Family project

• ![WebHackersWeapons
• ![MobileHackersWeapons

Weapons

Browser Addons

• Wayback Machine
• MM3 ProxySwitch
• Dark Reader for Safari
• User-Agent Switcher - agents.||||
• DotGit
• DOMLogger++ - mizu/domloggerpp?label=%20)|dom xss||
• cookie-quick-manager - quick-manager?label=%20)|cookie||
• firefox-container-proxy - container-proxy?label=%20)|||
• ZAP Browser Extension - extension/?label=%20)|browser-record||
• postMessage-tracker - icon||js-analysis||
• Edit-This-Cookie - This-Cookie?label=%20)|cookie||
• clear-cache - on to clear browser cache with a single click or via the F9 key.||||
• eval_villain
• Dark Reader
• PwnFox
• jsonwebtoken.github.io
• Firefox Multi-Account Containers - Account Containers lets you keep parts of your online life separated into color-coded tabs||||
• Hack-Tools - in-one Red Team extension for Web Pentester 🛠||||
• rep - powered security analysis||http repeater||

Burpsuite, Caido and ZAP Addons

• BurpSuite-Secret_Finder - Secret_Finder?label=%20)|||
• Dr. Watson - Watson?label=%20)|param subdomains||
• HUNT
• attack-surface-detector-burp - surface-detector-burp?label=%20)|endpoint url attack-surface||
• BurpJSLinkFinder - analysis`](/categorize/tags/js-analysis.md)||
• reflected-parameters - parameters?label=%20)|param||
• attack-surface-detector-zap - surface-detector-zap?label=%20)|endpoint url attack-surface||
• burp-retire-js - retire-js?label=%20)|js-analysis||
• param-miner - miner?label=%20)|param cache-vuln||
• GAP - h4ck3r/GAP-Burp-Extension?label=%20)|param||
• AuthMatrix
• Autorize
• http-request-smuggler - request-smuggler?label=%20)|smuggle||
• collaborator-everywhere - everywhere?label=%20)|oast||
• BurpSuiteHTTPSmuggler
• csp-auditor - auditor?label=%20)|csp||
• argumentinjectionhammer
• taborator
• zap-hud - hud?label=%20)|||
• blackboxprotobuf
• Map Local - on which allows mapping of responses to content of a chosen local file.||||
• EvenBetter
• notebook - community/notebook?label=%20)|note||
• safecopy
• Decoder-Improved - Improved?label=%20)|||
• CaidoReflector
• burp-send-to - send-to?label=%20)|||
• BurpCustomizer
• HTTPSignatures - ietf-httpbis-message-signatures-01 draft.||||
• reflect
• EvenBetterExtensions
• caidope - caido plugin||||
• burp-piper - piper?label=%20)|||
• Berserko
• community-scripts - scripts?label=%20)|||
• turbo-intruder - intruder?label=%20)|||
• gRPC-Web Pentest Suite - Pentest-Suite is set of tools for pentesting / hacking gRPC Web (gRPC-Web) applications.||gRPC-Web||
• burp-exporter - exporter?label=%20)|||
• Stepper
• AWSSigner
• Web3 Decoder - decoder?label=%20)|web3||
• pcap-burp - burp?label=%20)|||
• inql
• knife
• femida - i-was/femida?label=%20)|||
• http-script-generator - script-generator?label=%20)|||
• Neonmarker
• BurpBounty
• owasp-zap-jwt-addon - zap-jwt-addon?label=%20)|jwt||
• BurpSuiteLoggerPlusPlus

