mirror of
https://github.com/hahwul/WebHackersWeapons.git
synced 2024-10-01 01:25:58 -04:00
107 lines
33 KiB
Markdown
107 lines
33 KiB
Markdown
|
|
## The Go based tools
|
|
|
|
| Type | Name | Description | Star | Tags | Badges |
|
|
| --- | --- | --- | --- | --- | --- |
|
|
|Army-Knife|[jaeles](https://github.com/jaeles-project/jaeles)|The Swiss Army knife for automated Web Application Testing ||[`live-audit`](/tags/live-audit.md)|[](/langs/Go.md)|
|
|
|Proxy|[hetty](https://github.com/dstotijn/hetty)|Hetty is an HTTP toolkit for security research. It aims to become an open source alternative to commercial software like Burp Suite Pro, with powerful features tailored to the needs of the infosec and bug bounty community.|||[](/langs/Go.md)|
|
|
|Proxy|[proxify](https://github.com/projectdiscovery/proxify)|Swiss Army knife Proxy tool for HTTP/HTTPS traffic capture, manipulation and replay|||[](/langs/Go.md)|
|
|
|Recon|[scilla](https://github.com/edoardottt/scilla)|🏴☠️ Information Gathering tool 🏴☠️ dns/subdomain/port enumeration|||[](/langs/Go.md)|
|
|
|Recon|[subjs](https://github.com/lc/subjs)|Fetches javascript file from a list of URLS or subdomains.|||[](/langs/Go.md)|
|
|
|Recon|[gowitness](https://github.com/sensepost/gowitness)|🔍 gowitness - a golang, web screenshot utility using Chrome Headless |||[](/langs/Go.md)|
|
|
|Recon|[puredns](https://github.com/d3mondev/puredns)|Puredns is a fast domain resolver and subdomain bruteforcing tool that can accurately filter out wildcard subdomains and DNS poisoned entries.|||[](/langs/Go.md)|
|
|
|Recon|[zdns](https://github.com/zmap/zdns)|Fast CLI DNS Lookup Tool||[`dns`](/tags/dns.md)|[](/langs/Go.md)|
|
|
|Recon|[Amass](https://github.com/OWASP/Amass)|In-depth Attack Surface Mapping and Asset Discovery ||[`subdomains`](/tags/subdomains.md)|[](/langs/Go.md)|
|
|
|Recon|[haktrails](https://github.com/hakluke/haktrails)|Golang client for querying SecurityTrails API data|||[](/langs/Go.md)|
|
|
|Recon|[Sub404](https://github.com/r3curs1v3-pr0xy/sub404)|A python tool to check subdomain takeover vulnerability||[`subdomains`](/tags/subdomains.md) [`takeover`](/tags/takeover.md)|[](/langs/Go.md)|
|
|
|Recon|[gau](https://github.com/lc/gau)|Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl.|||[](/langs/Go.md)|
|
|
|Recon|[meg](https://github.com/tomnomnom/meg)|Fetch many paths for many hosts - without killing the hosts |||[](/langs/Go.md)|
|
|
|Recon|[hakrawler](https://github.com/hakluke/hakrawler)|Simple, fast web crawler designed for easy, quick discovery of endpoints and assets within a web application |||[](/langs/Go.md)|
|
|
|Recon|[aquatone](https://github.com/michenriksen/aquatone)|A Tool for Domain Flyovers ||[`domain`](/tags/domain.md)|[](/langs/Go.md)|
|
|
|Recon|[dnsprobe](https://github.com/projectdiscovery/dnsprobe)|DNSProb (beta) is a tool built on top of retryabledns that allows you to perform multiple dns queries of your choice with a list of user supplied resolvers. ||[`dns`](/tags/dns.md)|[](/langs/Go.md)|
|
|
|Recon|[waybackurls](https://github.com/tomnomnom/waybackurls)|Fetch all the URLs that the Wayback Machine knows about for a domain |||[](/langs/Go.md)|
|
|
|Recon|[subgen](https://github.com/pry0cc/subgen)|A really simple utility to concate wordlists to a domain name - to pipe into your favourite resolver!||[`subdomains`](/tags/subdomains.md)|[](/langs/Go.md)|
