Webash 2.8

Web Crawler, Scanner, and Analyzer Framework (Shell-Script based)

About:

Webash serves as a scanning tool for web-based applications, primarily utilized in bug bounty programs and penetration testing. Its framework-like design allows effortless integration of vulnerability detection scripts.

For Example

Make it more powerful, By adding (custom) script like this:

modules/form/yourscript.bash {WEB-URL} {SOURCECODE}

modules/url/yourscript.bash {WEB-URL} {SOURCECODE}

modules/header/yourscript.bash {WEB-URL} {SOURCECODE}

For the sample, you can follow existing scripts.

Disable Script

You only need to change the extension, for example .bash => .bashx.

by Default:

• Web Crawler
• Gather Input Form
• Detect Missconfigured CORS
• Detect missing X-FRAME-OPTIONS (Clickjacking Potential)
• Detect Reflected XSS via URL
• Detect Reflected XSS via Form
• Detect HTTP Splitting Response via CRLF Injection
• Detect Open Redirect

Tested on:

How to Run:

git clone https://github.com/vardhanrajya08/Webash

cd Webash

bash webash.bash

Notes:

• This tool will consume a lot of disk usage, so don't forget to housekeep webash-tempdata and scan-logs.