{"id":45051,"url":"https://github.com/0xapt/awesome-bbht","name":"awesome-bbht","description":"A bash script that will automatically install a list of bug hunting tools that I find interesting for recon, exploitation, etc. (minus burp) For Ubuntu/Debain.","projects_count":80,"last_synced_at":"2026-08-01T23:00:19.319Z","repository":{"id":37248258,"uuid":"235199821","full_name":"0xapt/awesome-bbht","owner":"0xapt","description":"A bash script that will automatically install a list of bug hunting tools that I find interesting for recon, exploitation, etc. (minus burp) For Ubuntu/Debain.","archived":false,"fork":false,"pushed_at":"2022-02-02T23:10:56.000Z","size":281,"stargazers_count":570,"open_issues_count":2,"forks_count":107,"subscribers_count":14,"default_branch":"master","last_synced_at":"2026-01-22T02:59:37.255Z","etag":null,"topics":["bug-bounty","bug-hunting","bugbounty","enumerate-subdomains","exploitation","hacking","hacking-tool","hacking-tools","penetration-testing","recon","reconnaissance","security-tools"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/0xapt.png","metadata":{},"created_at":"2020-01-20T21:10:45.000Z","updated_at":"2025-12-20T14:15:21.000Z","dependencies_parsed_at":"2022-08-08T20:00:31.647Z","dependency_job_id":null,"html_url":"https://github.com/0xapt/awesome-bbht","commit_stats":null,"previous_names":["subn0x/awesome-bbht","0xapt/awesome-bbht"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/0xapt/awesome-bbht","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xapt%2Fawesome-bbht","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xapt%2Fawesome-bbht/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xapt%2Fawesome-bbht/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xapt%2Fawesome-bbht/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/0xapt","download_url":"https://codeload.github.com/0xapt/awesome-bbht/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xapt%2Fawesome-bbht/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28917454,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-30T16:37:38.804Z","status":"ssl_error","status_checked_at":"2026-01-30T16:37:37.878Z","response_time":66,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"created_at":"2024-01-13T21:19:03.229Z","updated_at":"2026-08-01T23:00:19.324Z","primary_language":"Python","list_of_lists":false,"displayable":true,"categories":["Other","Content Discovery","Wordlists","Subdomain-enum","Frameworks","Exploitation","CMS","CloudFlare","Git"],"sub_categories":["XSS","Inspecting JS Files","SQLi","Crawlers","Directory Bruteforcers \u0026 Fuzzers","Digital Ocean","Google Cloud Storage","AWS S3 Bucket","Subdomain Takeover","XXE","CSRF","Command Injection","Code Audit","API"],"readme":"# awesome-bbht\nA bash script that will automatically install a list of bug hunting tools I sometimes use for recon, exploitation, etc. (minus burp.) (Contributions are always welcome.)\n\n## Install\n\n```sh\n\ngit clone https://github.com/0xApt/awesome-bbht.sh\ncd awesome-bbht\nchmod +x awesome-bbht.sh\nsudo ./awesome-bbht.sh\n```\n\nThe list of tools downloaded: \n\n\u003eawscli\n\n## Subdomain-enum\n\n- [aquatone](https://github.com/michenriksen/aquatone) - A Tool for Domain Flyovers\n\n- [knockpy](https://github.com/guelfoweb/knock) - Knockpy is a python tool designed to enumerate subdomains on a target domain through a wordlist.\n\n- [subbrute](https://github.com/TheRook/subbrute) - A DNS meta-query spider that enumerates DNS records, and subdomains.\n\n- [assetfinder](https://github.com/tomnomnom/assetfinder) - Find domains and subdomains related to a given domain\n\n- [domain-finder](https://raw.githubusercontent.com/gwen001/pentest-tools/master/domain-finder.py)\n\n- [rsdl](https://github.com/tismayil/rsdl) - Subdomain Scan with the Ping Method\n\n- [subDomainizer](https://github.com/nsonaniya2010/SubDomainizer) - A tool to find subdomains and interesting things hidden inside, external Javascript files of page, folder, and Github.\n\n- [domain_analyzer](https://github.com/eldraco/domain_analyzer) - Analyze the security of any domain by finding all the information possible. Made in python.\n\n- [massdns](https://github.com/blechschmidt/massdns) - A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)\n\n- [subfinder](https://github.com/subfinder/subfinder) - Subfinder is a subdomain discovery tool that discovers valid subdomains for websites. Designed as a passive framework to be useful for bug bounties and safe for penetration testing. \n\n- [amass](https://github.com/caffix/amass) - In-depth Attack Surface Mapping and Asset Discovery\n\n- [sub.sh](https://github.com/cihanmehmet/sub.sh) - Online Subdomain Detect Script\n\n- [sublist3r](https://github.com/aboul3la/Sublist3r) - Fast subdomains enumeration tool for penetration testers\n\n- [Sudomy](https://github.com/Screetsec/Sudomy) - Sudomy is a subdomain enumeration tool, created using a bash script, to analyze domains and collect subdomains in fast and comprehensive way . Report output in HTML or CSV format https://github.com/Screetsec/\n\n- [dnsenum](https://github.com/fwaeytens/dnsenum) - Multithreaded perl script to enumerate DNS information of a domain and to discover non-contiguous ip blocks.