WebHackersWeapons
⚔️ Web Hacker's Weapons / A collection of cool tools used by Web hackers. Happy hacking , Happy bug-hunting
https://github.com/hahwul/WebHackersWeapons
Last synced: about 8 hours ago
JSON representation
-
Family project
-
Weapons
-
Browser Addons
- Wayback Machine
- MM3 ProxySwitch
- Dark Reader for Safari
- User-Agent Switcher - agents.||||
- DotGit
- DOMLogger++ - mizu/domloggerpp?label=%20)|[`dom`](/categorize/tags/dom.md) [`xss`](/categorize/tags/xss.md)|[](/categorize/langs/JavaScript.md)|
- cookie-quick-manager - quick-manager?label=%20)|[`cookie`](/categorize/tags/cookie.md)|[](/categorize/langs/JavaScript.md)|
- firefox-container-proxy - container-proxy?label=%20)||[](/categorize/langs/JavaScript.md)|
- ZAP Browser Extension - extension/?label=%20)|[`browser-record`](/categorize/tags/browser-record.md)|[](/categorize/langs/TypeScript.md)|
- postMessage-tracker - icon||[`js-analysis`](/categorize/tags/js-analysis.md)|[](/categorize/langs/JavaScript.md)|
- Edit-This-Cookie - This-Cookie?label=%20)|[`cookie`](/categorize/tags/cookie.md)|[](/categorize/langs/JavaScript.md)|
- clear-cache - on to clear browser cache with a single click or via the F9 key.|||[](/categorize/langs/JavaScript.md)|
- eval_villain
- Dark Reader
- PwnFox
- jsonwebtoken.github.io
- Firefox Multi-Account Containers - Account Containers lets you keep parts of your online life separated into color-coded tabs|||[](/categorize/langs/JavaScript.md)|
- Hack-Tools - in-one Red Team extension for Web Pentester 🛠|||[](/categorize/langs/TypeScript.md)|
- rep - powered security analysis||[`http`](/categorize/tags/http.md) [`repeater`](/categorize/tags/repeater.md)|[](/categorize/langs/JavaScript.md)|
-
Burpsuite, Caido and ZAP Addons
- BurpSuite-Secret_Finder - Secret_Finder?label=%20)|||
- Dr. Watson - Watson?label=%20)|[`param`](/categorize/tags/param.md) [`subdomains`](/categorize/tags/subdomains.md)|[](/categorize/langs/Python.md)|
- HUNT
- attack-surface-detector-burp - surface-detector-burp?label=%20)|[`endpoint`](/categorize/tags/endpoint.md) [`url`](/categorize/tags/url.md) [`attack-surface`](/categorize/tags/attack-surface.md)|[](/categorize/langs/Java.md)|
- BurpJSLinkFinder - analysis`](/categorize/tags/js-analysis.md)|[](/categorize/langs/Python.md)|
- reflected-parameters - parameters?label=%20)|[`param`](/categorize/tags/param.md)|[](/categorize/langs/Java.md)|
- attack-surface-detector-zap - surface-detector-zap?label=%20)|[`endpoint`](/categorize/tags/endpoint.md) [`url`](/categorize/tags/url.md) [`attack-surface`](/categorize/tags/attack-surface.md)|[](/categorize/langs/Java.md)|
- burp-retire-js - retire-js?label=%20)|[`js-analysis`](/categorize/tags/js-analysis.md)|[](/categorize/langs/JavaScript.md)|
- param-miner - miner?label=%20)|[`param`](/categorize/tags/param.md) [`cache-vuln`](/categorize/tags/cache-vuln.md)|[](/categorize/langs/Java.md)|
- GAP - h4ck3r/GAP-Burp-Extension?label=%20)|[`param`](/categorize/tags/param.md)|[](/categorize/langs/Python.md)|
- AuthMatrix
- Autorize
- http-request-smuggler - request-smuggler?label=%20)|[`smuggle`](/categorize/tags/smuggle.md)|[](/categorize/langs/Java.md)|
- collaborator-everywhere - everywhere?label=%20)|[`oast`](/categorize/tags/oast.md)|[](/categorize/langs/Java.md)|
- BurpSuiteHTTPSmuggler
- csp-auditor - auditor?label=%20)|[`csp`](/categorize/tags/csp.md)|[](/categorize/langs/Java.md)|
- argumentinjectionhammer
- taborator
- zap-hud - hud?label=%20)||[](/categorize/langs/Java.md)|
- blackboxprotobuf
- Map Local - on which allows mapping of responses to content of a chosen local file.|||[](/categorize/langs/Java.md)|
- EvenBetter
- notebook - community/notebook?label=%20)|[`note`](/categorize/tags/note.md)|[](/categorize/langs/TypeScript.md)|
- safecopy
- Decoder-Improved - Improved?label=%20)||[](/categorize/langs/Java.md)|
- CaidoReflector
- burp-send-to - send-to?label=%20)||[](/categorize/langs/Java.md)|
- BurpCustomizer
