BlackWidow v1.3 releases: web application scanner to gather OSINT and fuzz for OWASP vulnerabilities

by do son · Published August 27, 2018 · Updated July 19, 2020

BlackWidow is a python based web application spider to gather subdomains, URL’s, dynamic parameters, email addresses and phone numbers from a target website. This project also includes Inject-X fuzzer to scan dynamic URL’s for common OWASP vulnerabilities.

FEATURES:

Automatically collect all URL’s from a target website
Automatically collect all dynamic URL’s and parameters from a target website
Automatically collect all subdomains from a target website
Automatically collect all phone numbers from a target website
Automatically collect all email addresses from a target website
Automatically collect all form URL’s from a target website
Automatically scan/fuzz for common OWASP TOP vulnerabilities
Automatically saves all data into sorted text files

Changelog v1.3

Updated installer and both python scripts to support python3
Fixed bug in BlackWidow dynamic URL’s not being captured properly

LINUX INSTALL:

git clone https://github.com/1N3/BlackWidow.git
cp blackwidow /usr/bin/blackwidow
cp injectx.py /usr/bin/injectx.py
pip install -r requirements.txt

USAGE:

blackwidow

-u https://target.com – crawl target.com with 3 levels of depth.
-d target.com -l 5 – crawl the domain: target.com with 5 levels of depth.
-d target.com -l 5 -s y – crawl the domain: target.com with 5 levels of depth and fuzz all unique parameters for OWASP vulnerabilities.

injectx.py https://test.com/uers.php?user=1&admin=true – Fuzz all GET parameters for common OWASP vulnerabilities.

SAMPLE REPORT:

Demo