A high-level library for web application security testers to automate, document, share, and compose exploits.
npm install railgun-coreRailgun is a high-level library built with the JavaScript programming language designed for web applicaion security testers to be able to write simple scripts to document and automate the exploitation of vulnerabilities found in the wild.
Much like the popular Metasploit software, which can be extended with new modules written in Ruby, Railgun aims to provide tools that web application security testers are used to with a programmatic interface. This includes things like, but not limited to
* A proxy server that can intercept and modify requests and responses.
* A spider that can be programmatically configured to crawl websites.
* A simple way to issue requests in sequence or in parallel with modified payloads.
The major milestones for Railgun are to:
1. Provide the same functionality as the most powerful and common features of tools like Burp Suite and Apache ZAP,
2. Allow for exploit scripts to be composed into useful testing suites that can be customized by testers with a little bit of coding chops, and finally
3. Be able to act as an encyclopedia of vulnerabilities in software found in the real world that can be studied by developers and testers in order to build more secure software.
There are also several things that are not goals for Railgun- things that I do not plan to implement and would not want to include in this project at any point.
1. Railgun does not aim to provide a GUI like Burp or Apache ZAP nor an interactive command-line interface like Metasploit. Some functionality may need to include some interactive elements, however total automation is the goal.
2. Railgun is not designed to be a useful tool for script kiddies to pick up and pwn websites with. To use Railgun, one will need to have at least a basic understanding of JavaScript programming.