Cazador

CazadorApp itself does not contain any tools , however the built plugins contain the following :

Listeners

• HTTP Server
• DNS Server
• TCP Server
• POSTMessage Hooker
• Websocket Hooker

Analyzers

• HTTP
• JS-Files
• FileSystem
• Binary
• Packet

Net Tools

• Get DNS Records
• Resolve Hosts
• Reverse IPs
• Passive DNS
• DNS History

Text Tools

• Text Processing
• Block construct
• Format generator
• pattern creation
• Encrypt/Decrypt data
• Hash Identification
• Crackers
• Payload Generators
• Encoders/Decoders
• Poc Generators (Python , bash , HTML)

Recon

• Get Websites ScreenShots
• GET Subdomains (Scrabbing , Minning , DNS-brute-force,Http-brute-force)
• Site categorizer
• s3/GC bucket enumeration
• Github Lister
• Ip History

Scanners

• Detect Misconfiguration
• Port/vulnerability/ssl scanner
• Vulnerability Exploiters
• Waf Detection

Scrabbers

• Download Android apps (APK)
• Travis-CI logs fetching

Tools discussed separately here

ScreenShots

[scanner] [TcpListener]
[FileMiner]
[Subscrabber] [Hpinger]

virustotal Scan result

if the app is not working proberly , Download the missing dlls, put them in application folder , beside the executable file

Some notes:

• This tool is meant primarily for bug hunnters (specially beginers).
• This tool is not backdoored with any malicious software/tracking .
• Memory is not carefully managed so be carefull , do not use all the tools at the same time , Consider to make targets and threads less than 1000.
• Do not use it illegally
• Tools starting with _ are not built yet , i added buttons to remmember building in future, hence no need to reverse engineer the tool in order to enable them , if you have time feel free to do it no problem.
• Many third-parties are used without permitssion no APIS used.
• The source code is not published because the tool is a beta and the code is uggly and worse than my hand writing.
• Project is planned to be open-source with the first release.
• Suggestions are deeply welcome.
• Credits are reserved for all authors and third-parties.
• Feel free to push any issue

Linked IN

• https://blog.intigriti.com/2019/07/02/bugbytes-25-to-scan-or-not-to-scan-gotcha-and-live-mentoring-by-zseano/
• https://pentester.land/newsletter/2019/07/02/the-5-hacking-newsletter-60.html
• https://securitytraning.com/bugbounty-with-cazador/