# WebCopilot | An Automation Tool That Enumerates Subdomains

**URL:** <https://onehack.st/t/webcopilot-an-automation-tool-that-enumerates-subdomains/272121>\
**Category:** Tools & Scripts\
**Tags:** hacking, freebies, data-recovery, documents\
**Created:** [January 13, 2024, 8:58pm UTC](https://onehack.st/t/webcopilot-an-automation-tool-that-enumerates-subdomains/272121 "2024-01-13T20:58:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\
**Post date:** [January 13, 2024, 8:58pm UTC](https://onehack.st/t/webcopilot-an-automation-tool-that-enumerates-subdomains/272121/1 "2024-01-13T20:58:20Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/3/9/3986ecc86f07ecf630a5b5c4c3fd55ed6a3d34f4.jpeg)

# [WebCopilot](https://github.com/h4r5h1t/webcopilot/)

#### An automation tool that enumerate subdomains then filters out xss, sqli, open redirect, lfi, ssrf and rce parameters and then scans for vulnerabilities.

[![](https://camo.githubusercontent.com/5a96b176e9521edb2151fdd7dc768ee92ece68a360abe7c637587cc6e53f4f84/68747470733a2f2f696d672e736869656c64732e696f2f747769747465722f666f6c6c6f772f683472356831745f6872733f7374796c653d736f6369616c)](https://twitter.com/h4r5h1t_hrs) [![](https://camo.githubusercontent.com/f2718179bfd4c9fd791b6971300b5bac7d1ebd6cfe482f17b8cb1aa58c0be711/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f666f6c6c6f776572732f683472356831743f7374796c653d736f6369616c)](https://github.com/h4r5h1t?tab=followers) [![](https://camo.githubusercontent.com/8531ea80bc5e0ac96a01c1f2e18f168ca543ffd837522065bcf93f238774d4b8/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f636f6e747269627574696f6e732d77656c636f6d652d627269676874677265656e2e7376673f7374796c653d666c6174)](https://github.com/h4r5h1t/webcopilot/issues) [![](https://camo.githubusercontent.com/a4426cbe5c21edb002526331c7a8fbfa089e84a550567b02a0d829a98b136ad0/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d4d49542d79656c6c6f772e737667)](https://github.com/h4r5h1t/webcopilot/blob/master/LICENSE) [![](https://camo.githubusercontent.com/46eb12606941fe2775f4de694631cf2f4162bcdc91924d5b47126f5324e19ad5/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4d616465253230776974682d426173682d3166343235662e737667)](https://github.com/h4r5h1t/webcopilot#) [![](https://camo.githubusercontent.com/fd28d076b00f9d3942dd13fc5397df404141bb28bbf8e008ac951461932e601d/68747470733a2f2f6d616465776974686c6f76652e6f72672e696e2f62616467652e737667)](https://github.com/h4r5h1t/webcopilot#)

[Features](https://github.com/h4r5h1t/webcopilot#features) • [Installation](https://github.com/h4r5h1t/webcopilot#installing-webCopilot) • [Usage](https://github.com/h4r5h1t/webcopilot#usage) • [WebCopilot](https://github.com/h4r5h1t/webcopilot#running-webcopilot) • [Tools Used](https://github.com/h4r5h1t/webcopilot#tools-used) • [Acknowledgement](https://github.com/h4r5h1t/webcopilot#acknowledgement)

* * *

**WebCopilot** is an automation tool designed to enumerate subdomains of the target and detect bugs using different open-source tools.

The script first enumerate all the subdomains of the given target domain using assetfinder, sublister, subfinder, amass, findomain, hackertarget, riddler and crt then do active subdomain enumeration using gobuster from SecLists wordlist then filters out all the live subdomains using dnsx then it extract titles of the subdomains using httpx & scans for subdomain takeover using subjack. Then it uses gauplus & waybackurls to crawl all the endpoints of the given subdomains then it use gf patterns to filters out xss, lfi, ssrf, sqli, open redirect & rce parameters from that given subdomains, and then it scans for vulnerabilities on the subdomains using different open-source tools (like kxss, dalfox, openredirex, nuclei, etc). Then it’ll print out the result of the scan and save all the output in a specified directory.

