Web App Scanning Utilities
Scanning for the technology used within your target. Understand how it works, to understand how to break it.
Visual scanning with Screenshots
Target pages can provide a wealth of information, and screenshots are useful evidence for reports. These tools help collect screenshots and web metadata at scale.
Screenshot tools
gowitness - A website screenshot utility written in Golang, that uses Chrome Headless to generate screenshots of web interfaces using the command line, with a handy report viewer to process results.
eyeballer - Eyeballer is meant for large-scope network penetration tests where you need to find "interesting" targets from a huge set of web-based hosts. Go ahead and use your favorite screenshotting tool like normal (EyeWitness or GoWitness) and then run them through Eyeballer to tell you what's likely to contain vulnerabilities, and what isn't.
EyeWitness - EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.
Web Application Fingerprinting
Web-Based Utilities
These tools can support passive web fingerprinting without directly interacting with the target infrastructure beyond the service you are querying.
Netcraft - Offers a slew of tools including a handy browser extension for on demand scanning of websites for reputation and technical data.
Wappalyzer - Scanning tool that can determine the web technologies that are used on the target web page.
BuiltWith - Similar technology fingerprinting and company/web stack lookup.
Visual Site Mapper - Handy tool for conceptualizing a target website in a different way.
Mozilla Observatory - Fantastic resource that will scan for HTTP, SSL, and TLS settings and return with an overall grade based on a scored checklist. Can be run to include a few other popular third party scanning utilities for even easier recon.
Qualys SSL Labs test - Scan and score SSL/TLS settings.
Security Headers - Analyze the data found in HTTP responses to a domain
CLI Based Utilities
What Web - WhatWeb recognizes web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 1800 plugins, each to recognize something different. WhatWeb also identifies version numbers, email addresses, account IDs, web framework modules, SQL errors, and more.
wafw00f - WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.
Blind Elephant - Legacy web application fingerprinter. Kept for historical context; verify current usefulness before relying on it.
Virtual Host Scanner - A virtual host scanner that can be used with pivot tools, detect catch-all scenarios, aliases and dynamic default pages.
https://whatcms.org/ - Web based tool to determine what CMS a site is using.
httprint - httprint is a web server fingerprinting tool. It relies on web server characteristics to accurately identify web servers, despite the fact that they may have been obfuscated by changing the server banner strings, or by plug-ins such as mod_security or servermaskd
Web Vulnerability Scanning
Web App Vuln Scanning Tools
Nikto - Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 6700 potentially dangerous files/programs, checks for outdated versions of over 1250 servers, and version specific problems on over 270 servers.
Nikto web server scan
Arachni - Retired Ruby web application scanner. Kept as a legacy reference; prefer maintained tools such as OWASP ZAP, Nuclei, Wapiti, or commercial DAST platforms for current work.
W3AF - w3af: web application attack and audit framework, the open source web vulnerability scanner.
Wapiti - Wapiti allows you to audit the security of your websites or web applications.
It performs "black-box" scans (it does not study the source code) of the web application by crawling the webpages of the deployed webapp, looking for scripts and forms where it can inject data.
Vega Scanner - Legacy Subgraph web scanner. Project activity appears limited; verify maintenance before use.
WAVE - Web Application Vulnerability Exploiter scanner.
https://snyk.io/website-scanner/ - Get a full website security check for known vulnerabilities and HTTP security headers
SSL Scanning
SSL/TLS Scanning Tools
sslscan - SSLScan queries SSL services, such as HTTPS, in order to determine the ciphers that are supported. SSLScan is designed to be easy, lean and fast. The output includes preferred ciphers of the SSL service, the certificate and is in text and XML formats.
tlssled - TLSSLed evaluates SSL/TLS configuration and is based on sslscan.
sslyze - SSLyze is a Python tool that can analyze the SSL configuration of a server by connecting to it. It is designed to be fast and comprehensive, and should help organizations and testers identify misconfigurations affecting their SSL servers.
testssl.sh - testssl.sh is a free command line tool which checks a server’s service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.
o-saft - O-Saft is an easy to use tool to show information about SSL certificates and tests the SSL connection according to a given list of ciphers and various SSL configurations.
qsslcaudit - This tool can be used to determine if an application that uses TLS/SSL for its data transfers does this in a secure way.
