mirror of
https://github.com/hahwul/WebHackersWeapons.git
synced 2024-10-01 01:25:58 -04:00
93 lines
10 KiB
Markdown
93 lines
10 KiB
Markdown
<h1 align="center">
|
|
<br>
|
|
<a href=""><img src="https://user-images.githubusercontent.com/13212227/79006553-5fbfc100-7b94-11ea-8b42-3fa154d098fd.png" alt="" width="600px;"></a>
|
|
<br>
|
|
Web Hacker's Weapons<br>
|
|
< Burp and ZAP Extensions >
|
|
<br>
|
|
<a href="https://twitter.com/intent/follow?screen_name=hahwul"><img src="https://img.shields.io/twitter/follow/hahwul?style=flat-square"></a> <img src="https://img.shields.io/github/languages/top/hahwul/WebHackersWeapons?style=flat-square"> <img src="https://img.shields.io/github/last-commit/hahwul/WebHackersWeapons?style=flat-square">
|
|
</h1>
|
|
A collection of cool tools used by Web hackers. Happy hacking , Happy bug-hunting<br>
|
|
This is Cool Extensions collection of Burp suite and ZAP
|
|
|
|
## Table of Contents
|
|
- [Web Hacker's Weapons Main](https://github.com/hahwul/WebHackersWeapons)
|
|
- [Cool Extensions](#cool-extensions)
|
|
- [Contribute](#contribute-and-contributor)
|
|
|
|
## Cool Extensions
|
|
| Type | Name | Description | Popularity | Language |
|
|
| ---------- | :---------- | :----------: | :----------: | :----------: |
|
|
| All/CODE | [http-script-generator](https://github.com/h3xstream/http-script-generator) | ZAP/Burp plugin that generate script to reproduce a specific HTTP request (Intended for fuzzing or scripted attacks) |  |  |
|
|
| All/PASV | [HUNT](https://github.com/bugcrowd/HUNT) | Data Driven web hacking Manual testing |  |  |
|
|
| All/PASV | [burp-retire-js](https://github.com/h3xstream/burp-retire-js) | Burp/ZAP/Maven extension that integrate Retire.js repository to find vulnerable Javascript libraries. |  |  |
|
|
| All/PASV | [csp-auditor](https://github.com/GoSecure/csp-auditor) | Burp and ZAP plugin to analyse Content-Security-Policy headers or generate template CSP configuration from crawling a Website |  |  |
|
|
| Burp/ACTIVE | [http-request-smuggler](https://github.com/PortSwigger/http-request-smuggler) | Testing HTTP Request Smuggling and Desync Attack |  |  |
|
|
| Burp/ACTIVE | [param-miner](https://github.com/PortSwigger/param-miner) | Parameter mining on Burpsuite |  |  |
|
|
| Burp/ACTIVE | [turbo-intruder](https://github.com/PortSwigger/turbo-intruder) | Turbo Intruder is a Burp Suite extension for sending large numbers of HTTP requests and analyzing the results. |  |  |
|
|
| Burp/BYPASS | [BurpSuiteHTTPSmuggler](https://github.com/nccgroup/BurpSuiteHTTPSmuggler) | A Burp Suite extension to help pentesters to bypass WAFs or test their effectiveness using a number of techniques |  |  |
|
|
| Burp/CALLBACK | [taborator](https://github.com/hackvertor/taborator) | A Burp extension to show the Collaborator client in a tab |  |  |
|
|
| Burp/CODE | [burp-exporter](https://github.com/artssec/burp-exporter) | Exporter is a Burp Suite extension to copy a request to the clipboard as multiple programming languages functions. |  |  |
|
|
| Burp/EXPORT | [burp-send-to](https://github.com/bytebutcher/burp-send-to) | Adds a customizable "Send to..."-context-menu to your BurpSuite. |  |  |
|
|
| Burp/HISTORY | [BurpSuiteLoggerPlusPlus](https://github.com/nccgroup/BurpSuiteLoggerPlusPlus) | Burp Suite Logger++ |  |  |
|
|
| Burp/PASV | [Autorize](https://github.com/Quitten/Autorize) | Automatic authorization enforcement detection extension for burp suite written in Jython developed by Barak Tawily in order to ease application security people work and allow them perform an automatic authorization tests |  |  |
