{"id":13840808,"url":"https://github.com/dzonerzy/goWAPT","last_synced_at":"2025-07-11T09:33:35.867Z","repository":{"id":57536233,"uuid":"113224577","full_name":"dzonerzy/goWAPT","owner":"dzonerzy","description":"Go Web Application Penetration Test","archived":false,"fork":false,"pushed_at":"2024-09-11T23:13:35.000Z","size":4689,"stargazers_count":340,"open_issues_count":3,"forks_count":61,"subscribers_count":16,"default_branch":"master","last_synced_at":"2024-09-12T09:27:53.779Z","etag":null,"topics":["fuzzer","hack","injection","scan-fuzzing","sql","tool","vulnerability","wapt","wfuzz","wordlist","xss"],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/dzonerzy.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2017-12-05T19:32:43.000Z","updated_at":"2024-09-11T23:13:41.000Z","dependencies_parsed_at":"2022-08-29T00:41:36.507Z","dependency_job_id":null,"html_url":"https://github.com/dzonerzy/goWAPT","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dzonerzy%2FgoWAPT","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dzonerzy%2FgoWAPT/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dzonerzy%2FgoWAPT/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dzonerzy%2FgoWAPT/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/dzonerzy","download_url":"https://codeload.github.com/dzonerzy/goWAPT/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225712737,"owners_count":17512470,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["fuzzer","hack","injection","scan-fuzzing","sql","tool","vulnerability","wapt","wfuzz","wordlist","xss"],"created_at":"2024-08-04T17:00:56.615Z","updated_at":"2024-11-21T10:30:48.548Z","avatar_url":"https://github.com/dzonerzy.png","language":"Go","funding_links":[],"categories":["Go","Go (531)"],"sub_categories":[],"readme":"# GOWAPT - Go Web Application Penetration Test\n\nGOWAPT is the younger brother of [wfuzz](https://github.com/xmendez/wfuzz) a swiss army knife of WAPT, it allow pentester to perform huge activity with no stress at all, just configure it and it's just a matter of clicks.\n\n## How to install\n\nTo install `gowapt` just type:\n```bash\nmake\nsudo make install\n```\n\n## Usage\n\nFrom the `-h` menu\n\n```\nUsage of gowapt:\n  -H value\n    \tA list of additional headers\n  -a string\n    \tBasic authentication (user:password)\n  -c string\n    \tA list of cookies\n  -d string\n    \tPOST data for request\n  -e string\n    \tA list of comma separated encoders (default \"plain\")\n  -f string\n    \tFilter the results\n  -from-proxy\n    \tGet the request via a proxy server\n  -fuzz\n    \tUse the built-in fuzzer\n  -p string\n    \tUse upstream proxy\n  -plugin-dir string\n    \tDirectory containing all scanning module\n  -scanner\n    \tRun in scanning mode\n  -ssl\n    \tUse SSL\n  -t string\n    \tTemplate for request\n  -threads int\n    \tNumber of threads (default 10)\n  -u string\n    \tURL to fuzz\n  -w string\n    \tWordlist file\n  -x string\n    \tExtension file example.js\n```\n\n**Examples**\n\nScan http://www.example.com and filter all `200 OK` requests\n\n\tgowapt -u \"http://www.example.com/FUZZ\" -w wordlist/general/common.txt -f \"code == 200\"\n\nScan http://www.example.com fuzzing `vuln` GET parameter looking for XSS (assume it had 200 tag with a legit request)\n\n\tgowapt -u \"http://www.example.com/?vuln=FUZZ\" -w wordlist/Injections/XSS.txt -f \"tags \u003e 200\"\n\nScan http://www.example.com fuzzing `vuln` POST parameter looking for XSS (assume it had 200 tag with a legit request)\n\n\tgowapt -u \"http://www.example.com/\" -d \"vuln=FUZZ\" -w wordlist/Injections/XSS.txt -f \"tags \u003e 200\"\n\nScan auth protected http://www.example.com and filter all `200 OK` requests\n\n\tgowapt -u \"http://www.example.com/FUZZ\" -w wordlist/general/common.txt -f \"code == 200\" -a \"user:password\"\n\nScan http://www.example.com adding header `Hello: world` and filter all `200 OK` requests\n\n\tgowapt -u \"http://www.example.com/FUZZ\" -w wordlist/general/common.txt -f \"code == 200\" -H \"Hello: world\"\n\nScan http://www.example.com using basic auth with user/pass `guest:guest`\n\n\tgowapt -u \"http://www.example.com/FUZZ\" -w wordlist/general/common.txt -a \"guest:guest\"\n\nScan http://www.example.com adding an extension\n\n\tgowapt -u \"http://www.example.com/FUZZ\" -w wordlist/general/common.txt -x myextension.js\n\nScan http://www.example.com through a proxy (like Burp):\n\n\tgowapt -p \"http://localhost:8080\" -u \"http://www.example.com/FUZZ\" -w wordlist/general/common.txt\n\t\nScan http://www.example.com (received from proxy) and filter all `200 OK` requests\n\n\tgowapt --from-proxy -w wordlist/general/common.txt\n\t\nRun scanner mode on http://www.example.com (received from proxy) with default plugins\n\n\tgowapt --from-proxy --scanner --plugin-dir plugin/\n\n\nThen open BurpSuite send the request you want to fuzz to repeater and set an upstream proxy to 127.0.0.1:31337\nwhen you're ready click send, if everything was right you should see as response `Request received by GOWAPT`\n\n## Extension\n\nExtension are an easy way to extend gowapt features, a JavaScript VM is the responsible for loading and executing extension files.