h4r5h1t/webcopilot

Health v2 · maintenance only

Adoption not part of the score

1295 stars · 203 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

WebCopilot is a Bash-based automation script for bug bounty reconnaissance that enumerates subdomains using multiple tools, filters parameters vulnerable to XSS, SQLi, open redirect, LFI, SSRF, and RCE, and scans for vulnerabilities with tools like dalfox and nuclei. It orchestrates a pipeline of open-source security tools and saves all output to a specified directory.

Use cases

• automate subdomain enumeration for a target domain
• find XSS and SQLi parameters across subdomains
• run a full recon and vulnerability scan pipeline for bug bounty
• check for subdomain takeover
• crawl endpoints from wayback and filter by vulnerability patterns
• scan a domain for SSRF, LFI, and open redirect bugs

When to choose

• you want a one-command recon-to-vuln-scan pipeline for bug bounty targets
• you already use tools like subfinder, amass, httpx, and nuclei and want them chained automatically
• you need organized output files from a multi-tool recon workflow

When to avoid

• you need a maintained, production-grade vulnerability scanner with support
• you are on Windows without WSL or a Unix-like shell
• you want a GUI or interactive web interface
• you need authorized enterprise security testing with reporting features

Facets

cli-tool · maturity active

security penetration-testing web-scraping cli workflow-automation security penetration-testing developer-tools cli bug-bounty recon subdomain-enumeration vulnerability-scanning reconnaissance bash-script offensive-security command-line linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="h4r5h1t/webcopilot")