|
|
| Burp/PASV | [BurpJSLinkFinder](https://github.com/InitRoot/BurpJSLinkFinder) | Burp Extension for a passive scanning JS files for endpoint links. |  |  |
|
|
| Burp/PASV | [BurpSuite-Secret_Finder](https://github.com/m4ll0k/BurpSuite-Secret_Finder) | Burp Suite extension to discover apikeys/accesstokens and sensitive data from HTTP response. |  |  |
|
|
| Burp/PASV | [auto-repeater](https://github.com/PortSwigger/auto-repeater) | Automated HTTP Request Repeating With Burp Suite |  |  |
|
|
| Burp/PASV | [collaborator-everywhere](https://github.com/PortSwigger/collaborator-everywhere) | A Burp Suite Pro extension which augments your proxy traffic by injecting non-invasive headers designed to reveal backend systems by causing pingbacks to Burp Collaborator |  |  |
|
|
| Burp/PASV | [femida](https://github.com/wish-i-was/femida) | Automated blind-xss search for Burp Suite |  |  |
|
|
| Burp/PASV | [reflected-parameters](https://github.com/PortSwigger/reflected-parameters) | Find reflected parameter on Burpsuite |  |  |
|
|
| Burp/REPEAT | [IntruderPayloads](https://github.com/1N3/IntruderPayloads) | A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists. |  |  |
|
|
| Burp/REPEAT | [Stepper](https://github.com/CoreyD97/Stepper) | A natural evolution of Burp Suite's Repeater tool |  |  |
|
|
| Burp/UTIL | [safecopy](https://github.com/yashrs/safecopy) | Burp Extension for copying requests safely. It redacts headers like Cookie, Authorization and X-CSRF-Token for now. More support can be added in the future. |  |  |
|
|
| ZAP/INTERFACE | [zap-hud](https://github.com/zaproxy/zap-hud) | The OWASP ZAP Heads Up Display (HUD) |  |  |
|
|
| ZAP/PASV | [attack-surface-detector-zap](https://github.com/secdec/attack-surface-detector-zap) | The Attack Surface Detector uses static code analyses to identify web app endpoints by parsing routes and identifying parameters |  |  |
|
|
| ZAP/PASV | [reflect](https://github.com/TypeError/reflect) | OWASP ZAP add-on to help find reflected parameter vulnerabilities |  |  |
|
|
| ZAP/SCRIPT | [community-scripts](https://github.com/zaproxy/community-scripts) | A collection of ZAP scripts provided by the community - pull requests very welcome! |  |  |
|
|
## Contribute and Contributor
|
|
### Usage of add-tool
|
|
```
|
|
./add-tool
|
|
Usage of ./add-tool:
|
|
-isFirst
|
|
if you add new type, it use
|
|
-url string
|
|
any url
|
|
```
|
|
|
|
### Three Procedures for the Contribute
|
|
- First, your tool append `data.json` using `add-tool
|
|
```
|
|
$ ./add-tool -url https://github.com/sqlmapproject/sqlmap
|
|
Successfully Opened type.lst
|
|
[0] Army-Knife
|
|
[1] Discovery
|
|
[2] Fetch
|
|
[3] Scanner
|
|
[4] Utility
|
|
[+] What is type?
|
|
3
|
|
Scanner
|
|
[+] What is method(e.g XSS, WVS, SSL, ETC..)?
|
|
SQL
|
|
Successfully Opened data.json
|
|
|
|
```
|
|
- Second, Give me PR or Add issue with data.json<br>
|
|
- Third, There's no third.
|
|
|
|
### Add Burp Suite or ZAP Extensions
|
|
in `WebHackersWeapons/Burp and ZAP Extensions` directory
|
|
```
|
|
$ ../add-tool -url https://github.com/nccgroup/BurpSuiteLoggerPlusPlus
|
|
```
|
|
|
|
### Distribute to Burp Suite or ZAP Extensions
|
|
```
|
|
$ ../distribute-readme
|
|
=> show new README file in Burp Suite or ZAP Extensions
|
|
```
|
|
|
|
### Add/Distribute common tools
|
|
https://github.com/hahwul/WebHackersWeapons#contribute-and-contributor
|