Repolode
Submit
hahwul

hahwul/WebHackersWeapons

A curated awesome-list of tools, bookmarklets, browser addons and Burp/Caido/ZAP extensions used by web hackers and bug bounty hunters.

View on GitHub
Stars
5,092
Forks
853
Open issues
6
Last commit
last month

What is it?

WebHackersWeapons is a curated list of tools that web security researchers and bug bounty hunters use. Entries are grouped into categories such as tools, bookmarklets, browser addons, and Burp Suite, Caido and ZAP addons, and each tool is tagged by type (for example Recon, Proxy, Fuzzer, Scanner) and by technique (subdomains, portscan, xss, sqli, jwt, and so on).

The Tools section is the largest part of the list. It covers subdomain enumeration and DNS tools, URL and endpoint discovery from archives and crawlers, port scanners, intercepting proxies such as mitmproxy and Caido, and all-in-one frameworks like ZAP and Metasploit. Each row lists the project's language and the operating systems it supports, which helps when comparing options.

The repository is a directory rather than a software package, so there is nothing to install. It is useful as a starting point when you need a tool for a particular recon or testing step and want to see what the community commonly uses.

Key features

  • 01Lists tools grouped by type such as Recon, Proxy, Fuzzer and Scanner.
  • 02Covers subdomain enumeration, DNS lookup, port scanning and URL discovery.
  • 03Includes intercepting proxies like mitmproxy, Caido and hetty.
  • 04Shows language and OS support for each listed tool.
  • 05Provides browser addons, bookmarklets and Burp/Caido/ZAP extensions.

Use cases

  • Finding a subdomain enumeration or URL discovery tool for a bug bounty recon workflow.
  • Choosing an intercepting proxy for web application testing.
  • Browsing which tools the web security community commonly uses before writing your own scripts.

Topics

#web-security#bug-bounty#pentest#recon#awesome-list#security-tools#bugbounty#bugbountytips#hacking#hacktoberfest

FAQ

What is WebHackersWeapons?
A curated awesome-list of tools, bookmarklets, browser addons and Burp/Caido/ZAP extensions used by web hackers and bug bounty hunters. WebHackersWeapons is a curated list of tools that web security researchers and bug bounty hunters use. Entries are grouped into categories such as tools, bookmarklets, browser addons, and Burp Suite, Caido and ZAP addons, and each tool is tagged by type (for example Recon, Proxy, Fuzzer, Scanner) and by technique (subdomains, portscan, xss, sqli, jwt, and so on).
Is WebHackersWeapons free to use? What license does it have?
WebHackersWeapons is open source under the MIT license. Check the license terms before using it in commercial products.
Is WebHackersWeapons still maintained?
Updated within 6 months. The last commit to WebHackersWeapons was on Sep 7, 2026.
What can I use WebHackersWeapons for?
Finding a subdomain enumeration or URL discovery tool for a bug bounty recon workflow. Choosing an intercepting proxy for web application testing. Browsing which tools the web security community commonly uses before writing your own scripts.
Where can I get WebHackersWeapons?
The source code and installation instructions are on GitHub: https://github.com/hahwul/WebHackersWeapons

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects