web-fu

The web hacking chrome extension

== license ==

GPL v3

== install ==

(...) button -> more tools -> Extensions -> developer mode on -> load unpacked

clone the repo and load unpacked

== usage ==

Right Click Action

Extensions icon for more features

== pros ==

• Agility
• Pseudo manual
• Integrated
• Speed
• No copy paste get/post/cookies/ua/headers
• no proxy needed
• integrated in chrome
• ssl friendly
• urllog logs before sending the request
• user-event-hooks
• no sever daemon

== cons ==

• no user agent change¿?

== features ==

• bruteforcing folders, files, params names, param values on get/post.
• false positive reduction with gauss
• default wordlists or load worlist
• cookie editor
• notes
• log
• visual crawl
• visual bruteforce (experimental)
• clever params auditor expert system
• request interceptor
• base64 and url encoding/decoding
• danger bytes, all encoded bytes
• portscan
• build request

== components ==

Bar-Button -> main.html ->  main.js -> settings.html -> settings.js
                                |                           |
                                |                           |
(RighClick) -----+              |                           |
                 |              |                           |
                 v              |                           |
Background -+--> menu.js        |                           |
            |                   |                           |
            +--> attackAPI.js <-+-----> ATTACKS             |
            |                                               |
            +--> storageAPI.js <----------------------------+
                       |
                       V
                   WORDLISTS

== Manifest V3 migration ==

Web-Fu was originally a Manifest V2 extension. Current Chrome no longer loads MV2, so it was ported to Manifest V3:

• manifest_version 3; browser_action -> action; host_permissions split out; webRequestBlocking and background removed; scripting + storage added.
• Background persistent page -> service worker. js/sw.js shims the APIs the worker lacks (window alias, alert, browserAction, extension, contextMenus onclick, tabs.getSelected/executeScript) and importScripts() the original background scripts unchanged.
• Messaging: chrome.extension.* -> chrome.runtime.*
• Storage: window.localStorage -> chrome.storage.local behind a synchronous cache (js/storage.js), shared and persistent between the worker and pages.
• Wordlists: synchronous XHR -> fetch (async).
• Injection: executeScript({code}) -> chrome.scripting with func/args.
• Notifications: webkitNotifications -> chrome.notifications.

Known functionality loss:

• The interactive request Interceptor (pause/edit/resend every request) relied on blocking webRequest + showModalDialog, neither of which exist for a regular MV3 extension. It is disabled with a notice. The non-blocking Logger and the Build Request tool remain. A future port would use declarativeNetRequest.
• User wordlists loaded from disk via file:// URLs won't fetch under MV3; bundled wl/*.txt wordlists work.