Web Hacker's Weapons
A collection of cool tools used by Web hackers. Happy hacking , Happy bug-hunting
## Category
- [Weapons](#weapons)
- [Main Weapon](#main-weapon)
- [Subdomain Enumeration](#subdomain-enumeration)
- [Fetch path and host](#fetch-path-and-host)
- [Port scanner](#port-scanner)
- [Web Discovery](#web-discovery)
- [Web Vulnerability Scanner](#web-vulnerability-scanner)
- [XSS](#xss)
- [CSRF](#csrf)
- [Path traversal / Directory traversal / LFI](#path-traversal--directory-traversal--lfi)
- [Command Injection](#command-injection)
- [SQL Injection](#sql-injection)
- [NoSQL Injection](#nosql-injection)
- [SSRF](#ssrf)
- [CORS Misconfiguration](#cors-misconfiguration)
- [WebSocket](#websocket)
- [Cloud Security](#cloud-security)
- [Utility for hackers](#utility-for-hackers)
- [Contribute](#contribute-and-contributor)
## Weapons
### Main Weapon
asdf
### Subdomain Enumeration
| Name | Description | Popularity | Language | Metadata |
| ---------- | :---------- | :----------: | :----------: | :----------: |
| [findomain](https://github.com/Edu4rdSHL/findomain) | The fastest and cross-platform subdomain enumerator, do not waste your time. |  |  | 
 |
| [subfinder](https://github.com/projectdiscovery/subfinder) | Subfinder is a subdomain discovery tool that discovers valid subdomains for websites. Designed as a passive framework to be useful for bug bounties and safe for penetration testing. |  |  | 
 |
| [Amass](https://github.com/OWASP/Amass) | In-depth Attack Surface Mapping and Asset Discovery |  |  | 
 |
| [Sublist3r](https://github.com/aboul3la/Sublist3r) | Fast subdomains enumeration tool for penetration testers |  |  | 
 |
| [assetfinder](https://github.com/tomnomnom/assetfinder) | Find domains and subdomains related to a given domain |  |  | 
 |
### Fetch path and host
| Name | Description | Popularity | Language | Metadata |
| ---------- | :---------- | :----------: | :----------: | :----------: |
| [meg](https://github.com/tomnomnom/meg) | Fetch many paths for many hosts - without killing the hosts |  |  | 
 |
| [httprobe](https://github.com/tomnomnom/httprobe) | Take a list of domains and probe for working HTTP and HTTPS servers |  |  | 
 |
### Port scanner
| Name | Description | Popularity | Language | Metadata |
| ---------- | :---------- | :----------: | :----------: | :----------: |
| [nmap](https://github.com/nmap/nmap) | Nmap - the Network Mapper. Github mirror of official SVN repository. |  |  | 
 |
| [naabu](https://github.com/projectdiscovery/naabu) | A fast port scanner written in go with focus on reliability and simplicity. Designed to be used in combination with other tools for attack surface discovery in bug bounties and pentests |  |  | 
 |
| [masscan](https://github.com/robertdavidgraham/masscan) | TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes. |  |  | 
 |
### Web Discovery
| Name | Description | Popularity | Language | Metadata |
| ---------- | :---------- | :----------: | :----------: | :----------: |
| [gospider](https://github.com/jaeles-project/gospider) | Gospider - Fast web spider written in Go |  |  | 
 |
| [gobuster](https://github.com/OJ/gobuster) | Directory/File, DNS and VHost busting tool written in Go |  |  | 
 |
| [LinkFinder](https://github.com/GerbenJavado/LinkFinder) | A python script that finds endpoints in JavaScript files |  |  | 
 |
| [wfuzz](https://github.com/xmendez/wfuzz) | Web application fuzzer |  |  | 
 |
### Web Vulnerability Scanner
| Name | Description | Popularity | Language | Metadata |
| ---------- | :---------- | :----------: | :----------: | :----------: |
| [jaeles](https://github.com/jaeles-project/jaeles) | The Swiss Army knife for automated Web Application Testing |  |  | 
 |
| [wpscan](https://github.com/wpscanteam/wpscan) | WPScan is a free, for non-commercial use, black box WordPress Vulnerability Scanner written for security professionals and blog maintainers to test the security of their WordPress websites. |  |  | 
 |
| [Wordpresscan](https://github.com/swisskyrepo/Wordpresscan) | WPScan rewritten in Python + some WPSeku ideas |  |  | 
 |
| [arachni](https://github.com/Arachni/arachni) | Web Application Security Scanner Framework |  |  | 
 |
| [testssl.sh](https://github.com/drwetter/testssl.sh) | Testing TLS/SSL encryption anywhere on any port |  |  | 
 |
| [a2sv](https://github.com/hahwul/a2sv) | Auto Scanning to SSL Vulnerability |  |  | 
 |
### XSS
| Name | Description | Popularity | Language | Metadata |
| ---------- | :---------- | :----------: | :----------: | :----------: |
| [XSStrike](https://github.com/s0md3v/XSStrike) | Most advanced XSS scanner. |  |  | 
 |
| [XSpear](https://github.com/hahwul/XSpear) | Powerfull XSS Scanning and Parameter analysis tool&gem |  |  | 
 |
| [XSSCon](https://github.com/menkrep1337/XSSCon) | XSSCon |  |  | 
 |
### CSRF
### Path traversal / Directory traversal / LFI
### Command Injection
### SQL Injection
### NoSQL Injection
### SSRF
### CORS Misconfiguration
### WebSocket
### Cloud Security
### Utility for hackers
## Contribute and Contributor
### Usage of weapon-md
```
./weapon-md
Usage of ./weapon-md:
-isFirst
if you add new type, it use
-url string
github / gitlab / bitbucket url
```
### Three Procedures for the Contribute
- First, generate markdown code using `weapon-md`
```
$ ./weapon-md -url https://github.com/hahwul/xspear
| [xspear](https://github.com/hahwul/xspear) | Powerfull XSS Scanning and Parameter analysis tool&gem |  |  | 
 |
```
- Second, Give me PR or Add issue with output code
- Third, There's no third.