|
|
|Recon|[dnsx](https://github.com/projectdiscovery/dnsx)|dnsx is a fast and multi-purpose DNS toolkit allow to run multiple DNS queries of your choice with a list of user-supplied resolvers.||[`dns`](/tags/dns.md)|[](/langs/Go.md)|
|
|
|Recon|[Osmedeus](https://github.com/j3ssie/Osmedeus)|Fully automated offensive security framework for reconnaissance and vulnerability scanning |||[](/langs/Go.md)|
|
|
|Recon|[gospider](https://github.com/jaeles-project/gospider)|Gospider - Fast web spider written in Go |||[](/langs/Go.md)|
|
|
|Recon|[hakrevdns](https://github.com/hakluke/hakrevdns)|Small, fast tool for performing reverse DNS lookups en masse. |||[](/langs/Go.md)|
|
|
|Recon|[chaos-client](https://github.com/projectdiscovery/chaos-client)|Go client to communicate with Chaos DNS API. |||[](/langs/Go.md)|
|
|
|Recon|[naabu](https://github.com/projectdiscovery/naabu)|A fast port scanner written in go with focus on reliability and simplicity. Designed to be used in combination with other tools for attack surface discovery in bug bounties and pentests |||[](/langs/Go.md)|
|
|
|Recon|[github-endpoints](https://github.com/gwen001/github-endpoints)|Find endpoints on GitHub.|||[](/langs/Go.md)|
|
|
|Recon|[gitrob](https://github.com/michenriksen/gitrob)|Reconnaissance tool for GitHub organizations |||[](/langs/Go.md)|
|
|
|Recon|[crawlergo](https://github.com/Qianlitp/crawlergo)|A powerful browser crawler for web vulnerability scanners|||[](/langs/Go.md)|
|
|
|Recon|[cariddi](https://github.com/edoardottt/cariddi)|Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more|||[](/langs/Go.md)|
|
|
|Recon|[SubOver](https://github.com/Ice3man543/SubOver)|A Powerful Subdomain Takeover Tool||[`subdomains`](/tags/subdomains.md) [`takeover`](/tags/takeover.md)|[](/langs/Go.md)|
|
|
|Recon|[htcat](https://github.com/htcat/htcat)|Parallel and Pipelined HTTP GET Utility |||[](/langs/Go.md)|
|
|
|Recon|[subfinder](https://github.com/projectdiscovery/subfinder)|Subfinder is a subdomain discovery tool that discovers valid subdomains for websites. Designed as a passive framework to be useful for bug bounties and safe for penetration testing. ||[`subdomains`](/tags/subdomains.md)|[](/langs/Go.md)|
|
|
|Recon|[uncover](https://github.com/projectdiscovery/uncover)|Quickly discover exposed hosts on the internet using multiple search engine.|||[](/langs/Go.md)|
|
|
|Recon|[go-dork](https://github.com/dwisiswant0/go-dork)|The fastest dork scanner written in Go. |||[](/langs/Go.md)|
|
|
|Recon|[github-subdomains](https://github.com/gwen001/github-subdomains)|Find subdomains on GitHub|||[](/langs/Go.md)|
|
|
|Recon|[shuffledns](https://github.com/projectdiscovery/shuffledns)|shuffleDNS is a wrapper around massdns written in go that allows you to enumerate valid subdomains using active bruteforce as well as resolve subdomains with wildcard handling and easy input-output support. |||[](/langs/Go.md)|
|
|
|Recon|[urlhunter](https://github.com/utkusen/urlhunter)|a recon tool that allows searching on URLs that are exposed via shortener services|||[](/langs/Go.md)|
|
|
|Recon|[Smap](https://github.com/s0md3v/smap/)|a drop-in replacement for Nmap powered by shodan.io|||[](/langs/Go.md)|
|
|
