WebHackingTools

Automatically install some web hacking/bug bounty tools for your VPS/hacking station.

<b>O.S supported :heavy_check_mark: </b>

• Debian 11 x64

• Kali Linux 2022.4 x64

• Linux Mint 21 x64

• Ubuntu 22.04 x64

Installation

💻 Manual: laptop/VPS/other

apt-get update -y && apt-get install git -y
cd /tmp && git clone https://github.com/supr4s/WebHackingTools && cd WebHackingTools && ./installer.sh

🐳 Docker

A Docker version is available, see https://hub.docker.com/r/supr4s/webhackingtools

docker pull supr4s/webhackingtools
docker run --name webhackingtools -it supr4s/webhackingtools

To leave the container but leave it running:

ctrl + p and ctrl + q 

To re-attach to the container:

docker attach webhackingtools

Available tools list

Subdomains enumeration

• Amass
• Assetfinder
• Crobat
• Findomain
• Github-subdomains
• Gitlab-subdomains *
• Subfinder

DNS resolver

• dnsx
• MassDNS
• PureDNS

HTTP probe

• httprobe
• httpx

Visual recon

• Aquatone
• Gowitness

Network scanner

• Masscan
• Naabu
• Nmap
• Smap *

Web crawler

• Gospider
• Hakrawler
• Katana *

HTTP parameter

• Arjun
• x8

JavaScript hunting

• LinkFinder
• SecretFinder
• subjs
• xnLinkFinder *

Bypass 40X (new)

• dontgo403 *

CORS tools (new)

• Corsy *
• CORScanner *

Fuzzing tools

• ffuf
• Gobuster
• wfuzz
• fuzzuli *

Prototype pollution (new)

• ppfuzz *
• ppmap *

LFI tools

• LFISuite

SSRF tools

• SSRFmap
• Gopherus
• Interactsh
• AutoSSRF *

SSTI tools

• tplmap

API hacking tools

• Kiterunner + API routes

Vulns - XSS

• Dalfox
• kxss
• XSStrike

Vulns - SQL Injection

• NoSQLMap
• SQLMap

Vulns - Scanner

• Jaeles
• Nikto **
• Nuclei

CMS Scanner

• WPscan
• droopescan
• AEM-Hacker

Wordlists

• SecLists
• OneForAll *

Git hunting

• GitDorker
• gitGraber
• GitHacker
• GitTools

Sensitive stuff finding

• DumpsterDiver
• EarlyBird
• Ripgrep
• Trufflehog *

Useful tools

• anew
• anti-burl
• getallurls
• gron
• Interlace
• jq
• qsreplace
• Tmux
• unfurl
• Uro

Note

• Refer to the usage of the tools as most of them require configuration (especially for subdomains enumeration).
• Please be careful with these tools and only use them on targets you have explicitly authorized.

N.B : * = added in the last update

** For Nikto and Debian 10, you need to have the non-free contrib sources in addition. e.g :

deb http://deb.debian.org/debian/ buster main contrib non-free
deb-src http://deb.debian.org/debian/ buster main contrib non-free