\n\n### JS Api\n\nBelow a list of currently implemented API\n\n|       Method       \t| Number of params \t|                              Description                             \t|                                                            Params                                                            \t|\n|:------------------:\t|:----------------:\t|:--------------------------------------------------------------------:\t|:----------------------------------------------------------------------------------------------------------------------------:\t|\n| addCustomEncoder   \t| 2                \t| Create a custom encoder to be used with wordlists                    \t| Param1 -\u003e EncoderName (string)\u003cbr\u003eParam2 -\u003e EncoderLogic (function)                                                          \t|\n| panic              \t| 1                \t| For debugging purpose crash the application                          \t| Param1 -\u003e PanicText (string)                                                                                                 \t|\n| dumpResponse       \t| 2                \t| Dump a full request/response to disk, useful to save testcase        \t| Param1 -\u003e ResponseObject (http.Response)\u003cbr\u003eParam2 -\u003e Path (string)                                                          \t|\n| setHTTPInterceptor \t| 1                \t| Create an interceptor for outgoing HTTP Request and ingoing responses \t| Param1 -\u003e HTTPCallback (function) *                                                                                          \t|\n| sendRequestSync *    \t| 4                \t|  Send an HTTP Request in a synchronous way                           \t| Param1 -\u003e Method (string)\u003cbr\u003eParam2 -\u003e Url (string)\u003cbr\u003eParam3 -\u003e PostData (string)\u003cbr\u003eParam4 -\u003e Headers (Object{Name:Value}) \t|\n\n**\\*** **PS: When using \u003cu\u003esetHTTPInterceptor\u003c/u\u003e the callback method receive 3 parameters:**\n\n- A request/response object\n- A result object\n- A flag object that indicate whenever the first object is a request or a response\n\n**Since the nature of sendRequestSync it will slow down the engine due to synchronous request so use moderately**\n\nMore info on the example extension below:\n\n**example.js**\n\n```js\n/*\n* Create a custom encoder called helloworld\n*\n* This encore just add the string \"_helloworld\" to every payload\n* coming from the wordlist\n*/\naddCustomEncoder(\"helloworld\", myenc);\n/*\n* Define the callback method for the helloworld encoder\n*/\nfunction myenc(data) {\n\treturn data + \"_helloword\";\n}\n/*\n* Create an HTTP interceptor\n*\n* The interceptor will hook every request / response\n* is possible to modify request before send it, anyway the respose item\n* it's just shadow copy of the one received from the server so no modification\n* are possible\n*\n*\n* request_response is an object which may contains both http.Request\n* or http.Response , to know which on is contained check is_request flag\n*\n* REMEMBER! request_response is an http.* object so you must interact with\n* this one just like you would do in golang!\n*\n* dumpResponse is a built-in function which dump full request-response to\n* disk.\n* result is an object filled with stats about the response it contains some fields\n*\n* result.tags =\u003e Number of tags in the response\n* result.code =\u003e HTTP Response status\n* result.words =\u003e Number of words in the response\n* result.lines =\u003e Number of lines in the response\n* result.chars =\u003e Number of chars in the response\n* result.request =\u003e Full dump of the request\n* result.response =\u003e Full dump of the response\n* result.response =\u003e The injected payload\n*\n*/\nsetHTTPInterceptor(function(request_response, result, is_request){\n\tif(is_request){\n\t\trequest_response.Header.Set(\"Hello\", \"world\")\n\t}else{\n\t\tdumpResponse(request_response, \"/tmp/dump.txt\")\n\t\t/*\n\t\t* Send an HTTP request in a synchronous way\n\t\t*\n\t\t* This API accept 4 parameters:\n\t\t* method =\u003e GET | POST | HEAD | PUT | PATCH | UPDATE\n\t\t* url =\u003e The url of the HTTP service\n\t\t* post_data =\u003e The content of request bodyBytes\n\t\t* headers =\u003e A javascript dictionary {headerName =\u003e headerValue}\n\t\t*\n\t\t* The response object may be null or undefined or an http.Response from golang\n\t\t*/\n\t\tvar response = sendRequestSync(\"GET\", \"http://example.com/\", null, {\"Fake\": \"Header\"})\n\t}\n})\n```\n\n## Scanner\nA new mode called `Scanner` was introduced with the latest commit , it allow user to create fully customizable plugins in order to perform active web scanning for more info read the Wiki!.\n\n## Wordlists\n\nWordlists comes from [wfuzz](https://github.com/xmendez/wfuzz) project! so thanks much guys!\n\n## Look\u0026Feel\n\n[![asciicast](https://asciinema.org/a/151130.png)](https://asciinema.org/a/151130)\n\n## Encoders\n\nBelow the list of encoders available\n\n- **url** (URL encode)\n- **urlurl** (Double URL encode)\n- **html** (HTML encode)\n- **htmlhex** (HTML hex encode)\n- **unicode** (Unicode encode)\n- **hex** (Hex encode)\n- **md5hash** (MD5 hash)\n- **sha1hash** (SHA1 hash)\n- **sha2hash** (SHA2 hash)\n- **b64** (Base64 encode)\n- **b32** (Base32 encode)\n- **plain** (No encoding)\n\n## Filters\n\nYou can apply filters on the following variables\n\n- **tags** (Number of tags)\n- **lines** (Number of lines of response body)\n- **words** (Number of words of response body)\n- **length** (Size of response body)\n- **code** (HTTP status code)\n- **chars** (Number of chars of response body)\n\n## License\n\n`gowapt` is released under the GPL 3.0 license and it's copyleft of Daniele 'dzonerzy' Linguaglossa\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdzonerzy%2FgoWAPT","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdzonerzy%2FgoWAPT","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdzonerzy%2FgoWAPT/lists"}