\n\n## Content Discovery\n\n### API\n\n- [secretx](https://github.com/xyele/secretx) - Extracting api keys and secrets by requesting each url in your list.\n\n\n### AWS S3 Bucket\n\n- [s3brute](https://github.com/ghostlulzhacks/s3brute) - s3 brute force tool \n\n- [s3-bucket-finder](https://github.com/gwen001/s3-buckets-finder) - Find aws s3 buckets and extract datas. \n\n- [bucket-stream](https://github.com/eth0izzle/bucket-stream) - Find interesting Amazon S3 Buckets by watching certificate transparency logs.\n\n- [slurp](https://github.com/nuncan/slurp) - Enumerate S3 buckets via certstream, domain, or keywords.\n\n- [lazys3](https://github.com/nahamsec/lazys3) - A Ruby script to bruteforce for AWS s3 buckets using different permutations.\n\n- [cred_scanner](https://github.com/disruptops/cred_scanner) - \nA simple file-based scanner to look for potential AWS access and secret keys in files\n\n- [DumpsterDiver](https://github.com/securing/DumpsterDiver) - A tool used to analyze big volumes of various file types in search of harcoded secrets like keys (AWS Access Key, Azuer Share Key or SSH keys) or passwords.\n\n- [S3Scanner](https://github.com/sa7mon/S3Scanner) - Scan for open AWS S3 buckets and dump the contents\n\n### Inspecting JS Files\n\n- [JSParser](https://github.com/nahamsec/JSParser) - A python 2.7 script using Tornado and JSBeautifier to parse relative URLs from JavaScript files. \n\n- [relative-url-extractor](https://github.com/jobertabma/relative-url-extractor) - A small tool that extracts relative URLs from a file.\n\n- [github-search](https://raw.githubusercontent.com/gwen001/github-search/master/github-subdomains.py)\n- [sub.js](https://github.com/lc/subjs) - A tool to get javascript files from a list of URLS or subdomains\n- [LinkFinder](https://github.com/GerbenJavado/LinkFinder) - A python script that finds endpoints in JavaScript files\n\n### Code Audit\n\n- [Cobra](https://github.com/WhaleShark-Team/cobra) - Source Code Security Audit (源代码安全审计)\n\n### Crawlers\n\n- [Crawler](https://github.com/ghostlulzhacks/crawler) - Crawl website extract links\n\n- [waybackMachine](https://github.com/ghostlulzhacks/waybackMachine) - Use wayback Machine data to pull a list of paths.\n\n- [meg](https://github.com/tomnomnom/meg) - Fetch many paths for many hosts - without killing the hosts\n\n- [hakrawler](https://github.com/hakluke/hakrawler) - Simple, fast web crawler designed for easy, quick discovery of endpoints and assets within a web application\n\n- [igoturls](https://github.com/xyele/igoturls) - WaybackURLS + OtxURLS + CommonCrawl\n\n### Directory Bruteforcers \u0026 Fuzzers\n\n- [gobuster](https://github.com/OJ/gobuster) - Directory/File, DNS and VHost busting tool written in Go\n\n- [ffuf](https://github.com/ffuf/ffuf) - Fast web fuzzer written in Go\n\n- [dirsearch](https://github.com/maurosoria/dirsearch) - Web path scanner\n\n## Exploitation\n\n### Subdomain Takeover\n\n- [subjack](https://github.com/haccer/subjack) - Subdomain Takeover tool written in Go\n\n- [subdomain-takeover](https://github.com/antichown/subdomain-takeover) - Subdomain Takeover Scanner | Subdomain Takeover Tool | by 0x94\n\n- [takeover](https://github.com/m4ll0k/takeover) - Sub-Domain TakeOver Vulnerability Scanner\n\n- [SubOver](https://github.com/Ice3man543/SubOver) - A Powerful Subdomain Takeover Tool \n\n\n### Google Cloud Storage\n\n- [GCPBucketBrute](https://github.com/RhinoSecurityLabs/GCPBucketBrute) - A script to enumerate Google Storage buckets, determine what access you have to them, and determine if they can be privilege escalated.\n\n### Digital Ocean\n\n- [spaces-finder](https://github.com/appsecco/spaces-finder) - A tool to hunt for publicly accessible DigitalOcean Spaces\n\n### XXE\n\n- [XXEinjector](https://github.com/enjoiz/XXEinjector) - Tool for automatic exploitation of XXE vulnerability using direct and different out of band methods.\n\n### CSRF\n\n- [XSRFProbe](https://github.com/0xInfection/XSRFProbe) - The Prime Cross Site Request Forgery (CSRF) Audit and Exploitation Toolkit.\n\n### Command Injection\n\n- [commix](https://github.com/commixproject/commix) - Automated All-in-One OS command injection and exploitation tool. https://commixproject.com\n\n\n### SQLi\n\n- [sqlmap](https://github.com/sqlmapproject/sqlmap) - Automatic SQL injection and database takeover tool http://sqlmap.org\n\n- [sqliv](https://github.com/the-robot/sqliv) - massive SQL injection vulnerability scanner\n\n- [sqlmate](https://github.com/s0md3v/sqlmate) - A friend of SQLmap which will do what you always expected from SQLmap.