Web Hacking ToolKit

A web hacking toolkit (docker image).

Resources

• Installation
  • Docker
  • Docker Compose
  • Build from Source
• GUI Support
  • Using SSH with X11 forwarding
• Toolkit Setup
  • System
  • Tools
  • Wordlists
• Contribution

Installation

Docker

Pull the image from Docker Hub:

docker pull hueristiq/web-hacking-toolkit

Run a container and attach a shell:

docker run \
	-it \
	--rm \
	--shm-size="2g" \
	--name web-hacking-toolkit \
	--hostname web-hacking-toolkit \
	-p 22:22 \
	-v $(pwd)/data:/root/data \
	hueristiq/web-hacking-toolkit \
	/bin/zsh -l

Docker Compose

Docker-Compose can also be used.

version: "3.9"

services:
    web-hacking-toolkit:
        image: hueristiq/web-hacking-toolkit
        container_name: web-hacking-toolkit
        hostname: web-hacking-toolkit
        stdin_open: true
        shm_size: 2gb # increase shared memory size to prevent firefox from crashing
        ports:
            - "22:22" # exposed for GUI support sing SSH with X11 forwarding
        volumes:
            - ./data:/root/data
        restart: unless-stopped

Build and run container:

docker-compose up

Attach shell:

docker-compose exec web-hacking-toolkit /bin/zsh -l

Build from Source

Clone this repository and build the image:

git clone https://github.com/hueristiq/web-hacking-toolkit.git && \
cd web-hacking-toolkit && \
make build-image

Run a container and attach a shell:

make run

GUI Support

By default, no GUI tools can be run in a Docker container as no X11 server is available. To run them, you must change that. What is required to do so depends on your host machine. If you:

• run on Linux, you probably have X11
• run on Mac OS, you need Xquartz (brew install Xquartz)
• run on Windows, you have a problem

Using SSH with X11 forwarding

Use X11 forwarding through SSH if you want to go this way. Run start_ssh inside the container to start the server, make sure you expose port 22 when starting the container: docker run -p 127.0.0.1:22:22 ..., then use ssh -X ... when connecting (the script prints the password).

Tookit Setup

• System Setup

  • Terminal

    • Shell (ZSH)
    • Session Manager (TMUX)

  • Browser

    • Chrome

    • Firefox

      Installed Addons

      Addons	Description
      Privacy Badger	Automatically learns to block invisible trackers.
      Disable WebRTC	WebRTC leaks your actual IP addresses from behind your VPN, by default.
      Shodan	The Shodan plugin tells you where the website is hosted (country, city), who owns the IP and what other services/ ports are open.
      Wappalyzer	Identify technologies on websites.
      Bulk URL Opener	Allows user to open a list of url in one click.
      TWP - Translate Web Pages	Translate your page in real time using Google or Yandex.
      User-Agent Switcher and Manager	Spoof websites trying to gather information about your web navigation—like your browser type and operating system—to deliver distinct content you may not want.
      HTTP Header Live	Displays the HTTP header. Edit it and send it.
      Cookie-Editor	Cookie-Editor lets you efficiently create, edit and delete a cookie for the current tab. Perfect for developing, quickly testing or even manually managing your cookies for your privacy.
      TempMail	Temporary disposable email address. Protect your email from spam, bots and phishing with Temp-Mail.
      FoxyProxy	FoxyProxy is an advanced proxy management tool that completely replaces Firefox's limited proxying capabilities.
      Firefox Multi-Account Containers	Firefox Multi-Account Containers lets you keep parts of your online life separated into color-coded tabs. Cookies are separated by container, allowing you to use the web with multiple accounts and integrate Mozilla VPN for an extra layer of privacy.

  • Remote Connection

    • SSH
• Development
  • Text Editor
    • vim
  • Programming Languages
    • Go (Golang)
    • python3

Contribution

Issues and Pull Requests are welcome!