license to embed in a commercial product.