- HTTPSignatures - ietf-httpbis-message-signatures-01 draft.|||[](/categorize/langs/Java.md)|
- reflect
- EvenBetterExtensions
- caidope - caido plugin|||[](/categorize/langs/TypeScript.md)|
- burp-piper - piper?label=%20)||[](/categorize/langs/Kotlin.md)|
- Berserko
- community-scripts - scripts?label=%20)||[](/categorize/langs/JavaScript.md)|
- turbo-intruder - intruder?label=%20)||[](/categorize/langs/Kotlin.md)|
- gRPC-Web Pentest Suite - Pentest-Suite is set of tools for pentesting / hacking gRPC Web (gRPC-Web) applications.||[`gRPC-Web`](/categorize/tags/gRPC-Web.md)|[](/categorize/langs/Python.md)|
- burp-exporter - exporter?label=%20)||[](/categorize/langs/Python.md)|
- Stepper
- AWSSigner
- Web3 Decoder - decoder?label=%20)|[`web3`](/categorize/tags/web3.md)|[](/categorize/langs/Java.md)|
- pcap-burp - burp?label=%20)||[](/categorize/langs/Java.md)|
- inql
- knife
- femida - i-was/femida?label=%20)||[](/categorize/langs/Python.md)|
- http-script-generator - script-generator?label=%20)||[](/categorize/langs/Java.md)|
- Neonmarker
- BurpBounty
- owasp-zap-jwt-addon - zap-jwt-addon?label=%20)|[`jwt`](/categorize/tags/jwt.md)|[](/categorize/langs/Java.md)|
- BurpSuiteLoggerPlusPlus
-
Tools
- BurpSuite - audit`](/categorize/tags/live-audit.md) [`crawl`](/categorize/tags/crawl.md)|[](/categorize/langs/Java.md)|
- Caido
- Echo Mirage
- Shodan - connected devices||[`osint`](/categorize/tags/osint.md)||
- SecurityTrails
- axiom
- jaeles - project/jaeles?label=%20)|[`live-audit`](/categorize/tags/live-audit.md)|[](/categorize/langs/Go.md)|
- Metasploit - framework?label=%20)|[`pentest`](/categorize/tags/pentest.md)|[](/categorize/langs/Ruby.md)|
- ZAP - audit`](/categorize/tags/live-audit.md) [`crawl`](/categorize/tags/crawl.md)|[](/categorize/langs/Java.md)|
- proxify
- hetty
- Glorp - based HTTP intercept and replay proxy||[`mitmproxy`](/categorize/tags/mitmproxy.md)|[](/categorize/langs/Go.md)|
- mitmproxy - capable intercepting HTTP proxy for penetration testers and software developers.||[`mitmproxy`](/categorize/tags/mitmproxy.md)|[](/categorize/langs/Python.md)|
- EvilProxy - proxy?label=%20)|[`mitmproxy`](/categorize/tags/mitmproxy.md)|[](/categorize/langs/Ruby.md)|
- knock
- meg - without killing the hosts |||[](/categorize/langs/Go.md)|
- xnLinkFinder - h4ck3r/xnLinkFinder?label=%20)|[`js-analysis`](/categorize/tags/js-analysis.md)|[](/categorize/langs/Python.md)|
- dnsprobe
- noir - cr/noir?label=%20)|[`endpoint`](/categorize/tags/endpoint.md) [`url`](/categorize/tags/url.md) [`attack-surface`](/categorize/tags/attack-surface.md)|[](/categorize/langs/Crystal.md)|
- gowitness - a golang, web screenshot utility using Chrome Headless |||[](/categorize/langs/Go.md)|
- recon_profile
- hakrawler
- htcat
- subfinder
- Silver
- Smap - in replacement for Nmap powered by shodan.io||[`port`](/categorize/tags/port.md)|[](/categorize/langs/Go.md)|
- graphw00f
- JSFScan.sh - analysis`](/categorize/tags/js-analysis.md)|[](/categorize/langs/Shell.md)|
- gau
- ParamSpider
- subgen - to pipe into your favourite resolver!||[`subdomains`](/categorize/tags/subdomains.md)|[](/categorize/langs/Go.md)|
- Sub404 - pr0xy/sub404?label=%20)|[`subdomains`](/categorize/tags/subdomains.md) [`takeover`](/categorize/tags/takeover.md)|[](/categorize/langs/Go.md)|
- gobuster
- fhc
- aquatone
- shosubgo
- haktrails
- intrigue-core - core?label=%20)||[](/categorize/langs/Ruby.md)|
- github-endpoints - endpoints?label=%20)||[](/categorize/langs/Go.md)|
- goverview - Get an overview of the list of URLs||[`url`](/categorize/tags/url.md)|[](/categorize/langs/Go.md)|
- assetfinder
- waybackurls
- cc.py
- shuffledns - output support. ||[`dns`](/categorize/tags/dns.md)|[](/categorize/langs/Go.md)|
- getJS - analysis`](/categorize/tags/js-analysis.md)|[](/categorize/langs/Go.md)|
- subs_all
- csprecon
- puredns
- jsluice - analysis`](/categorize/tags/js-analysis.md)|[](/categorize/langs/Go.md)|
- cariddi
- subjack
- Photon
- dirsearch
- bbot
- parameth - /parameth?label=%20)||[](/categorize/langs/Python.md)|
- spiderfoot
- zdns
- SubOver
- lazyrecon
- katana - generation crawling and spidering framework.||[`crawl`](/categorize/tags/crawl.md)|[](/categorize/langs/Go.md)|
- dnsx - purpose DNS toolkit allow to run multiple DNS queries of your choice with a list of user-supplied resolvers.||[`dns`](/categorize/tags/dns.md)|[](/categorize/langs/Go.md)|
- gauplus
- BLUTO
- HostHunter
- BugBountyScanner
- gitrob
- rengine
- HydraRecon
- SubBrute
- rusolver
- apkleaks
- longtongue
- reconftw
- masscan
- chaos-client - client?label=%20)||[](/categorize/langs/Go.md)|
- megplus
- Hunt3r
- subjs
- dnsvalidator
- github-subdomains - subdomains?label=%20)|[`subdomains`](/categorize/tags/subdomains.md)|[](/categorize/langs/Go.md)|
- crawlergo
- favirecon
- GitMiner
- hakrevdns
- LinkFinder - analysis`](/categorize/tags/js-analysis.md)|[](/categorize/langs/Python.md)|
- Osmedeus
- FavFreak
- STEWS
- naabu
- dmut
- OneForAll
- x8
- urlhunter
- sn0int - automatic OSINT framework and package manager||[`osint`](/categorize/tags/osint.md)|[](/categorize/langs/Rust.md)|
- CT_subdomains
- scilla
- 3klCon
- uncover
- Lepus
- Arjun
- go-dork - dork?label=%20)||[](/categorize/langs/Go.md)|
- subzy
- pagodo - Automate Google Hacking Database scraping and searching|||[](/categorize/langs/Python.md)|
- Sudomy
- gospider - Fast web spider written in Go ||[`crawl`](/categorize/tags/crawl.md)|[](/categorize/langs/Go.md)|
- httpx - purpose HTTP toolkit allow to run multiple probers using retryablehttp library, it is designed to maintain the result reliability with increased threads. ||[`url`](/categorize/tags/url.md)|[](/categorize/langs/Go.md)|
- SecretFinder - A python script for find sensitive data (apikeys, accesstoken,jwt,..) and search anything on javascript files |||[](/categorize/langs/Python.md)|
- altdns - au/altdns?label=%20)|[`dns`](/categorize/tags/dns.md) [`subdomains`](/categorize/tags/subdomains.md)|[](/categorize/langs/Python.md)|
- Parth
- uro
- feroxbuster
- BatchQL
- jwt-cracker - cracker?label=%20)|[`jwt`](/categorize/tags/jwt.md)|[](/categorize/langs/JavaScript.md)|
- GraphQLmap
- CrackQL - force and fuzzing utility.||[`graphql`](/categorize/tags/graphql.md)|[](/categorize/langs/Python.md)|
- medusa
- crlfuzz
- c-jwt-cracker - rius/c-jwt-cracker?label=%20)|[`jwt`](/categorize/tags/jwt.md)|[](/categorize/langs/C.md)|
- jwt-hack - hack is tool for hacking / security testing to JWT. Supported for En/decoding JWT, Generate payload for JWT attack and very fast cracking(dict/brutefoce)||[`jwt`](/categorize/tags/jwt.md)|[](/categorize/langs/Go.md)|
- ffuf
- BruteX
- SmuggleFuzz
- SSRFire
- fuzzparam
- headerpwn
- ParamPamPam - vuln`](/categorize/tags/cache-vuln.md)|[](/categorize/langs/Python.md)|
- dotdotpwn - The Directory Traversal Fuzzer ||[`path-traversal`](/categorize/tags/path-traversal.md)|[](/categorize/langs/Perl.md)|
- kiterunner
- ppfuzz - side prototype pollution vulnerability written in Rust. 🦀||[`prototypepollution`](/categorize/tags/prototypepollution.md) [`prototype-pollution`](/categorize/tags/prototype-pollution.md)|[](/categorize/langs/Rust.md)|
-
Programming Languages
Categories
Sub Categories
Keywords
bugbounty
91
security
78
pentesting
54
security-tools
43
hacking
42
golang
37
penetration-testing
35
recon
27
osint
27
scanner
26
reconnaissance
25
go
24
python
23
pentest
22
infosec
21
bug-bounty
18
xss
17
cli
17
vulnerability
14
pentest-tool
14
bugbounty-tool
14
http
14
vulnerability-scanner
12
enumeration
12
information-gathering
12
security-scanner
11
subdomain
11
javascript
11
hacking-tool
11
vulnerability-scanners
11
tool
10
burpsuite
10
crawler
10
web
10
dns
10
security-audit
9
bugbountytips
8
appsec
8
owasp
7
vulnerability-detection
7
graphql
7
pentesting-tools
7
burp-extensions
7
offensive-security
7
nmap
7
rust
7
nuclei
6
exploitation
6
websocket
6
subdomain-takeover
6