# Features

- Subdomain Enumeration using [assetfinder](https://github.com/tomnomnom/assetfinder), [sublist3r](https://github.com/aboul3la/Sublist3r), [subfinder](https://github.com/projectdiscovery/subfinder), [amass](https://github.com/OWASP/Amass), [findomain](https://github.com/Findomain/Findomain), etc.
- Active Subdomain Enumeration using [gobuster](https://github.com/OJ/gobuster) & [amass](https://github.com/OWASP/Amass) from [SecLists/DNS](https://github.com/danielmiessler/SecLists/tree/master/Discovery/DNS) wordlist.
- Extract titles and take screenshots of live subdomains using [aquatone](https://github.com/michenriksen/aquatone) & [httpx](https://github.com/projectdiscovery/httpx).
- Crawl all the endpoints of the subdomains using [waybackurls](https://github.com/tomnomnom/waybackurls) & [gauplus](https://github.com/bp0lr/gauplus) and filter out XSS, SQLi, SSRF, etc parameters using [gf patterns](https://github.com/tomnomnom/gf).
- Run different open-source tools (like [dalfox](https://github.com/hahwul/dalfox), [nuclei](https://github.com/projectdiscovery/nuclei), [sqlmap](https://github.com/sqlmapproject/sqlmap), etc) to search for vulnerabilities on these parameters and then save all the outputs in the folder.

# Usage

g!2m0:~ webcopilot -h

──────▄▀▄─────▄▀▄ ─────▄█░░▀▀▀▀▀░░█▄ ─▄▄──█░░░░░░░░░░░█──▄▄ █▄▄█─█░░▀░░┬░░▀░░█─█▄▄█ ██╗░░░░░░░██╗███████╗██████╗░░█████╗░░█████╗░██████╗░██╗██╗░░░░░░█████╗░████████╗ ░██║░░██╗░░██║██╔════╝██╔══██╗██╔══██╗██╔══██╗██╔══██╗██║██║░░░░░██╔══██╗╚══██╔══╝ ░╚██╗████╗██╔╝█████╗░░██████╦╝██║░░╚═╝██║░░██║██████╔╝██║██║░░░░░██║░░██║░░░██║░░░ ░░████╔═████║░██╔══╝░░██╔══██╗██║░░██╗██║░░██║██╔═══╝░██║██║░░░░░██║░░██║░░░██║░░░ ░░╚██╔╝░╚██╔╝░███████╗██████╦╝╚█████╔╝╚█████╔╝██║░░░░░██║███████╗╚█████╔╝░░░██║░░░ ░░░╚═╝░░░╚═╝░░╚══════╝╚═════╝░░╚════╝░░╚════╝░╚═╝░░░░░╚═╝╚══════╝░╚════╝░░░░╚═╝░░░ [●] @h4r5h1t.hrs | G!2m0 Usage: webcopilot -d webcopilot -d -s webcopilot [-d target] [-o output destination] [-t threads] [-b blind server URL] [-x exclude domains] Flags: -d Add your target [Requried] -o To save outputs in folder [Default: [domain.com](http://domain.com)] -t Number of threads [Default: 100] -b Add your server for BXSS [Default: False] -x Exclude out of scope domains [Default: False] -s Run only Subdomain Enumeration [Default: False] -h Show this help message Example: webcopilot -d [domain.com](http://domain.com) -o domain -t 333 -x exclude.txt -b testServer.xss Use [https://xsshunter.com/](https://xsshunter.com/) or [https://interact.projectdiscovery.io/](https://interact.projectdiscovery.io/) to get your server

# Installing WebCopilot

WebCopilot requires **git** to install successfully. Run the following command as a **root** to install webcopilot

git clone [https://github.com/h4r5h1t/webcopilot](https://github.com/h4r5h1t/webcopilot) && cd webcopilot/ && chmod +x webcopilot install.sh && mv webcopilot /usr/bin/ && ./install.sh

### Tools Used:

[SubFinder](https://github.com/projectdiscovery/subfinder) • [Sublist3r](https://github.com/aboul3la/Sublist3r) • [Findomain](https://github.com/Findomain/Findomain) • [gf](https://github.com/tomnomnom/gf) • [OpenRedireX](https://github.com/devanshbatham/OpenRedireX) • [dnsx](https://github.com/projectdiscovery/dnsx) • [sqlmap](https://github.com/sqlmapproject/sqlmap) • [gobuster](https://github.com/OJ/gobuster) • [assetfinder](https://github.com/tomnomnom/assetfinder) • [httpx](https://github.com/projectdiscovery/httpx) • [kxss](https://github.com/Emoe/kxss) • [qsreplace](https://github.com/tomnomnom/qsreplace) • [Nuclei](https://github.com/projectdiscovery/nuclei) • [dalfox](https://github.com/hahwul/dalfox) • [anew](https://github.com/tomnomnom/anew) • [jq](https://github.com/stedolan/jq) • [aquatone](https://github.com/michenriksen/aquatone) • [urldedupe](https://github.com/ameenmaali/urldedupe) • [Amass](https://github.com/OWASP/Amass) • [gauplus](https://github.com/bp0lr/gauplus) • [waybackurls](https://github.com/tomnomnom/waybackurls) • [crlfuzz](https://github.com/dwisiswant0/crlfuzz)