|Recon|[subjack](https://github.com/haccer/subjack)|Subdomain Takeover tool written in Go ||[`subdomains`](/tags/subdomains.md) [`takeover`](/tags/takeover.md)|[](/langs/Go.md)|
|
|
|Recon|[subzy](https://github.com/LukaSikic/subzy)|Subdomain takeover vulnerability checker||[`subdomains`](/tags/subdomains.md) [`takeover`](/tags/takeover.md)|[](/langs/Go.md)|
|
|
|Recon|[httpx](https://github.com/projectdiscovery/httpx)|httpx is a fast and multi-purpose HTTP toolkit allow to run multiple probers using retryablehttp library, it is designed to maintain the result reliability with increased threads. |||[](/langs/Go.md)|
|
|
|Recon|[gobuster](https://github.com/OJ/gobuster)|Directory/File, DNS and VHost busting tool written in Go |||[](/langs/Go.md)|
|
|
|Recon|[gauplus](https://github.com/bp0lr/gauplus)|A modified version of gau for personal usage. Support workers, proxies and some extra things.|||[](/langs/Go.md)|
|
|
|Recon|[getJS](https://github.com/003random/getJS)|A tool to fastly get all javascript sources/files|||[](/langs/Go.md)|
|
|
|Recon|[dmut](https://github.com/bp0lr/dmut)|A tool to perform permutations, mutations and alteration of subdomains in golang.||[`subdomains`](/tags/subdomains.md)|[](/langs/Go.md)|
|
|
|Recon|[assetfinder](https://github.com/tomnomnom/assetfinder)|Find domains and subdomains related to a given domain ||[`subdomains`](/tags/subdomains.md)|[](/langs/Go.md)|
|
|
|Fuzzer|[jwt-hack](https://github.com/hahwul/jwt-hack)|🔩 jwt-hack is tool for hacking / security testing to JWT. Supported for En/decoding JWT, Generate payload for JWT attack and very fast cracking(dict/brutefoce)||[`jwt`](/tags/jwt.md)|[](/langs/Go.md)|
|
|
|Fuzzer|[fuzzparam](https://github.com/0xsapra/fuzzparam)|A fast go based param miner to fuzz possible parameters a URL can have.|||[](/langs/Go.md)|
|
|
|Fuzzer|[kiterunner](https://github.com/assetnote/kiterunner)|Contextual Content Discovery Tool|||[](/langs/Go.md)|
|
|
|Fuzzer|[medusa](https://github.com/riza/medusa)|Fastest recursive HTTP fuzzer, like a Ferrari. |||[](/langs/Go.md)|
|
|
|Fuzzer|[ffuf](https://github.com/ffuf/ffuf)|Fast web fuzzer written in Go |||[](/langs/Go.md)|
|
|
|Scanner|[h2csmuggler](https://github.com/assetnote/h2csmuggler)|HTTP Request Smuggling Detection Tool||[`smuggle`](/tags/smuggle.md)|[](/langs/Go.md)|
|
|
|Scanner|[hinject](https://github.com/dwisiswant0/hinject)|Host Header Injection Checker |||[](/langs/Go.md)|
|
|
|Scanner|[CorsMe](https://github.com/Shivangx01b/CorsMe)|Cross Origin Resource Sharing MisConfiguration Scanner |||[](/langs/Go.md)|
|
|
|Scanner|[dontgo403](https://github.com/devploit/dontgo403)|Tool to bypass 40X response codes.||[`403`](/tags/403.md)|[](/langs/Go.md)|
|
|
|Scanner|[nuclei](https://github.com/projectdiscovery/nuclei)|Nuclei is a fast tool for configurable targeted scanning based on templates offering massive extensibility and ease of use. |||[](/langs/Go.md)|
|
|
|Scanner|[nosqli](https://github.com/Charlie-belmer/nosqli)|NoSql Injection CLI tool|||[](/langs/Go.md)|
|
|
|Scanner|[websocket-connection-smuggler](https://github.com/hahwul/websocket-connection-smuggler)|websocket-connection-smuggler||[`smuggle`](/tags/smuggle.md)|[](/langs/Go.md)|
|
|
|Scanner|[fockcache](https://github.com/tismayil/fockcache)|FockCache - Minimalized Test Cache Poisoning|||[](/langs/Go.md)|
|
|
