## https://sploitus.com/exploit?id=A49FCC9E-7A62-588B-9114-9CBF55803A4F
Web Application Pentest Helper
A menu-driven Python CLI for authorized web application penetration
testing / reconnaissance. Built for use on Kali/Parrot Linux or any Linux
box where `nmap`, `dirb`/`gobuster` are installed.
⚠️ Legal notice
Only run this against systems you own or have explicit written
authorization to test. Unauthorized scanning, directory brute-forcing,
or SQL injection testing is illegal in most jurisdictions. The script
requires you to type `YES` to confirm authorization before it will run.
Setup
```bash
# System tools (Debian/Ubuntu/Kali)
sudo apt update
sudo apt install nmap dirb gobuster whois -y
# Python dependencies
pip install -r requirements.txt --break-system-packages
```
Wordlists (for option 3) — Kali ships these by default at:
`/usr/share/wordlists/dirb/common.txt`
`/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt`
If you're on plain Ubuntu/Debian, install seclists or dirb's wordlists:
```bash
sudo apt install dirb seclists -y
```
Usage
```bash
python3 webpentest.py
```
You'll be asked to confirm authorization, then enter a target URL.
A `results/<host>/` folder is created, and you get a menu:
```
1. Information Gathering -> gatherinfo.txt
2. Vulnerability Scanning (Nmap)-> vulnscan.txt
3. Hidden Directory Search -> hiddendir.txt
4. SQL Injection Detection -> sqltest.txt
5. Generate Consolidated Report -> report_<timestamp>.txt
0. Exit
```
You can run options in any order, any number of times — each run
overwrites its corresponding file. Run option 5 last to compile
everything into one report.
Option 1 — Information Gathering
Grabs HTTP headers, guesses OS/framework/CMS/cloud provider from
header and body signatures, resolves DNS, and runs a WHOIS lookup.
Purely passive/low-noise (a few HTTP GETs).
Option 2 — Vulnerability Scanning (Nmap)
Presents a submenu of common scan types:
Ping scan · 2. SYN scan · 3. TCP connect scan · 4. UDP scan ·
Version detection · 6. OS detection · 7. Aggressive scan ·
Full port scan · 9. NSE vuln scripts · 10. Full aggressive+vuln
Some scan types (`-sS`, `-O`, `--script vuln`) need root:
```bash
sudo python3 webpentest.py
```
Option 3 — Hidden Directory Discovery
Choose `dirb` or `gobuster`, supply/confirm a wordlist path, and it
runs the brute-force scan against the target.
Option 4 — SQL Injection Detection (basic)
Fetches the given login page, tries to auto-detect the `<form>`
(action, method, username/password fields) using BeautifulSoup, then
submits a small set of classic SQLi payloads (`' OR '1'='1`, etc.).
It flags the target as possibly vulnerable if:
a known SQL error signature appears in the response, or
the response pattern suggests an authentication bypass (e.g. a
"dashboard"/"welcome" page appears with no "invalid" message).
This is a detection aid, not an exploitation/data-extraction tool.
It does not dump database contents. For deeper, more accurate testing,
use a mature tool like `sqlmap` — with authorization.
Option 5 — Consolidated Report
Reads whichever of the four output files exist in the results folder
and stitches them into one `report_<timestamp>.txt`, plus an
auto-generated "Executive Summary" flagging anything notable found
(SQLi indicators, open ports, accessible hidden paths).
Notes / limitations
Nmap, dirb, and gobuster are external tools the script shells
out to — they must be installed separately; the script checks for
them and tells you if they're missing.
OS/framework/cloud detection is heuristic (based on headers,
cookies, body signatures) — treat it as a lead, not ground truth.
SQLi detection uses a small, safe payload set and pattern matching;
it will miss blind/time-based/second-order injection and can have
false positives/negatives. Always confirm manually.
w e b - p e n t e s t i n g