# h4r5h1t/webcopilot

An automation tool that enumerates subdomains then filters out xss, sqli, open redirect, lfi, ssrf and rce parameters and then scans for vulnerabilities.

Repository: https://github.com/h4r5h1t/webcopilot
Canonical: https://ross.abutalabs.com/products/webcopilot
Language: Shell
License: MIT
License Family: permissive
Topics: bug-bounty, bugbounty, enumeration, recon, reconnaissance
Last push: 2024-07-18T14:44:09+00:00

## Health v2 (maintenance only)
Score: 23/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 1830, "days_push": 776, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1295, forks 203 (observed 2026-08-28T04:04:16.493851+00:00)

## What it is
WebCopilot is a Bash-based automation script for bug bounty reconnaissance that enumerates subdomains using multiple tools, filters parameters vulnerable to XSS, SQLi, open redirect, LFI, SSRF, and RCE, and scans for vulnerabilities with tools like dalfox and nuclei. It orchestrates a pipeline of open-source security tools and saves all output to a specified directory.

## Use cases
- automate subdomain enumeration for a target domain
- find XSS and SQLi parameters across subdomains
- run a full recon and vulnerability scan pipeline for bug bounty
- check for subdomain takeover
- crawl endpoints from wayback and filter by vulnerability patterns
- scan a domain for SSRF, LFI, and open redirect bugs

## When to choose
- you want a one-command recon-to-vuln-scan pipeline for bug bounty targets
- you already use tools like subfinder, amass, httpx, and nuclei and want them chained automatically
- you need organized output files from a multi-tool recon workflow

## When to avoid
- you need a maintained, production-grade vulnerability scanner with support
- you are on Windows without WSL or a Unix-like shell
- you want a GUI or interactive web interface
- you need authorized enterprise security testing with reporting features

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, penetration-testing, web-scraping, cli, workflow-automation
- domain: security, penetration-testing, developer-tools
- platform: cli
- tags: bug-bounty, recon, subdomain-enumeration, vulnerability-scanning, reconnaissance, bash-script, offensive-security, command-line, linux, macos

## Member repositories
- h4r5h1t/webcopilot (main) score 23

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:16.493851+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:54:01.303595+00:00, confidence not recorded.
  - readme: https://github.com/h4r5h1t/webcopilot (fetched 2026-08-28T04:04:16.493851+00:00, sha 3675314f2b26)
- Data as of 2026-08-30T08:39:29.467469+00:00.