|Scanner|[Web-Cache-Vulnerability-Scanner](https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner)|Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning. It is developed by Hackmanit GmbH (http://hackmanit.de/).|||[](/langs/Go.md)|
|
|
|Scanner|[ws-smuggler](https://github.com/hahwul/ws-smuggler)|WebSocket Connection Smuggler||[`smuggle`](/tags/smuggle.md)|[](/langs/Go.md)|
|
|
|Scanner|[http2smugl](https://github.com/neex/http2smugl)|This tool helps to detect and exploit HTTP request smuggling in cases it can be achieved via HTTP/2 -> HTTP/1.1 conversion by the frontend server.|||[](/langs/Go.md)|
|
|
|Scanner|[ditto](https://github.com/evilsocket/ditto)|A tool for IDN homograph attacks and detection.|||[](/langs/Go.md)|
|
|
|Scanner|[httprobe](https://github.com/tomnomnom/httprobe)|Take a list of domains and probe for working HTTP and HTTPS servers |||[](/langs/Go.md)|
|
|
|Scanner|[DirDar](https://github.com/M4DM0e/DirDar)|DirDar is a tool that searches for (403-Forbidden) directories to break it and get dir listing on it||[`403`](/tags/403.md)|[](/langs/Go.md)|
|
|
|Scanner|[gitleaks](https://github.com/zricethezav/gitleaks)|Scan git repos (or files) for secrets using regex and entropy 🔑|||[](/langs/Go.md)|
|
|
|Scanner|[ppmap](https://github.com/kleiton0x00/ppmap)|A scanner/exploitation tool written in GO, which leverages client-side Prototype Pollution to XSS by exploiting known gadgets.|||[](/langs/Go.md)|
|
|
|Scanner|[wprecon](https://github.com/blackcrw/wprecon)|Hello! Welcome. Wprecon (Wordpress Recon), is a vulnerability recognition tool in CMS Wordpress, 100% developed in Go.|||[](/langs/Go.md)|
|
|
|Scanner|[plution](https://github.com/raverrr/plution)|Prototype pollution scanner using headless chrome|||[](/langs/Go.md)|
|
|
|Scanner|[headi](https://github.com/mlcsec/headi)|Customisable and automated HTTP header injection|||[](/langs/Go.md)|
|
|
|Scanner|[dalfox](https://github.com/hahwul/dalfox)|🌘🦊 DalFox(Finder Of XSS) / Parameter Analysis and XSS Scanning tool based on golang ||[`xss`](/tags/xss.md)|[](/langs/Go.md)|
|
|
|Scanner|[confused](https://github.com/visma-prodsec/confused)|Tool to check for dependency confusion vulnerabilities in multiple package management systems|||[](/langs/Go.md)|
|
|
|Scanner|[ssrf-sheriff](https://github.com/teknogeek/ssrf-sheriff)|A simple SSRF-testing sheriff written in Go |||[](/langs/Go.md)|
|
|
|Exploit|[xxeserv](https://github.com/staaldraad/xxeserv)|A mini webserver with FTP support for XXE payloads|||[](/langs/Go.md)|
|
|
|Utils|[burl](https://github.com/tomnomnom/burl)|A Broken-URL Checker ||[`url`](/tags/url.md)|[](/langs/Go.md)|
|
|
|Utils|[urlgrab](https://github.com/IAmStoxe/urlgrab)|A golang utility to spider through a website searching for additional links. |||[](/langs/Go.md)|
|
|
|Utils|[qsreplace](https://github.com/tomnomnom/qsreplace)|Accept URLs on stdin, replace all query string values with a user-supplied value |||[](/langs/Go.md)|
|
|
|Utils|[Emissary](https://github.com/BountyStrike/Emissary)|Send notifications on different channels such as Slack, Telegram, Discord etc.|||[](/langs/Go.md)|
|
|
|Utils|[hacks](https://github.com/tomnomnom/hacks)|A collection of hacks and one-off scripts |||[](/langs/Go.md)|
|
|
|Utils|[gitls](https://github.com/hahwul/gitls)|Listing git repository from URL/User/Org|||[](/langs/Go.md)|
