Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/1n3/blackwidow
A Python based web application scanner to gather OSINT and fuzz for OWASP vulnerabilities on a target website.
https://github.com/1n3/blackwidow
active application automated bugbounty csrf fuzzer lfi osint owasp passive python rce rfi scan scanner spider sqli vulnerability web xss
Last synced: 25 days ago
JSON representation
A Python based web application scanner to gather OSINT and fuzz for OWASP vulnerabilities on a target website.
- Host: GitHub
- URL: https://github.com/1n3/blackwidow
- Owner: 1N3
- License: other
- Created: 2018-01-06T18:58:30.000Z (almost 7 years ago)
- Default Branch: master
- Last Pushed: 2023-03-31T17:43:56.000Z (over 1 year ago)
- Last Synced: 2024-10-15T04:03:22.979Z (25 days ago)
- Topics: active, application, automated, bugbounty, csrf, fuzzer, lfi, osint, owasp, passive, python, rce, rfi, scan, scanner, spider, sqli, vulnerability, web, xss
- Language: Python
- Homepage: https://sn1persecurity.com
- Size: 214 KB
- Stars: 1,509
- Watchers: 61
- Forks: 349
- Open Issues: 5
-
Metadata Files:
- Readme: README.md
- License: LICENSE.md
Awesome Lists containing this project
README
## ABOUT:
BlackWidow is a python based web application spider to gather subdomains, URL's, dynamic parameters, email addresses and phone numbers from a target website. This project also includes Inject-X fuzzer to scan dynamic URL's for common OWASP vulnerabilities.
## DEMO VIDEO:
[](https://www.youtube.com/watch?v=mch8ht47taY)
## FEATURES:
- [x] Automatically collect all URL's from a target website
- [x] Automatically collect all dynamic URL's and parameters from a target website
- [x] Automatically collect all subdomains from a target website
- [x] Automatically collect all phone numbers from a target website
- [x] Automatically collect all email addresses from a target website
- [x] Automatically collect all form URL's from a target website
- [X] Automatically scan/fuzz for common OWASP TOP vulnerabilities
- [x] Automatically saves all data into sorted text files
## LINUX INSTALL:
```
sudo bash install.sh
```
## USAGE:
```
blackwidow -u https://target.com - crawl target.com with 3 levels of depth.
blackwidow -d target.com -l 5 -v y - crawl the domain: target.com with 5 levels of depth with verbose logging enabled.
blackwidow -d target.com -l 5 -c 'test=test' - crawl the domain: target.com with 5 levels of depth using the cookie 'test=test'
blackwidow -d target.com -l 5 -s y -v y - crawl the domain: target.com with 5 levels of depth and fuzz all unique parameters for OWASP vulnerabilities with verbose logging on.
injectx.py -u https://test.com/uers.php?user=1&admin=true -v y - Fuzz all GET parameters for common OWASP vulnerabilities with verbose logging enabled.
```
## SAMPLE REPORT:
## DOCKER:
```bash
git clone https://github.com/1N3/BlackWidow.git
cd BlackWidow
docker build -t blackwidow .
docker run -it blackwidow # Defaults to --help
```
## LICENSE:
You may modify and re-distribute this software as long as the project name "BlackWidow", credit to the author "xer0dayz" and website URL "https://sn1persecurity.com" are NOT mofified. Doing so will break the license agreement and a takedown notice will be issued.
## DISCLAIMER:
This program is used for educational and ethical purposes only. I take no responsibility for any damages caused from using this program. By downloading and using this software, you agree that you take full responsibility for any damages and liability.
## LINKS:
- [Twitter](https://www.twitter.com/xer0dayz "Personal Twitter")
- [Twitter](https://www.twitter.com/sn1persecurity "Company Twitter")
- [Website](https://sn1persecurity.com "Sn1perSecurity")