hahwul/WebHackersWeapons：Web 黑客的武器 / 一组 Web 黑客使用的酷炫工具

项目介绍

hahwul/WebHackersWeapons 是一个托管在 GitHub 上的开源项目，主要使用 Ruby 编写，采用 MIT License 许可证，目前获得 5.1k 个 Star、791 次 Fork。

仓库全名: hahwul/WebHackersWeapons

README 摘要

A collection of awesome tools used by Web hackers. Happy hacking , Happy bug-hunting! Family project Table of Contents Weapons Tools Bookmarklets Browser Addons Burpsuite, Caido and ZAP Addons Contribute Thanks to contributor Weapons Attributes Attributes | Types | Army-Knife Proxy Recon Fuzzer Scanner Exploit Env Utils Etc| Tags | live-audit mitmproxy crawl osint recon forensics social-engineering steganography…

完整内容见 GitHub 原始 README 或本页。

常见问题

WebHackersWeapons 用什么语言开发？

主要使用 Ruby 编写，采用 MIT License 许可证，目前有 5.1k 个 Star。

WebHackersWeapons 可以免费商用吗？

如何获取 WebHackersWeapons 的源码？

可以直接克隆仓库：git clone https://github.com/hahwul/WebHackersWeapons.git，默认分支为 main；安装与运行步骤见仓库 README。

WebHackersWeapons 最近还在维护吗？

仓库最近一次更新为 9月7日，当前有 2 个未关闭 Issue；Star 数为 5.1k，可作为社区活跃度的参考。

关于

GitHub 原始描述（英文）

⚔️ Web Hacker's Weapons / A collection of cool tools used by Web hackers. Happy hacking , Happy bug-hunting

awesome-list bugbounty bugbountytips hacking hacktoberfest scanner security tools webhacking

MIT License
5.1k Stars
791 Forks
145 Watching

描述取自 GitHub 官方 API，保持仓库作者书写的原文。

简要分析

热度分

6834

价值分

3315

活跃状态

活跃

GitHub

语言占比

Ruby

贡献者

A collection of awesome tools used by Web hackers. Happy hacking , Happy bug-hunting!

Family project

Weapons
Contribute
Thanks to contributor

Weapons

Attributes

	Attributes
Types	`Army-Knife` `Proxy` `Recon` `Fuzzer` `Scanner` `Exploit` `Env` `Utils` `Etc`
Tags	`live-audit` `mitmproxy` `crawl` `osint` `recon` `forensics` `social-engineering` `steganography` `pentest` `exploit` `cloud` `report` `infra` `http` `repeater` `url` `subdomains` `portscan` `dns` `port` `online` `endpoint` `attack-surface` `domain` `takeover` `ssl` `tls` `certificates` `js-analysis` `favicon` `param` `csp` `apk` `graphql` `asset-discovery` `asn` `network-mapping` `wordlist` `permutation` `jwt` `path-traversal` `cache-vuln` `prototypepollution` `prototype-pollution` `header` `smuggle` `fuzz` `ssrf` `crlf` `ssti` `dependency-confusion` `nosqli` `403` `xss` `sqli` `lfi` `open-redirect` `aaa` `broken-link` `vulnerability-scanner` `web-scanner` `sast` `code-analysis` `s3` `oast` `dependency-scanning` `cors` `container-security` `sbom` `aws` `security` `terraform` `secret-scanning` `credentials` `rfi` `authentication` `xxe` `rop` `RMI` `race-condition` `deserialize` `diff` `package-manager` `tools-management` `dom` `blind-xss` `payload` `browser-record` `json` `web3` `nuclei-templates` `notify` `documents` `gRPC-Web` `note` `clipboard` `cookie` `encode` `darkmode` `cidr` `network` `ip-manipulation` `zipbomb`
Langs	`Go` `Java` `Python` `Ruby` `Shell` `JavaScript` `Rust` `C` `Crystal` `Kotlin` `Perl` `C#` `TypeScript` `HTML` `BlitzBasic` `C++` `CSS` `Txt` `PHP`

Tools

Type	Name	Description	Tags
Army-Knife	jaeles	The Swiss Army knife for automated Web Application Testing	`live-audit`
Army-Knife	ZAP	The ZAP core project	`mitmproxy` `live-audit` `crawl`
Army-knife	Baudrillard Suite	Cross-platform security research toolkit with OSINT aggregation, memory forensics, social engineering tools, steganography, and predictive threat modeling.	`osint` `recon` `forensics` `social-engineering` `steganography`
Army-knife	Ronin	Free and Open Source Ruby Toolkit for Security Research and Development	`pentest` `crawl` `recon` `exploit`
Army-Knife	Darkmoon	Autonomous AI penetration testing platform with agentic reasoning and real exploit execution across web, cloud, identity, CI/CD, Active Directory and Kubernetes	`pentest` `exploit` `recon` `cloud` `report`
Army-Knife	BurpSuite	The BurpSuite Project	`mitmproxy` `live-audit` `crawl`
Army-Knife	Metasploit	The world’s most used penetration testing framework	`pentest`
Army-Knife	axiom	A dynamic infrastructure toolkit for red teamers and bug bounty hunters!	`infra`
Proxy	Glorp	A CLI-based HTTP intercept and replay proxy	`mitmproxy`
Proxy	Echo Mirage	A generic network proxy that uses DLL injection to capture and alter TCP traffic.	`mitmproxy`
Proxy	hetty	Hetty is an HTTP toolkit for security research. It aims to become an open source alternative to commercial software like Burp Suite Pro, with powerful features tailored to the needs of the infosec and bug bounty community.	`mitmproxy`
Proxy	Caido	A lightweight web security auditing toolkit	`mitmproxy`
Proxy	EvilProxy	A ruby http/https proxy to do EVIL things.	`mitmproxy`
Proxy	proxify	Swiss Army knife Proxy tool for HTTP/HTTPS traffic capture, manipulation and replay	`mitmproxy`
Proxy	mitmproxy	An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.	`mitmproxy`
Recon	goverview	goverview - Get an overview of the list of URLs	`url`
Recon	intrigue-core	Discover Your Attack Surface
Recon	FavFreak	Making Favicon.ico based Recon Great again !
Recon	gitrob	Reconnaissance tool for GitHub organizations
Recon	knock	Knock Subdomain Scan	`subdomains`
Recon	Amass	In-depth Attack Surface Mapping and Asset Discovery	`subdomains`
Recon	masscan	TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.	`portscan`
Recon	bbot	OSINT automation for hackers	`osint`
Recon	scilla	🏴‍☠️ Information Gathering tool 🏴‍☠️ dns/subdomain/port enumeration	`subdomains` `dns` `port`
Recon	SubBrute	https://github.com/TheRook/subbrute	`subdomains`
Recon	SecurityTrails	Online dns / subdomain / recon tool	`subdomains` `online`
Recon	Lepus	Subdomain finder	`subdomains`
Recon	lazyrecon	This script is intended to automate your reconnaissance process in an organized fashion
Recon	subfinder	Subfinder is a subdomain discovery tool that discovers valid subdomains for websites. Designed as a passive framework to be useful for bug bounties and safe for penetration testing.	`subdomains`
Recon	assetfinder	Find domains and subdomains related to a given domain	`subdomains`
Recon	urlhunter	a recon tool that allows searching on URLs that are exposed via shortener services	`url`
Recon	dirsearch	Web path scanner
Recon	waymore	Find way more from the Wayback Machine, Common Crawl, Alien Vault OTX, URLScan, VirusTotal & Intelligence X!	`url`
Recon	Osmedeus	Fully automated offensive security framework for reconnaissance and vulnerability scanning
Recon	spiderfoot	SpiderFoot automates OSINT collection so that you can focus on analysis.	`osint`
Recon	dnsvalidator	Maintains a list of IPv4 DNS servers by verifying them against baseline servers, and ensuring accurate responses.	`dns`
Recon	aquatone	A Tool for Domain Flyovers	`domain`
Recon	urx	Extracts URLs from OSINT Archives for Security Insights	`url`
Recon	crawlergo	A powerful browser crawler for web vulnerability scanners	`crawl`
Recon	shuffledns	shuffleDNS is a wrapper around massdns written in go that allows you to enumerate valid subdomains using active bruteforce as well as resolve subdomains with wildcard handling and easy input-output support.	`dns`
Recon	subzy	Subdomain takeover vulnerability checker	`subdomains` `takeover`
Recon	github-endpoints	Find endpoints on GitHub.
Recon	tlsx	Fast and configurable TLS grabber focused on TLS based data collection	`ssl` `tls` `certificates`
Recon	waybackurls	Fetch all the URLs that the Wayback Machine knows about for a domain	`url`
Recon	SecretFinder	SecretFinder - A python script for find sensitive data (apikeys, accesstoken,jwt,…) and search anything on javascript files
Recon	longtongue	Customized Password/Passphrase List inputting Target Info
Recon	3klCon	Automation Recon tool which works with Large & Medium scopes. It performs more than 20 tasks and gets back all the results in separated files.
Recon	pagodo	pagodo (Passive Google Dork) - Automate Google Hacking Database scraping and searching
Recon	BLUTO	DNS Analysis Tool	`dns`
Recon	github-subdomains	Find subdomains on GitHub	`subdomains`
Recon	meg	Fetch many paths for many hosts - without killing the hosts
Recon	STEWS	A Security Tool for Enumerating WebSockets
Recon	zdns	Fast CLI DNS Lookup Tool	`dns`
Recon	favirecon	Use favicon.ico to improve your target recon phase. Quickly detect technologies, WAF, exposed panels, known services.	`favicon`
Recon	Sub404	A python tool to check subdomain takeover vulnerability	`subdomains` `takeover`
Recon	ParamSpider	Mining parameters from dark corners of Web Archives	`param`
Recon	OneForAll	OneForAll是一款功能强大的子域收集工具
Recon	Photon	Incredibly fast crawler designed for OSINT.	`osint` `crawl`
Recon	HydraRecon	All In One, Fast, Easy Recon Tool
Recon	csprecon	Discover new target domains using Content Security Policy	`csp`
Recon	Sublist3r	Fast subdomains enumeration tool for penetration testers	`subdomains`
Recon	katana	A next-generation crawling and spidering framework.	`crawl`
Recon	Silver	Mass scan IPs for vulnerable services	`port`
Recon	cc.py	Extracting URLs of a specific target based on the results of “commoncrawl.org”	`url`
Recon	altdns	Generates permutations, alterations and mutations of subdomains and then resolves them	`dns` `subdomains`
Recon	noir	Attack surface detector that identifies endpoints by static analysis	`endpoint` `url` `attack-surface`
Recon	subjack	Subdomain Takeover tool written in Go	`subdomains` `takeover`
Recon	apkleaks	Scanning APK file for URIs, endpoints & secrets.	`apk` `url` `endpoint`
Recon	xnLinkFinder	A python tool used to discover endpoints (and potential parameters) for a given target	`js-analysis`
Recon	naabu	A fast port scanner written in go with focus on reliability and simplicity. Designed to be used in combination with other tools for attack surface discovery in bug bounties and pentests	`portscan`
Recon	reconftw	reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities
Recon	graphw00f	GraphQL Server Engine Fingerprinting utility	`graphql`
Recon	gospider	Gospider - Fast web spider written in Go	`crawl`
Recon	findomain	The fastest and cross-platform subdomain enumerator, do not waste your time.	`subdomains`
Recon	Shodan	World’s first search engine for Internet-connected devices	`osint`
Recon	uncover	Quickly discover exposed hosts on the internet using multiple search engine.
Recon	parameth	This tool can be used to brute discover GET and POST parameters
Recon	fhc	Fast HTTP Checker.
Recon	Smap	a drop-in replacement for Nmap powered by shodan.io	`port`
Recon	puredns	Puredns is a fast domain resolver and subdomain bruteforcing tool that can accurately filter out wildcard subdomains and DNS poisoned entries.	`subdomains` `dns`
Recon	subjs	Fetches javascript file from a list of URLS or subdomains.	`url` `subdomains`
Recon	RustScan	Faster Nmap Scanning with Rust	`portscan`
Recon	dnsprobe	DNSProb (beta) is a tool built on top of retryabledns that allows you to perform multiple dns queries of your choice with a list of user supplied resolvers.	`dns`
Recon	LinkFinder	A python script that finds endpoints in JavaScript files	`js-analysis`
Recon	gauplus	A modified version of gau for personal usage. Support workers, proxies and some extra things.	`url`
Recon	subs_all	Subdomain Enumeration Wordlist. 8956437 unique words. Updated.	`subdomains`
Recon	HostHunter	Recon tool for discovering hostnames using OSINT techniques.	`osint`
Recon	DNSDumpster	Online dns recon & research, find & lookup dns records	`dns` `online`
Recon	htcat	Parallel and Pipelined HTTP GET Utility
Recon	SubOver	A Powerful Subdomain Takeover Tool	`subdomains` `takeover`
Recon	sn0int	Semi-automatic OSINT framework and package manager	`osint`
Recon	Parth	Heuristic Vulnerable Parameter Scanner	`param`
Recon	cloudlist	Cloudlist is a tool for listing Assets from multiple Cloud Providers	`cloud` `asset-discovery`
Recon	subgen	A really simple utility to concate wordlists to a domain name - to pipe into your favourite resolver!	`subdomains`
Recon	go-dork	The fastest dork scanner written in Go.
Recon	asnmap	Go CLI and Library for quickly mapping organization network ranges using ASN information	`asn` `network-mapping`
Recon	Hunt3r	Made your bugbounty subdomains reconnaissance easier with Hunt3r the web application reconnaissance framework
Recon	JSFScan.sh	Automation for javascript recon in bug bounty.	`js-analysis`
Recon	recon_profile	Recon profile (bash profile) for bugbounty
Recon	BugBountyScanner	A Bash script and Docker image for Bug Bounty reconnaissance.
Recon	gau	Fetch known URLs from AlienVault’s Open Threat Exchange, the Wayback Machine, and Common Crawl.	`url`
Recon	x8	Hidden parameters discovery suite
Recon	CT_subdomains	An hourly updated list of subdomains gathered from certificate transparency logs	`subdomains`
Recon	jsluice	Extract URLs, paths, secrets, and other interesting bits from JavaScript	`js-analysis`
Recon	dmut	A tool to perform permutations, mutations and alteration of subdomains in golang.	`subdomains`
Recon	hakrevdns	Small, fast tool for performing reverse DNS lookups en masse.
Recon	Chaos Web	actively scan and maintain internet-wide assets’ data. enhance research and analyse changes around DNS for better insights.
Recon	uro	declutters url lists for crawling/pentesting	`url`
Recon	xurlfind3r	A command-line utility designed to discover URLs for a given domain in a simple, efficient way.	`url`
Recon	megplus	Automated reconnaissance wrapper — TomNomNom’s meg on steroids. [DEPRECATED]
Recon	rusolver	Fast and accurate DNS resolver.	`dns`
Recon	dnsx	dnsx is a fast and multi-purpose DNS toolkit allow to run multiple DNS queries of your choice with a list of user-supplied resolvers.	`dns`
Recon	rengine	reNgine is an automated reconnaissance framework meant for gathering information during penetration testing of web applications. reNgine has customizable scan engines, which can be used to scan the websites, endpoints, and gather information.
Recon	Sudomy	subdomain enumeration tool to collect subdomains and analyzing domains	`subdomains`
Recon	cariddi	Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more	`crawl`
Recon	GitMiner	Tool for advanced mining for content on Github
Recon	haktrails	Golang client for querying SecurityTrails API data
