hahwul/WebHackersWeapons

What it is

WebHackersWeapons is hahwul's GitHub README table of web-hacking tools. It is organised as four sections: Tools, Bookmarklets, Browser Addons, and Burpsuite/Caido/ZAP Addons. A sibling list, MobileHackersWeapons, covers mobile. Contributions go through CONTRIBUTING.md.

How to use it

Every Tools row has a Type, Name, one-line description, a live GitHub star badge, tags, and badges for OS support and implementation language. Types are Army-Knife, Proxy, Recon, Fuzzer, Scanner, Exploit, Env, Utils and Etc. Tags and languages link to generated pages under /categorize/tags/ and /categorize/langs/, so you can filter, for example, to subdomains, takeover, graphql, jwt or Rust. The tag set is wide: it includes ssrf, ssti, xxe, race-condition, deserialize, smuggle, cors, prototype-pollution, dependency-confusion, sast and secret-scanning.

What the visible part contains

The fetched text covers Army-Knife, Proxy, Recon and part of Fuzzer.

• Army-Knife: jaeles, ZAP, BurpSuite, Metasploit, axiom, Ronin, Baudrillard Suite and Darkmoon.
• Proxy: Caido, hetty, mitmproxy, proxify, Glorp and EvilProxy.
• Recon: the largest group, dominated by subdomain, URL-archive and JavaScript tooling. Examples are subfinder, Amass, httpx, katana, naabu, dnsx, tlsx, gau, waybackurls, LinkFinder, jsluice, Arjun, x8, reconftw and Osmedeus.
• Fuzzer: GraphQL tools (Clairvoyance, BatchQL, CrackQL), JWT tools (jwt-hack, c-jwt-cracker), smuggling and header fuzzers, plus credential tools such as hashcat, thc-hydra and BruteX.

Caveats

• The fetched text is the first 60,000 of about 168,800 characters. It ends mid-Fuzzer, so the Scanner, Exploit, Env, Utils and Etc rows, the bookmarklets, the browser addons, and the Burp, Caido and ZAP addon sections were not seen.
• Row quality varies. The SubBrute row links to aboul3la/Sublist3r while its description points to TheRook/subbrute. Sub404 is described as a Python tool but carries the Go badge. megplus is marked [DEPRECATED] and is still listed. Many rows have no tags.
• The page gives no vetting, maintenance dates or safety notes. Newer entries such as Baudrillard Suite and Darkmoon (described as running "real exploit execution") are listed with only a star badge.
• Some entries are hosted services or non-GitHub links, such as SecurityTrails, Shodan, DNSDumpster and Echo Mirage (Windows only). Others, such as noir, have no Windows badge.