## Running WebCopilot

To run the tool on a target, just use the following command.

g!2m0:~ webcopilot -d [bugcrowd.com](http://bugcrowd.com)

The `-o` command can be used to specify an output dir.

g!2m0:~ webcopilot -d [bugcrowd.com](http://bugcrowd.com) -o bugcrowd

The `-s` command can be used for only subdomain enumerations (Active + Passive and also get title & screenshots).

g!2m0:~ webcopilot -d [bugcrowd.com](http://bugcrowd.com) -o bugcrowd -s

The `-t` command can be used to add thrads to your scan for faster result.

g!2m0:~ webcopilot -d [bugcrowd.com](http://bugcrowd.com) -o bugcrowd -t 333

The `-b` command can be used for blind xss (OOB), you can get your server from [xsshunter](https://xsshunter.com/) or [interact](https://interact.projectdiscovery.io/)

g!2m0:~ webcopilot -d [bugcrowd.com](http://bugcrowd.com) -o bugcrowd -t 333 -b testServer.xss

The `-x` command can be used to exclude out of scope domains.

g!2m0:~ echo [out.bugcrowd.com](http://out.bugcrowd.com) \> excludeDomain.txt g!2m0:~ webcopilot -d [bugcrowd.com](http://bugcrowd.com) -o bugcrowd -t 333 -x excludeDomain.txt -b testServer.xss

## Example

Default options looks like this:

g!2m0:~ webcopilot -d [bugcrowd.com](http://bugcrowd.com) - bugcrowd

──────▄▀▄─────▄▀▄ ─────▄█░░▀▀▀▀▀░░█▄ ─▄▄──█░░░░░░░░░░░█──▄▄ █▄▄█─█░░▀░░┬░░▀░░█─█▄▄█ ██╗░░░░░░░██╗███████╗██████╗░░█████╗░░█████╗░██████╗░██╗██╗░░░░░░█████╗░████████╗ ░██║░░██╗░░██║██╔════╝██╔══██╗██╔══██╗██╔══██╗██╔══██╗██║██║░░░░░██╔══██╗╚══██╔══╝ ░╚██╗████╗██╔╝█████╗░░██████╦╝██║░░╚═╝██║░░██║██████╔╝██║██║░░░░░██║░░██║░░░██║░░░ ░░████╔═████║░██╔══╝░░██╔══██╗██║░░██╗██║░░██║██╔═══╝░██║██║░░░░░██║░░██║░░░██║░░░ ░░╚██╔╝░╚██╔╝░███████╗██████╦╝╚█████╔╝╚█████╔╝██║░░░░░██║███████╗╚█████╔╝░░░██║░░░ ░░░╚═╝░░░╚═╝░░╚══════╝╚═════╝░░╚════╝░░╚════╝░╚═╝░░░░░╚═╝╚══════╝░╚════╝░░░░╚═╝░░░ [●] @h4r5h1t.hrs | G!2m0 [❌] Warning: Use with caution. You are responsible for your own actions. [❌] Developers assume no liability and are not responsible for any misuse or damage cause by this tool. Target: [bugcrowd.com](http://bugcrowd.com) Output: /home/gizmo/targets/bugcrowd Threads: 100 Server: False Exclude: False Mode: Running all Enumeration Time: 30-08-2021 15:10:00 [!] Please wait while scanning… [●] Subdomain Scanning is in progress: Scanning subdomains of [bugcrowd.com](http://bugcrowd.com) [●] Subdomain Scanned - [assetfinder​✔] Subdomain Found: 34 [●] Subdomain Scanned - [sublist3r​✔] Subdomain Found: 29 [●] Subdomain Scanned - [subfinder​✔] Subdomain Found: 54 [●] Subdomain Scanned - [amass​✔] Subdomain Found: 43 [●] Subdomain Scanned - [findomain​✔] Subdomain Found: 27 [●] Active Subdomain Scanning is in progress: [!] Please be patient. This may take a while… [●] Active Subdomain Scanned - [gobuster​✔] Subdomain Found: 11 [●] Active Subdomain Scanned - [amass​✔] Subdomain Found: 0 [●] Subdomain Scanning: Filtering out of scope subdomains [●] Subdomain Scanning: Filtering Alive subdomains [●] Subdomain Scanning: Getting titles of valid subdomains [●] Visual inspection of Subdomains is completed. Check: /subdomains/aquatone/ [●] Scanning Completed for Subdomains of [bugcrowd.com](http://bugcrowd.com) Total: 43 | Alive: 30 [●] Endpoints Scanning Completed for Subdomains of [bugcrowd.com](http://bugcrowd.com) Total: 11032 [●] Vulnerabilities Scanning is in progress: Getting all vulnerabilities of [bugcrowd.com](http://bugcrowd.com) [●] Vulnerabilities Scanned - [XSS​✔] Found: 0 [●] Vulnerabilities Scanned - [SQLi​✔] Found: 0 [●] Vulnerabilities Scanned - [LFI​✔] Found: 0 [●] Vulnerabilities Scanned - [CRLF​✔] Found: 0 [●] Vulnerabilities Scanned - [SSRF​✔] Found: 0 [●] Vulnerabilities Scanned - [Sensitive Data​✔] Found: 0 [●] Vulnerabilities Scanned - [Open redirect​✔] Found: 0 [●] Vulnerabilities Scanned - [Subdomain Takeover​✔] Found: 0 [●] Vulnerabilities Scanned - [Nuclie​✔] Found: 0 [●] Vulnerabilities Scanning Completed for Subdomains of [bugcrowd.com](http://bugcrowd.com) Check: /vulnerabilities/ ▒█▀▀█ █▀▀ █▀▀ █░░█ █░░ ▀▀█▀▀ ▒█▄▄▀ █▀▀ ▀▀█ █░░█ █░░ ░░█░░ ▒█░▒█ ▀▀▀ ▀▀▀ ░▀▀▀ ▀▀▀ ░░▀░░ [+] Subdomains of [bugcrowd.com](http://bugcrowd.com) [+] Subdomains Found: 0 [+] Subdomains Alive: 0 [+] Endpoints: 11032 [+] XSS: 0 [+] SQLi: 0 [+] Open Redirect: 0 [+] SSRF: 0 [+] CRLF: 0 [+] LFI: 0 [+] Sensitive Data: 0 [+] Subdomain Takeover: 0 [+] Nuclei: 0

