Web Hacker's Weapons
< Burp and ZAP Extensions >
A collection of cool tools used by Web hackers. Happy hacking , Happy bug-hunting
This is Cool Extensions collection of Burp suite and ZAP
## Table of Contents
- [Web Hacker's Weapons Main](https://github.com/hahwul/WebHackersWeapons)
- [Cool Extensions](#cool-extensions)
- [Contribute](#contribute-and-contributor)
## Cool Extensions
| Type | Name | Description | Popularity | Language |
| ---------- | :---------- | :----------: | :----------: | :----------: |
| All/CODE | [http-script-generator](https://github.com/h3xstream/http-script-generator) | ZAP/Burp plugin that generate script to reproduce a specific HTTP request (Intended for fuzzing or scripted attacks) |  |  |
| All/PASV | [HUNT](https://github.com/bugcrowd/HUNT) | Data Driven web hacking Manual testing |  |  |
| All/PASV | [burp-retire-js](https://github.com/h3xstream/burp-retire-js) | Burp/ZAP/Maven extension that integrate Retire.js repository to find vulnerable Javascript libraries. |  |  |
| All/PASV | [csp-auditor](https://github.com/GoSecure/csp-auditor) | Burp and ZAP plugin to analyse Content-Security-Policy headers or generate template CSP configuration from crawling a Website |  |  |
| Burp/ACTIVE | [http-request-smuggler](https://github.com/PortSwigger/http-request-smuggler) | Testing HTTP Request Smuggling and Desync Attack |  |  |
| Burp/ACTIVE | [param-miner](https://github.com/PortSwigger/param-miner) | Parameter mining on Burpsuite |  |  |
| Burp/ACTIVE | [turbo-intruder](https://github.com/PortSwigger/turbo-intruder) | Turbo Intruder is a Burp Suite extension for sending large numbers of HTTP requests and analyzing the results. |  |  |
| Burp/AUTH | [AuthMatrix](https://github.com/SecurityInnovation/AuthMatrix) | AuthMatrix is a Burp Suite extension that provides a simple way to test authorization in web applications and web services. |  |  |
| Burp/BYPASS | [BurpSuiteHTTPSmuggler](https://github.com/nccgroup/BurpSuiteHTTPSmuggler) | A Burp Suite extension to help pentesters to bypass WAFs or test their effectiveness using a number of techniques |  |  |
| Burp/CALLBACK | [taborator](https://github.com/hackvertor/taborator) | A Burp extension to show the Collaborator client in a tab |  |  |
| Burp/CODE | [burp-exporter](https://github.com/artssec/burp-exporter) | Exporter is a Burp Suite extension to copy a request to the clipboard as multiple programming languages functions. |  |  |
| Burp/EXPORT | [burp-send-to](https://github.com/bytebutcher/burp-send-to) | Adds a customizable "Send to..."-context-menu to your BurpSuite. |  |  |
| Burp/GQL | [inql](https://github.com/doyensec/inql) | InQL - A Burp Extension for GraphQL Security Testing |  |  |
| Burp/HISTORY | [BurpSuiteLoggerPlusPlus](https://github.com/nccgroup/BurpSuiteLoggerPlusPlus) | Burp Suite Logger++ |  |  |
| Burp/PASV | [Autorize](https://github.com/Quitten/Autorize) | Automatic authorization enforcement detection extension for burp suite written in Jython developed by Barak Tawily in order to ease application security people work and allow them perform an automatic authorization tests |  |  |
| Burp/PASV | [BurpJSLinkFinder](https://github.com/InitRoot/BurpJSLinkFinder) | Burp Extension for a passive scanning JS files for endpoint links. |  |  |
| Burp/PASV | [BurpSuite-Secret_Finder](https://github.com/m4ll0k/BurpSuite-Secret_Finder) | Burp Suite extension to discover apikeys/accesstokens and sensitive data from HTTP response. |  |  |
| Burp/PASV | [auto-repeater](https://github.com/PortSwigger/auto-repeater) | Automated HTTP Request Repeating With Burp Suite |  |  |
| Burp/PASV | [collaborator-everywhere](https://github.com/PortSwigger/collaborator-everywhere) | A Burp Suite Pro extension which augments your proxy traffic by injecting non-invasive headers designed to reveal backend systems by causing pingbacks to Burp Collaborator |  |  |
| Burp/PASV | [femida](https://github.com/wish-i-was/femida) | Automated blind-xss search for Burp Suite |  |  |
| Burp/PASV | [reflected-parameters](https://github.com/PortSwigger/reflected-parameters) | Find reflected parameter on Burpsuite |  |  |
| Burp/PIPE | [burp-piper](https://github.com/silentsignal/burp-piper) | Piper Burp Suite Extender plugin |  |  |
| Burp/REPEAT | [IntruderPayloads](https://github.com/1N3/IntruderPayloads) | A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists. |  |  |
| Burp/REPEAT | [Stepper](https://github.com/CoreyD97/Stepper) | A natural evolution of Burp Suite's Repeater tool |  |  |
| Burp/SCAN | [BurpBounty](https://github.com/wagiro/BurpBounty) | Burp Bounty (Scan Check Builder in BApp Store) is a extension of Burp Suite that allows you, in a quick and simple way, to improve the active and passive scanner by means of personalized rules through a very intuitive graphical interface. |  |  |
| Burp/THEME | [BurpCustomizer](https://github.com/CoreyD97/BurpCustomizer) | Because just a dark theme wasn't enough! |  |  |
| Burp/UTIL | [safecopy](https://github.com/yashrs/safecopy) | Burp Extension for copying requests safely. It redacts headers like Cookie, Authorization and X-CSRF-Token for now. More support can be added in the future. |  |  |
| ZAP/INTERFACE | [zap-hud](https://github.com/zaproxy/zap-hud) | The OWASP ZAP Heads Up Display (HUD) |  |  |
| ZAP/JWT | [owasp-zap-jwt-addon](https://github.com/SasanLabs/owasp-zap-jwt-addon) | OWASP ZAP addon for finding vulnerabilities in JWT Implementations |  |  |
| ZAP/PASV | [attack-surface-detector-zap](https://github.com/secdec/attack-surface-detector-zap) | The Attack Surface Detector uses static code analyses to identify web app endpoints by parsing routes and identifying parameters |  |  |
| ZAP/PASV | [reflect](https://github.com/TypeError/reflect) | OWASP ZAP add-on to help find reflected parameter vulnerabilities |  |  |
| ZAP/SCRIPT | [community-scripts](https://github.com/zaproxy/community-scripts) | A collection of ZAP scripts provided by the community - pull requests very welcome! |  |  |
## Contribute and Contributor
### Usage of add-tool
```
./add-tool
Usage of ./add-tool:
-isFirst
if you add new type, it use
-url string
any url
```
### Three Procedures for the Contribute
- First, your tool append `data.json` using `add-tool
```
$ ./add-tool -url https://github.com/sqlmapproject/sqlmap
Successfully Opened type.lst
[0] Army-Knife
[1] Discovery
[2] Fetch
[3] Scanner
[4] Utility
[+] What is type?
3
Scanner
[+] What is method(e.g XSS, WVS, SSL, ETC..)?
SQL
Successfully Opened data.json
```
- Second, Give me PR or Add issue with data.json
- Third, There's no third.
### Add Burp Suite or ZAP Extensions
in `WebHackersWeapons/Burp and ZAP Extensions` directory
```
$ ../add-tool -url https://github.com/nccgroup/BurpSuiteLoggerPlusPlus
```
### Distribute to Burp Suite or ZAP Extensions
```
$ ../distribute-readme
=> show new README file in Burp Suite or ZAP Extensions
```
### Add/Distribute common tools
https://github.com/hahwul/WebHackersWeapons#contribute-and-contributor