The Toolkit
Web Application Analysis
Web applications are where a huge share of real-world compromise happens, and they deserve their own toolkit. This category is about testing the app itself: sitting between your browser and the server to inspect and tamper with every request, hunting SQL injection, auditing WordPress, and fuzzing endpoints for the inputs the developers forgot about.
The centerpiece is the intercepting proxy — Oniomarchy ships two, Burp Suite and Caido, and wires your hardened Firefox up to trust their certificates so you can start intercepting in seconds instead of minutes.
| Tool | Source | What it’s for |
|---|---|---|
| sqlmap | official | Automated SQL injection detection and exploitation. |
| wpscan | official | WordPress vulnerability scanner. |
| burpsuite | AUR | The industry-standard intercepting proxy and web testing platform. |
| caido | AUR | A modern, fast intercepting proxy — a lightweight Burp alternative. |
| wfuzz | AUR | Web fuzzer for brute-forcing parameters, paths, and forms. |
All live under Security → Web Application Analysis. For the browser proxy wiring and the CA-trust step, see Working the Machine → Quick Attack Actions and The Hardened Browser.