|
|
|Utils|[cf-check](https://github.com/dwisiswant0/cf-check)|Cloudflare Checker written in Go |||[](/langs/Go.md)|
|
|
|Utils|[unfurl](https://github.com/tomnomnom/unfurl)|Pull out bits of URLs provided on stdin |||[](/langs/Go.md)|
|
|
|Utils|[s3reverse](https://github.com/hahwul/s3reverse)|The format of various s3 buckets is convert in one format. for bugbounty and security testing. ||[`s3`](/tags/s3.md)|[](/langs/Go.md)|
|
|
|Utils|[wuzz](https://github.com/asciimoo/wuzz)|Interactive cli tool for HTTP inspection ||[`http`](/tags/http.md)|[](/langs/Go.md)|
|
|
|Utils|[interactsh](https://github.com/projectdiscovery/interactsh)|An OOB interaction gathering server and client library||[`oast`](/tags/oast.md)|[](/langs/Go.md)|
|
|
|Utils|[dnsobserver](https://github.com/allyomalley/dnsobserver)|A handy DNS service written in Go to aid in the detection of several types of blind vulnerabilities. It monitors a pentester's server for out-of-band DNS interactions and sends lookup notifications via Slack. ||[`oast`](/tags/oast.md) [`dns`](/tags/dns.md)|[](/langs/Go.md)|
|
|
|Utils|[github-regexp](https://github.com/gwen001/github-regexp)|Basically a regexp over a GitHub search.|||[](/langs/Go.md)|
|
|
|Utils|[urlprobe](https://github.com/1ndianl33t/urlprobe)|Urls status code & content length checker |||[](/langs/Go.md)|
|
|
|Utils|[pet](https://github.com/knqyf263/pet)|Simple command-line snippet manager, written in Go.|||[](/langs/Go.md)|
|
|
|Utils|[boast](https://github.com/marcoagner/boast)|The BOAST Outpost for AppSec Testing (v0.1.0)||[`oast`](/tags/oast.md)|[](/langs/Go.md)|
|
|
|Utils|[slackcat](https://github.com/bcicen/slackcat)|CLI utility to post files and command output to slack|||[](/langs/Go.md)|
|
|
|Utils|[godeclutter](https://github.com/c3l3si4n/godeclutter)|Declutters URLs in a fast and flexible way, for improving input for web hacking automations such as crawlers and vulnerability scans.||[`url`](/tags/url.md)|[](/langs/Go.md)|
|
|
|Utils|[gotestwaf](https://github.com/wallarm/gotestwaf)|An open-source project in Golang to test different web application firewalls (WAF) for detection logic and bypasses|||[](/langs/Go.md)|
|
|
|Utils|[gotator](https://github.com/Josue87/gotator)|Gotator is a tool to generate DNS wordlists through permutations.|||[](/langs/Go.md)|
|
|
|Utils|[gee](https://github.com/hahwul/gee)|🏵 Gee is tool of stdin to each files and stdout. It is similar to the tee command, but there are more functions for convenience. In addition, it was written as go|||[](/langs/Go.md)|
|
|
|Utils|[hakcheckurl](https://github.com/hakluke/hakcheckurl)|Takes a list of URLs and returns their HTTP response codes|||[](/langs/Go.md)|
|
|
|Utils|[TukTuk](https://github.com/ArturSS7/TukTuk)|Tool for catching and logging different types of requests. ||[`oast`](/tags/oast.md)|[](/langs/Go.md)|
|
|
|Utils|[gron](https://github.com/tomnomnom/gron)|Make JSON greppable! |||[](/langs/Go.md)|
|
|
|Utils|[gf](https://github.com/tomnomnom/gf)|A wrapper around grep, to help you grep for things |||[](/langs/Go.md)|
|
|
|Utils|[anew](https://github.com/tomnomnom/anew)|A tool for adding new lines to files, skipping duplicates|||[](/langs/Go.md)|
|
|
|Utils|[fzf](https://github.com/junegunn/fzf)|A command-line fuzzy finder|||[](/langs/Go.md)|
|
|
|