\n\n### XSS\n\n- [XSStrike](https://github.com/s0md3v/XSStrike) - Most advanced XSS scanner.\n\n- [XSS-keylogger](https://github.com/hadynz/xss-keylogger) - A keystroke logger to exploit XSS vulnerabilities in a site - for my personal Educational purposes only\n\n\n## CMS\n\n- [CMSmap](https://github.com/Dionach/CMSmap) - CMSmap is a python open source CMS scanner that automates the process of detecting security flaws of the most popular CMSs.\n\n- [CMSeeK](https://github.com/Tuhinshubhra/CMSeeK) - CMS Detection and Exploitation suite - Scan WordPress, Joomla, Drupal and over 170 other CMSs\n\n- [wpscan](https://github.com/wpscanteam/wpscan) - WPScan is a free, for non-commercial use, black box WordPress Vulnerability Scanner written for security professionals and blog maintainers to test the security of their WordPress websites\n\n- [Joomscan](https://github.com/rezasp/joomscan) - OWASP Joomla Vulnerability Scanner Project\n\n- [Droopescan](https://github.com/droope/droopescan) - \nA plugin-based scanner that aids security researchers in identifying issues with several CMSs, mainly Drupal \u0026 Silverstripe.\n\n- [Drupwn](https://github.com/immunIT/drupwn) - Drupal enumeration \u0026 exploitation tool\n\n## CloudFlare\n\n- [CloudFail](https://github.com/m0rtem/CloudFail) - Utilize misconfigured DNS and old database records to find hidden IP's behind the CloudFlare network \n\n## Git\n\n- [truffleHog](https://github.com/dxa4481/truffleHog.git) - Searches through git repositories for high entropy strings and secrets, digging deep into commit history \n\n- [git-dumper](https://github.com/arthaud/git-dumper) - A tool to dump a git repository from a website \n\n## Frameworks\n\n- [Sn1per](https://github.com/1N3/Sn1per) - Automated pentest framework for offensive security experts\n\n- [XRay](https://github.com/evilsocket/xray) - XRay is a tool for recon, mapping and OSINT gathering from public networks.\n\n- [datasploit](https://github.com/DataSploit/datasploit) - An #OSINT Framework to perform various recon techniques on Companies, People, Phone Number, Bitcoin Addresses, etc., aggregate all the raw data, and give data in multiple formats.\n\n- [Osmedeus](https://github.com/j3ssie/Osmedeus) - Fully automated offensive security framework for reconnaissance and vulnerability scanning\n\n- [TIDoS-Framework](https://github.com/0xinfection/tidos-framework) - The Offensive Manual Web Application Penetration Testing Framework.\n\n- [discover](https://github.com/leebaird/discover) - Custom bash scripts used to automate various penetration testing tasks including recon, scanning, parsing, and creating malicious payloads and listeners with Metasploit.\n\n- [lazyrecon](https://github.com/nahamsec/lazyrecon) - This script is intended to automate your reconnaissance process in an organized fashion\n\n- [003Recon](https://github.com/003random/003Recon) - Some tools to automate recon - 003random \n\n- [LazyRecon](https://github.com/capt-meelo/LazyRecon) - An automated approach to performing recon for bug bounty hunting and penetration testing.\n\n- [Vulmap](https://github.com/zhzyker/vulmap) - Vulmap is a web vulnerability scanning and verification tool that can scan webapps for vulnerabilities and has a vulnerability verification function \n\n\n## Wordlists\n\n- [SecLists](https://github.com/danielmiessler/SecLists) - SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.\n\n- [Jhaddix Wordlist](https://gist.githubusercontent.com/jhaddix/b80ea67d85c13206125806f0828f4d10/raw/c81a34fe84731430741e0463eb6076129c20c4c0/content_discovery_all.txt)\n\n- [Nahamsec list](https://gist.githubusercontent.com/Leoid/38984017886cd058a314dfda5c3d6c6e/raw/1ee5fe1da82a3ae92b0c486f86fbe26bbdff1e06/Nahamsec%2520Thread)\n\n## Other\n\n- [altdns](https://github.com/infosec-au/altdns) - Generates permutations, alterations and mutations of subdomains and then resolves them\n\n- [nmap](https://nmap.org/) - network mapper\n\n- [Blazy](https://github.com/s0md3v/Blazy) - Blazy is a modern login bruteforcer which also tests for CSRF, Clickjacking, Cloudflare and WAF. \n\n- [httprobe](https://github.com/tomnomnom/httprobe) - \nTake a list of domains and probe for working HTTP and HTTPS servers\n\n- [broken-link-checker](https://github.com/stevenvachon/broken-link-checker) - \nFind broken links, missing images, etc within your HTML.\n\n- [wafw00f](https://github.com/EnableSecurity/wafw00f) - WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website. \n\n\n\n\n","projects_url":"https://awesome.ecosyste.ms/api/v1/lists/0xapt%2Fawesome-bbht/projects"}