Recon	getJS	A tool to fastly get all javascript sources/files	`js-analysis`
Recon	ParamWizard	ParamWizard is a powerful Python-based tool designed for extracting and identifying URLs with parameters from a specified website.	`param`
Recon	Arjun	HTTP parameter discovery suite.	`param`
Recon	httpx	httpx is a fast and multi-purpose HTTP toolkit allow to run multiple probers using retryablehttp library, it is designed to maintain the result reliability with increased threads.	`url`
Recon	chaos-client	Go client to communicate with Chaos DNS API.
Recon	hakrawler	Simple, fast web crawler designed for easy, quick discovery of endpoints and assets within a web application	`crawl`
Recon	alterx	Fast and customizable subdomain wordlist generator using DSL	`subdomains` `wordlist` `permutation`
Recon	shosubgo	Small tool to Grab subdomains using Shodan api.	`subdomains`
Recon	gowitness	🔍 gowitness - a golang, web screenshot utility using Chrome Headless
Recon	gobuster	Directory/File, DNS and VHost busting tool written in Go	`subdomains`
Fuzzer	CrackQL	CrackQL is a GraphQL password brute-force and fuzzing utility.	`graphql`
Fuzzer	c-jwt-cracker	JWT brute force cracker written in C	`jwt`
Fuzzer	Clairvoyance	Obtain GraphQL API schema even if the introspection is disabled	`graphql`
Fuzzer	wfuzz	Web application fuzzer
Fuzzer	dotdotpwn	DotDotPwn - The Directory Traversal Fuzzer	`path-traversal`
Fuzzer	ParamPamPam	This tool for brute discover GET and POST parameters.	`param` `cache-vuln`
Fuzzer	ppfuzz	A fast tool to scan client-side prototype pollution vulnerability written in Rust. 🦀	`prototypepollution` `prototype-pollution`
Fuzzer	hashcat	World’s fastest and most advanced password recovery utility
Fuzzer	kiterunner	Contextual Content Discovery Tool
Fuzzer	headerpwn	A fuzzer for finding anomalies and analyzing how servers respond to different HTTP headers	`header`
Fuzzer	SmuggleFuzz	A rapid HTTP downgrade smuggling scanner written in Go.	`smuggle` `fuzz`
Fuzzer	thc-hydra	hydra
Fuzzer	fuzzparam	A fast go based param miner to fuzz possible parameters a URL can have.	`param`
Fuzzer	BruteX	Automatically brute force all services running on a target.
Fuzzer	BatchQL	GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations	`graphql`
Fuzzer	jwt-hack	🔩 jwt-hack is tool for hacking / security testing to JWT. Supported for En/decoding JWT, Generate payload for JWT attack and very fast cracking(dict/brutefoce)	`jwt`
Fuzzer	medusa	Fastest recursive HTTP fuzzer, like a Ferrari.
Fuzzer	jwt-cracker	Simple HS256 JWT token brute force cracker	`jwt`
Fuzzer	SSRFmap	Automatic SSRF fuzzer and exploitation tool	`ssrf`
Fuzzer	crlfuzz	A fast tool to scan CRLF vulnerability written in Go	`crlf`
Fuzzer	SSTImap	Automatic SSTI detection tool with interactive interface	`ssti`
Fuzzer	feroxbuster	A fast, simple, recursive content discovery tool written in Rust.
Fuzzer	GraphQLmap	GraphQLmap is a scripting engine to interact with a graphql endpoint for pentesting purposes.	`graphql`
Fuzzer	SSRFire	An automated SSRF finder. Just give the domain name and your server and chill	`ssrf`
Fuzzer	ffuf	Fast web fuzzer written in Go
Scanner	LFISuite	Totally Automatic LFI Exploiter (+ Reverse Shell) and Scanner
Scanner	depenfusion	A powerful pentesting tool for detecting and exploiting dependency confusion vulnerabilities in Node.js projects	`dependency-confusion`
Scanner	nosqli	NoSql Injection CLI tool	`nosqli`
Scanner	DirDar	DirDar is a tool that searches for (403-Forbidden) directories to break it and get dir listing on it	`403`
Scanner	gitGraber	gitGraber
Scanner	PPScan	Client Side Prototype Pollution Scanner	[`prototypepollution`](/categorize/tags/pro