WebHackersWeapons/categorize/langs/Python.md

The Python based tools

Type	Name	Description	Star	Tags	Badges
Proxy	mitmproxy	An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
Recon	longtongue	Customized Password/Passphrase List inputting Target Info
Recon	Arjun	HTTP parameter discovery suite.		param
Recon	Sublist3r	Fast subdomains enumeration tool for penetration testers		subdomains
Recon	BurpJSLinkFinder
Recon	GitMiner	Tool for advanced mining for content on Github
Recon	Silver	Mass scan IPs for vulnerable services
Recon	pagodo	pagodo (Passive Google Dork) - Automate Google Hacking Database scraping and searching
Recon	uro	declutters url lists for crawling/pentesting
Recon	SecretFinder	SecretFinder - A python script for find sensitive data (apikeys, accesstoken,jwt,..) and search anything on javascript files
Recon	dnsvalidator	Maintains a list of IPv4 DNS servers by verifying them against baseline servers, and ensuring accurate responses.		dns
Recon	Parth	Heuristic Vulnerable Parameter Scanner		param
Recon	ParamSpider	Mining parameters from dark corners of Web Archives		param
Recon	graphw00f	GraphQL Server Engine Fingerprinting utility		graphql
Recon	FavFreak	Making Favicon.ico based Recon Great again !
Recon	LinkFinder	A python script that finds endpoints in JavaScript files
Recon	dirsearch	Web path scanner
Recon	altdns	Generates permutations, alterations and mutations of subdomains and then resolves them		dns
Recon	HydraRecon	All In One, Fast, Easy Recon Tool
Recon	xnLinkFinder	A python tool used to discover endpoints (and potential parameters) for a given target
Recon	apkleaks	Scanning APK file for URIs, endpoints & secrets.		apk
Recon	spiderfoot	SpiderFoot automates OSINT collection so that you can focus on analysis.
Recon	Photon	Incredibly fast crawler designed for OSINT.
Recon	STEWS	A Security Tool for Enumerating WebSockets
Recon	3klCon	Automation Recon tool which works with Large & Medium scopes. It performs more than 20 tasks and gets back all the results in separated files.
Recon	OneForAll	OneForAll是一款功能强大的子域收集工具
Recon	parameth	This tool can be used to brute discover GET and POST parameters
Recon	cc.py	Extracting URLs of a specific target based on the results of "commoncrawl.org"
Recon	knock	Knock Subdomain Scan		subdomains
Fuzzer	SSRFmap	Automatic SSRF fuzzer and exploitation tool		ssrf
Fuzzer	CrackQL	CrackQL is a GraphQL password brute-force and fuzzing utility.		graphql
Fuzzer	GraphQLmap	GraphQLmap is a scripting engine to interact with a graphql endpoint for pentesting purposes.		graphql
Fuzzer	wfuzz	Web application fuzzer
Scanner	AWSBucketDump	Security Tool to Look For Interesting Files in S3 Buckets		s3
Scanner	OpenRedireX	A Fuzzer for OpenRedirect issues
Scanner	sqlmap	Automatic SQL injection and database takeover tool
Scanner	sqliv	massive SQL injection vulnerability scanner		sqli
Scanner	Autorize			aaa
Scanner	Striker	Striker is an offensive information and vulnerability scanner.
Scanner	S3Scanner	Scan for open AWS S3 buckets and dump the contents		s3
Scanner	corsair_scan	Corsair_scan is a security tool to test Cross-Origin Resource Sharing (CORS).
Scanner	zap-cli	A simple tool for interacting with OWASP ZAP from the commandline.
Scanner	a2sv	Auto Scanning to SSL Vulnerability		ssl
Scanner	rapidscan	The Multi-Tool Web Vulnerability Scanner.
Scanner	VHostScan	A virtual host scanner that performs reverse lookups, can be used with pivot tools, detect catch-all scenarios, work around wildcards, aliases and dynamic default pages.
Scanner	tplmap	Server-Side Template Injection and Code Injection Detection and Exploitation Tool
Scanner	Corsy	CORS Misconfiguration Scanner
Scanner	LFISuite	Totally Automatic LFI Exploiter (+ Reverse Shell) and Scanner
Scanner	xsscrapy	XSS/SQLi spider. Give it a URL and it'll test every link it finds for XSS and some SQLi.		xss
Scanner	AuthMatrix			aaa
Scanner	NoSQLMap	Automated NoSQL database enumeration and web application exploitation tool.
Scanner	smuggler	Smuggler - An HTTP Request Smuggling / Desync testing tool written in Python 3		smuggle
Scanner	commix	Automated All-in-One OS Command Injection Exploitation Tool.
Scanner	xsser	Cross Site "Scripter" (aka XSSer) is an automatic -framework- to detect, exploit and report XSS vulnerabilities in web-based applications.		xss
Scanner	deadlinks	Health checks for your documentation links.		broken-link
Scanner	XSStrike	Most advanced XSS scanner.		xss
Scanner	DSSS	Damn Small SQLi Scanner
Scanner	http-request-smuggling	HTTP Request Smuggling Detection Tool
Scanner	gitGraber	gitGraber
Exploit	toxssin	An XSS exploitation command-line interface and payload generator.		xss
Exploit	XSRFProbe	The Prime Cross Site Request Forgery (CSRF) Audit and Exploitation Toolkit.
Exploit	Gopherus	This tool generates gopher link for exploiting SSRF and gaining RCE in various servers
Exploit	Liffy	Local file inclusion exploitation tool		lfi
Utils	grc	generic colouriser
Utils	blackboxprotobuf	Blackbox protobuf is a Burp Suite extension for decoding and modifying arbitrary protobuf messages without the protobuf type definition.
Utils	pentest-tools	Custom pentesting tools
Utils	docem	Uility to embed XXE and XSS payloads in docx,odt,pptx,etc (OXML_XEE on steroids)		xxe xss
Utils	230-OOB	An Out-of-Band XXE server for retrieving file contents over FTP.		xxe
Utils	femida
Utils	burp-exporter
Utils	inql
Utils	Bug-Bounty-Toolz	BBT - Bug Bounty Tools
Utils	Atlas	Quick SQLMap Tamper Suggester
Utils	PayloadsAllTheThings	A list of useful payloads and bypass for Web Application Security and Pentest/CTF
Utils	argumentinjectionhammer	A Burp Extension designed to identify argument injection vulnerabilities.
Utils	tiscripts	Turbo Intruder Scripts
Utils	Redcloud	Automated Red Team Infrastructure deployement using Docker		infra
Utils	httpie	As easy as /aitch-tee-tee-pie/ 🥧 Modern, user-friendly command-line HTTP client for the API era. JSON support, colors, sessions, downloads, plugins & more. https://twitter.com/httpie		http
Env	Crimson	Web Application Security Testing automation.