CMS Scanners
CMSMap - CMSmap is a python open source CMS scanner that automates the process of detecting security flaws of the most popular CMSs. The main purpose of CMSmap is to integrate common vulnerabilities for different types of CMSs in a single tool.
CMSScan - CMS Scanner: Scan Wordpress, Drupal, Joomla, vBulletin websites for Security issues
CMSeeK - CMS Detection and Exploitation suite - Scan WordPress, Joomla, Drupal and over 180 other CMSs
Droopscan - plugin-based scanner that aids security researchers in identifying issues with several CMS.
Vulnx - Vulnx is An Intelligent Bot Auto Shell Injector that detects vulnerabilities in multiple types of Cms, fast cms detection,informations gathering and vulnerabilitie Scanning of the target like subdomains, ipaddresses, country, org, timezone, region, ans and more ...
WPScan - The Wordpress Vulnerability Scanner
https://wpsec.com/ - Online Wordpress scanner
Wordpress Exploit Framework - A Ruby framework designed to aid in the penetration testing of WordPress systems.
WPSploit - This repository is designed for creating and/or porting of specific exploits for WordPress using metasploit as exploitation tool.
Parameter Extraction
Parameter Extraction Tools
ParamSpider - Utility that scans the domain and sub-domains for exploitable parameters
Parameth - This tool can be used to brute discover GET and POST parameters
Arjun - Arjun can find query parameters for URL endpoints.
Sh1Yo/x8 - Hidden parameters discovery suite
Burp Suite Extension: Param Miner - This extension identifies hidden, unlinked parameters. It's particularly useful for finding web cache poisoning vulnerabilities.
ffuf - Fast web fuzzer written in Go for directory discovery, virtual host discovery, and GET/POST parameter fuzzing.
Misc Tools
Misc Tools
Photon - Fast crawler designed for OSINT-style web endpoint discovery.
URLgrab - Go utility for spidering a website and collecting links.
hakrawler - Simple web crawler for endpoint discovery.
gospider - Fast web spider written in Go.
filebuster - HTTP fuzzer and content discovery tool.
feroxbuster - Forced browsing and content discovery tool.
BFAC - BFAC (Backup File Artifacts Checker): An automated tool that checks for backup artifacts that may disclose the web-application's source code.
csprecon - Discover new target domains using Content Security Policy
RetireJS - Scanner to detect javascript libraries and known vulnerabilities within them.
SnallyGaster - Snallygaster is a tool that looks for files accessible on web servers that shouldn't be public and can pose a security risk.
Broken Link Checker - Find broken links, missing images, etc within your HTML.
AAP - AAP Finder (Advanced Admin Page Finder) is a tool written in Python3 with advanced functionalities, with more than 700+ Potential Admin Panels. This Tool Can Easily Find Login Pages of Any Site & is also capable to detect robots.txt File.
Admin-Scanner - This tool is design to find admin panel of any website by using custom wordlist or default wordlist easily and allow you to find admin panel trough a proxy server.
Breacher - An advanced multithreaded admin panel finder written in python.
JS-Scan - JavaScript scanner built in PHP for scraping URLs and other information.
SecretFinder - Python script for finding sensitive data such as API keys, access tokens, JWTs, and other strings in JavaScript files.
certgraph - Crawls certificate Subject Alternative Names and builds a domain graph. Passive certificate discovery also belongs in Cyber Intelligence.
changeme - Default credential scanner supporting HTTP/S, MSSQL, MySQL, Postgres, SSH, and SSH keys.
CSP Evaluator - Checks whether a Content Security Policy is a strong mitigation against XSS.
oxdork - Google dorking helper. Google dorking methodology is maintained in Cyber Intelligence.
subjs - Fetches javascript file from a list of URLS or subdomains.
RequestBin - Collect and inspect HTTP requests and webhooks.
Race the Web - Tests for race conditions in web applications.
DVCS-Ripper - Finds and downloads web-accessible SVN, Git, Mercurial, and Bazaar repositories.
interactsh - Out-of-band interaction server and client for vulnerability validation.
GoodFaith - Helps keep bug bounty recon automation within authorized scope.
Stripe Test Cards - Test card numbers for payment workflow testing.
Interlace - Easily turn single threaded command line applications into a fast, multi-threaded application with CIDR and glob support.
Last updated