What is webhackersweapons?

hahwul/webhackersweapons — explained in plain English

Analysis updated 2026-06-26

★ 4,598RubyAudience · developerComplexity · 1/5Setup · easy

Mindmap

mindmap
  root((WebHackersWeapons))
    What It Does
      Curated tool directory
      Bug bounty reference
      Pentest toolkit guide
    Tool Categories
      Proxies
      Fuzzers
      Scanners
      Recon tools
      Exploit tools
    Vulnerability Types
      XSS
      SQL injection
      SSRF
      Request smuggling
    Proxy Add-ons
      Burp Suite plugins
      OWASP ZAP extensions
      Caido plugins
    Audience
      Pentesters
      Bug bounty hunters

mindmap root((WebHackersWeapons)) What It Does Curated tool directory Bug bounty reference Pentest toolkit guide Tool Categories Proxies Fuzzers Scanners Recon tools Exploit tools Vulnerability Types XSS SQL injection SSRF Request smuggling Proxy Add-ons Burp Suite plugins OWASP ZAP extensions Caido plugins Audience Pentesters Bug bounty hunters

Click or tap to explore — scroll the page freely

What do people build with it?

USE CASE 1

Find the right fuzzer or scanner for a specific web vulnerability type like SQL injection, SSRF, or XSS.

USE CASE 2

Discover Burp Suite and OWASP ZAP add-ons recommended by the security community for proxy-based web testing.

USE CASE 3

Build a personal web pentesting toolkit by browsing the categorized list and selecting tools that match your workflow.

USE CASE 4

Look up tools for a specific technique such as subdomain takeover enumeration or JavaScript secret scanning.

What is it built with?

Ruby

How does it compare?

	hahwul/webhackersweapons	activemerchant/active_merchant	sferik/twitter-ruby
Stars	4,598	4,595	4,576
Language	Ruby	Ruby	Ruby
Setup difficulty	easy	moderate	moderate
Complexity	1/5	3/5	2/5
Audience	developer	developer	developer

Figures from each repo's GitHub metadata at analysis time.

How do you get it running?

Difficulty · easy Time to first run · 5min

No license information was provided in the explanation, check the repository directly.

So what is it?

WebHackersWeapons is a curated list of tools used by web security researchers, penetration testers, and bug bounty hunters. It is not a single application but a reference collection: a structured directory of hundreds of external tools, browser add-ons, bookmarklets, and plugins that security professionals use when testing web applications for vulnerabilities. The list is organized into categories by what the tool does. The types include general-purpose Swiss-army tools, proxies that sit between a browser and a server to inspect traffic, reconnaissance tools for mapping targets, fuzzers that send unusual input to find crashes or unexpected behavior, scanners that check for known weaknesses, and exploit tools. There is also a section for utilities and miscellaneous entries. Each tool in the list is tagged with the specific vulnerability types or techniques it relates to, covering a wide range of web security concerns: cross-site scripting, SQL injection, server-side template injection, request smuggling, subdomain takeover, DNS reconnaissance, JavaScript analysis, secret scanning, authentication testing, and many others. Tools are also tagged by the programming language they are written in, spanning Java, Python, Go, Rust, Ruby, JavaScript, and more. In addition to standalone command-line and GUI tools, the list includes addons and extensions for Burp Suite, Caido, and OWASP ZAP, which are popular proxy tools used to intercept and manipulate web traffic during security assessments. Bookmarklets and browser extensions for in-browser testing are listed as well. The project is community-maintained and contributions are welcome via a contributing guide in the repository. A companion project, MobileHackersWeapons, covers the same concept for mobile application testing. The full README is longer than what was shown.

Copy-paste prompts

Prompt 1

I'm starting a bug bounty engagement on a web app and need tools for recon, fuzzing, and XSS testing. Which tools from WebHackersWeapons should I use for each phase?

Prompt 2

Show me which tools in WebHackersWeapons are tagged for finding server-side template injection vulnerabilities.

Prompt 3

I want to set up a Burp Suite-centered web pentesting workflow. Which companion tools and add-ons from WebHackersWeapons complement it best?

Prompt 4

I'm doing subdomain enumeration on a target. Which reconnaissance tools in WebHackersWeapons are best suited for this step?

Frequently asked questions