Tools

• BurpSuite - audit](/categorize/tags/live-audit.md) [crawl`](/categorize/tags/crawl.md)||
• Caido
• Echo Mirage
• Shodan - connected devices||osint||
• SecurityTrails
• axiom
• jaeles - project/jaeles?label=%20)|live-audit||
• Metasploit - framework?label=%20)|pentest||
• ZAP - audit](/categorize/tags/live-audit.md) [crawl`](/categorize/tags/crawl.md)||
• proxify
• hetty
• Glorp - based HTTP intercept and replay proxy||mitmproxy||
• mitmproxy - capable intercepting HTTP proxy for penetration testers and software developers.||mitmproxy||
• EvilProxy - proxy?label=%20)|mitmproxy||
• knock
• meg - without killing the hosts ||||
• xnLinkFinder - h4ck3r/xnLinkFinder?label=%20)|js-analysis||
• dnsprobe
• noir - cr/noir?label=%20)|endpoint url attack-surface||
• gowitness - a golang, web screenshot utility using Chrome Headless ||||
• recon_profile
• hakrawler
• htcat
• subfinder
• Silver
• Smap - in replacement for Nmap powered by shodan.io||port||
• graphw00f
• JSFScan.sh - analysis`](/categorize/tags/js-analysis.md)||
• gau
• ParamSpider
• subgen - to pipe into your favourite resolver!||subdomains||
• Sub404 - pr0xy/sub404?label=%20)|subdomains takeover||
• gobuster
• fhc
• aquatone
• shosubgo
• haktrails
• intrigue-core - core?label=%20)|||
• github-endpoints - endpoints?label=%20)|||
• goverview - Get an overview of the list of URLs||url||
• assetfinder
• waybackurls
• cc.py
• shuffledns - output support. ||dns||
• getJS - analysis`](/categorize/tags/js-analysis.md)||
• subs_all
• csprecon
• puredns
• jsluice - analysis`](/categorize/tags/js-analysis.md)||
• cariddi
• subjack
• Photon
• dirsearch
• bbot
• parameth - /parameth?label=%20)|||
• spiderfoot
• zdns
• SubOver
• lazyrecon
• katana - generation crawling and spidering framework.||crawl||
• dnsx - purpose DNS toolkit allow to run multiple DNS queries of your choice with a list of user-supplied resolvers.||dns||
• gauplus
• BLUTO
• HostHunter
• BugBountyScanner
• gitrob
• rengine
• HydraRecon
• SubBrute
• rusolver
• apkleaks
• longtongue
• reconftw
• masscan
• chaos-client - client?label=%20)|||
• megplus
• Hunt3r
• subjs
• dnsvalidator
• github-subdomains - subdomains?label=%20)|subdomains||
• crawlergo
• favirecon
• GitMiner
• hakrevdns
• LinkFinder - analysis`](/categorize/tags/js-analysis.md)||
• Osmedeus
• FavFreak
• STEWS
• naabu
• dmut
• OneForAll
• x8
• urlhunter
• sn0int - automatic OSINT framework and package manager||osint||
• CT_subdomains
• scilla
• 3klCon
• uncover
• Lepus
• Arjun
• go-dork - dork?label=%20)|||
• subzy
• pagodo - Automate Google Hacking Database scraping and searching||||
• Sudomy
• gospider - Fast web spider written in Go ||crawl||
• httpx - purpose HTTP toolkit allow to run multiple probers using retryablehttp library, it is designed to maintain the result reliability with increased threads. ||url||
• SecretFinder - A python script for find sensitive data (apikeys, accesstoken,jwt,..) and search anything on javascript files ||||
• altdns - au/altdns?label=%20)|dns subdomains||
• Parth
• uro
• feroxbuster
• BatchQL
• jwt-cracker - cracker?label=%20)|jwt||
• GraphQLmap
• CrackQL - force and fuzzing utility.||graphql||
• medusa
• crlfuzz
• c-jwt-cracker - rius/c-jwt-cracker?label=%20)|jwt||
• jwt-hack - hack is tool for hacking / security testing to JWT. Supported for En/decoding JWT, Generate payload for JWT attack and very fast cracking(dict/brutefoce)||jwt||
• ffuf
• BruteX
• SmuggleFuzz
• SSRFire
• fuzzparam
• headerpwn
• ParamPamPam - vuln`](/categorize/tags/cache-vuln.md)||
• dotdotpwn - The Directory Traversal Fuzzer ||path-traversal||
• kiterunner
• ppfuzz - side prototype pollution vulnerability written in Rust. 🦀||prototypepollution prototype-pollution||