* * *

### Acknowledgement

WebCopilot is inspired from [Garud](https://github.com/R0X4R/Garud) & [Pinaak](https://github.com/R0X4R/Pinaak) by [ROX4R](https://github.com/R0X4R/).

#### Thanks to the authors of the tools & wordlists used in this script.

[@aboul3la](https://github.com/aboul3la) [@tomnomnom](https://github.com/tomnomnom) [@lc](https://github.com/lc) [@hahwul](https://github.com/hahwul) [@projectdiscovery](https://github.com/projectdiscovery) [@maurosoria](https://github.com/maurosoria) [@shelld3v](https://github.com/shelld3v) [@devanshbatham](https://github.com/devanshbatham) [@michenriksen](https://github.com/michenriksen) [@defparam](https://github.com/defparam/) [@projectdiscovery](https://github.com/projectdiscovery) [@bp0lr](https://github.com/bp0lr/) [@ameenmaali](https://github.com/ameenmaali) [@sqlmapproject](https://github.com/sqlmapproject/sqlmap) [@dwisiswant0](https://github.com/dwisiswant0) [@OWASP](https://github.com/OWASP/) [@OJ](https://github.com/OJ/) [@Findomain](https://github.com/Findomain/Findomain) [@danielmiessler](https://github.com/danielmiessler) [@1ndianl33t](https://github.com/1ndianl33t) [@ROX4R](https://github.com/R0X4R/)

**Warning:** Developers assume no liability and are not responsible for any misuse or damage cause by this tool. So, please se with caution because you are responsible for your own actions.

## GitHub:

> **[GitHub - h4r5h1t/webcopilot: An automation tool that enumerates subdomains then...](https://github.com/h4r5h1t/webcopilot)**
>
> An automation tool that enumerates subdomains then filters out xss, sqli, open redirect, lfi, ssrf and rce parameters and then scans for vulnerabilities.

---

<div class="post-metadata">

**Author:** ![Tracker\_utm](https://onehack.st/user_avatar/onehack.st/tracker_utm/32/128153_2.png) [@Tracker\_utm](https://onehack.st/u/Tracker_utm)\
**Post date:** [January 27, 2024, 5:27am UTC](https://onehack.st/t/webcopilot-an-automation-tool-that-enumerates-subdomains/272121/2 "2024-01-27T05:27:49Z")

</div>

Good share. Thank you!