Repolode
Submit
bountyyfi

bountyyfi/lonkero

Rust-based web application security scanner for penetration testers, with 125+ scanner modules, a browser extension, and an AI-driven testing mode.

Open-source alternative to:Burp Suite ProfessionalAcunetix

View on GitHubWebsite
Stars
1,103
Forks
92
Open issues
12
Last commit
2 months ago

What is it?

Lonkero is a command-line web security scanner aimed at professional penetration testing. It groups its 125+ scanners by category, covering injection (XSS, SQLi, SSRF, command injection), authentication and authorization (JWT, OAuth, IDOR/BOLA), API security (GraphQL, gRPC, WebSocket), framework-specific checks, and configuration issues. A context-aware layer uses technology detection and per-parameter risk scoring to decide which tests to run, and falls back to a broader set of checks when detection fails.

The project also includes a Chrome/Edge companion extension that runs passive checks such as vulnerable JavaScript library detection and security header analysis while browsing, and can sync findings with the CLI. An experimental `lonkero ai` command lets an LLM (Claude API or a local Ollama model) drive targeted scanner runs through natural-language conversation. Reports can be exported as JSON, HTML, PDF, SARIF, CSV, XLSX, or Markdown.

The project is written in Rust and requires Rust 1.85 or newer. Its license is listed as proprietary rather than open source.

Key features

  • 01Scanner modules covering injection, authentication, API, framework, and configuration issues.
  • 02Context-aware filtering that adjusts tests to detected technology and per-parameter risk.
  • 03Proof-based reflected XSS detection that works over plain HTTP without a headless browser.
  • 04Chrome/Edge extension for passive checks and live sync with the CLI.
  • 05AI agent mode that runs targeted scans from natural-language instructions, with Claude or Ollama.
  • 06Report export in JSON, HTML, PDF, SARIF, CSV, XLSX, and Markdown.

Use cases

  • Running authorized web penetration tests against a target application.
  • Adding SARIF-based web security checks to a CI pipeline.
  • Checking a site for vulnerable front-end JavaScript libraries while browsing with the extension.
  • Running AI-assisted testing against sensitive targets with a local Ollama model.

Quick start

  1. 1

    Install Lonkero by following the Installation section of the README

  2. 2

    Run a scan against a target

    lonkero scan https://example.com

Things to know

  • The license is proprietary, not an open-source license.
  • The AI testing mode needs your own API key (e.g. Anthropic) or a local model such as Ollama.
  • Scans only target sites you are authorized to test, as it is built for professional penetration testing.

Topics

#web-security#pentesting#vulnerability-scanner#xss#sql-injection#api-security#rust#cli#appsec#cve-scanning

FAQ

What is lonkero?
Rust-based web application security scanner for penetration testers, with 125+ scanner modules, a browser extension, and an AI-driven testing mode. Lonkero is a command-line web security scanner aimed at professional penetration testing. It groups its 125+ scanners by category, covering injection (XSS, SQLi, SSRF, command injection), authentication and authorization (JWT, OAuth, IDOR/BOLA), API security (GraphQL, gRPC, WebSocket), framework-specific checks, and configuration issues. A context-aware layer uses technology detection and per-parameter risk scoring to decide which tests to run, and falls back to a broader set of checks when detection fails.
Is lonkero free to use? What license does it have?
lonkero is open source under the Other license. Check the license terms before using it in commercial products.
Is lonkero still maintained?
Updated within 6 months. The last commit to lonkero was on Aug 16, 2026.
What can I use lonkero for?
Running authorized web penetration tests against a target application. Adding SARIF-based web security checks to a CI pipeline. Checking a site for vulnerable front-end JavaScript libraries while browsing with the extension. Running AI-assisted testing against sensitive targets with a local Ollama model.
How do I install lonkero?
Install Lonkero by following the Installation section of the README Run a scan against a target: lonkero scan https://example.com
Where can I get lonkero?
The source code and installation instructions are on GitHub: https://github.com/bountyyfi/lonkero

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects