supr4s / vps-web-hacking-tools

Automatically install some web hacking/bug bounty tools.

WebHackingTools

Automatically install some web hacking/bug bounty tools for your VPS/hacking station.

O.S supported ✔️

• Debian 11 x64

• Kali Linux 2022.4 x64

• Linux Mint 21 x64

• Ubuntu 22.04 x64

Installation

💻 Manual: laptop/VPS/other

apt-get update -y && apt-get install git -y
cd /tmp && git clone https://github.com/supr4s/WebHackingTools && cd WebHackingTools && ./installer.sh

🐳 Docker

A Docker version is available, see https://hub.docker.com/r/supr4s/webhackingtools

docker pull supr4s/webhackingtools
docker run --name webhackingtools -it supr4s/webhackingtools

To leave the container but leave it running:

ctrl + p and ctrl + q 

To re-attach to the container:

docker attach webhackingtools

Available tools list

Subdomains enumeration

• Amass
• Assetfinder
• Crobat
• Findomain
• Github-subdomains
• Gitlab-subdomains *
• Subfinder

DNS resolver

• dnsx
• MassDNS
• PureDNS

HTTP probe

• httprobe
• httpx

Visual recon

• Aquatone
• Gowitness

Network scanner

• Masscan
• Naabu
• Nmap
• Smap *

Web crawler

• Gospider
• Hakrawler
• Katana *

HTTP parameter

• Arjun
• x8

JavaScript hunting

• LinkFinder
• SecretFinder
• subjs
• xnLinkFinder *

Bypass 40X (new)

• dontgo403 *

CORS tools (new)

• Corsy *
• CORScanner *

Fuzzing tools

• ffuf
• Gobuster
• wfuzz
• fuzzuli *

Prototype pollution (new)

• ppfuzz *
• ppmap *

LFI tools

• LFISuite

SSRF tools

• SSRFmap
• Gopherus
• Interactsh
• AutoSSRF *

SSTI tools

• tplmap

API hacking tools

• Kiterunner + API routes

Vulns - XSS

• Dalfox
• kxss
• XSStrike

Vulns - SQL Injection

• NoSQLMap
• SQLMap

Vulns - Scanner

• Jaeles
• Nikto **
• Nuclei

CMS Scanner

• WPscan
• droopescan
• AEM-Hacker

Wordlists

• SecLists
• OneForAll *

Git hunting

• GitDorker
• gitGraber
• GitHacker
• GitTools

Sensitive stuff finding

• DumpsterDiver
• EarlyBird
• Ripgrep
• Trufflehog *

Useful tools

• anew
• anti-burl
• getallurls
• gron
• Interlace
• jq
• qsreplace
• Tmux
• unfurl
• Uro

Note

• Refer to the usage of the tools as most of them require configuration (especially for subdomains enumeration).
• Please be careful with these tools and only use them on targets you have explicitly authorized.

N.B : * = added in the last update

** For Nikto and Debian 10, you need to have the non-free contrib sources in addition. e.g :

deb http://deb.debian.org/debian/ buster main contrib non-free
deb-src http://deb.debian.org/debian/ buster main contrib non-free

vps-web-hacking-tools's Issues

Wfuzz ?

How about adding wfuzz

ShellCheck the code + Check whether a tool is installed

I would like to make two PRs but I need your opinion first.

1. ShellCheck the shell code and make it a little bit different.
2. Check if a tool is installed before proceeding with a download install.

what do you think please ?

Vps setup script

PDTM for all

Hi,

Please consider using pdtm for installing ll projectdiscovery related tools.

https://github.com/projectdiscovery/pdtm

A fierce competition

Hi @supr4s

You are getting some competition ... a docker image with the most commonly used bug bounty-hunting 🐛 tools (apentestbox).

A different approach, for sure, when you don't wanna mess with the main machine.

Have a nice day.
@Sim4n6

dirsearch

maybe dirsearch also a good tool

Kali linux unrecognized

I face this error while executing this script

[ENVIRONMENT] Packages required installation in progress ...
O.S unrecognized
End of the script

uname -a
Linux kali 5.7.0-kali1-amd64 #1 SMP Debian 5.7.6-1kali2 (2020-07-01) x86_64 GNU/Linux

Rustscan nd corsy

How about adding rustscan please? And corsy?

VPS ?

which vps service do you use for hacking?
gcloud almost ban me for some pentest.