WebHackersWeapons/Burp and ZAP Extensions/README.md
2020-04-19 01:41:11 +09:00

6.7 KiB



Web Hacker's Weapons
< Burp and ZAP Extensions >

A collection of cool tools used by Web hackers. Happy hacking , Happy bug-hunting
This is Cool Extensions collection of Burp suite and ZAP

Table of Contents

Cool Extensions

Type Name Description Popularity Language
All/ANALYSIS HUNT Data Driven web hacking Manual testing
All/ANALYSIS burp-retire-js Burp/ZAP/Maven extension that integrate Retire.js repository to find vulnerable Javascript libraries.
All/ANALYSIS csp-auditor Burp and ZAP plugin to analyse Content-Security-Policy headers or generate template CSP configuration from crawling a Website
All/POC http-script-generator ZAP/Burp plugin that generate script to reproduce a specific HTTP request (Intended for fuzzing or scripted attacks)
Burp/ANALYSIS Autorize Automatic authorization enforcement detection extension for burp suite written in Jython developed by Barak Tawily in order to ease application security people work and allow them perform an automatic authorization tests
Burp/ANALYSIS burp-send-to Adds a customizable "Send to..."-context-menu to your BurpSuite.
Burp/ANALYSIS collaborator-everywhere A Burp Suite Pro extension which augments your proxy traffic by injecting non-invasive headers designed to reveal backend systems by causing pingbacks to Burp Collaborator
Burp/ANALYSIS http-request-smuggler Testing HTTP Request Smuggling and Desync Attack
Burp/ANALYSIS param-miner Parameter mining on Burpsuite
Burp/ANALYSIS reflected-parameters Find reflected parameter on Burpsuite
Burp/ANALYSIS taborator A Burp extension to show the Collaborator client in a tab
Burp/ANALYSIS turbo-intruder Turbo Intruder is a Burp Suite extension for sending large numbers of HTTP requests and analyzing the results.
Burp/CODE burp-exporter Exporter is a Burp Suite extension to copy a request to the clipboard as multiple programming languages functions.
Burp/HISTORY BurpSuiteLoggerPlusPlus Burp Suite Logger++
ZAP/INTERFACE zap-hud The OWASP ZAP Heads Up Display (HUD)

Contribute and Contributor

Usage of add-tool

./add-tool
Usage of ./add-tool:
  -isFirst
    	if you add new type, it use
  -url string
    	any url

Three Procedures for the Contribute

  • First, your tool append data.json using `add-tool
$ ./add-tool -url https://github.com/sqlmapproject/sqlmap
Successfully Opened type.lst
[0] Army-Knife
[1] Discovery
[2] Fetch
[3] Scanner
[4] Utility
[+] What is type?
3
Scanner
[+] What is method(e.g XSS, WVS, SSL, ETC..)?
SQL
Successfully Opened data.json

  • Second, Give me PR or Add issue with data.json
  • Third, There's no third.

Add Burp Suite or ZAP Extensions

in WebHackersWeapons/Burp and ZAP Extensions directory

$ ../add-tool -url https://github.com/nccgroup/BurpSuiteLoggerPlusPlus

Distribute to Burp Suite or ZAP Extensions

$ ../distribute-readme
=> show new README file in Burp Suite or ZAP Extensions

Add/Distribute common tools

https://github.com/hahwul/WebHackersWeapons#contribute-and-contributor