README
¶
Joro
A web exploitation framework for offensive security professionals. Intercepting proxy, blind vulnerability detection, web shell generation, C2 integration, and collaboration tools in a single binary with an embedded web UI.
Warning: This tool is intended for authorized penetration testing and security research only. You must only use Joro against systems you own or have explicit written permission to test. Unauthorized access to computer systems is illegal. Bishop Fox assumes no liability and is not responsible for any misuse or damage caused by this tool. Use responsibly.
Features
Joro covers a web application engagement end to end: an intercepting proxy for viewing and editing requests and responses, a site map and searchable history, a fuzzer, passive scanning that surfaces secrets and misconfigurations in captured traffic, out-of-band listeners for blind vulnerabilities, web shell generation and execution, Sliver and Mythic C2 integration, and a team server for running an engagement alongside other operators. Work saves to portable project files, and Go plugins enable Linux and macOS users to add anything missing.
Installation
Grab a binary from Releases, then see the wiki for installation instructions and a quick start guide.
Help
For more information:
- Checkout the wiki
- Review outstanding issues or create your own.
- See CONTRIBUTING.md for information on how to contribute.
- See CLAUDE.md for detailed developer documentation.
- See SECURITY.md for information on reporting security issues.
License - GPLv3
Joro is licensed under GPLv3, some sub-components may have separate licenses. See their respective subdirectories in this project for details.
Documentation
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
internal
|
|
|
activescan
Package activescan is Joro's operator-initiated active scanning: unlike detect, echo and anomaly — which only ever read captured traffic — a scan originates traffic or drives a browser against a target the operator picked, and files confirmed results into the shared detect.Store.
|
Package activescan is Joro's operator-initiated active scanning: unlike detect, echo and anomaly — which only ever read captured traffic — a scan originates traffic or drives a browser against a target the operator picked, and files confirmed results into the shared detect.Store. |
|
activescan/cmdi
Package cmdi is the active command-injection rule.
|
Package cmdi is the active command-injection rule. |
|
activescan/domxss
Package domxss is the first internal/activescan rule: it confirms DOM-based XSS by driving a headless browser over CDP.
|
Package domxss is the first internal/activescan rule: it confirms DOM-based XSS by driving a headless browser over CDP. |
|
activescan/inject
Package inject is the shared scaffold for the active injection-scanning rules (reflected XSS, SQLi, SSTI, command injection, open redirect, path traversal).
|
Package inject is the shared scaffold for the active injection-scanning rules (reflected XSS, SQLi, SSTI, command injection, open redirect, path traversal). |
|
activescan/injkit
Package injkit adapts the activescan framework to the inject library: it builds a sender/OAST/request-list from a rule's Target and RuleDeps and mints findings, so each injection rule stays a payload set plus a detector.
|
Package injkit adapts the activescan framework to the inject library: it builds a sender/OAST/request-list from a rule's Target and RuleDeps and mints findings, so each injection rule stays a payload set plus a detector. |
|
activescan/openredirect
Package openredirect is the active open-redirect rule.
|
Package openredirect is the active open-redirect rule. |
|
activescan/pathtraversal
Package pathtraversal is the active path-traversal / LFI rule.
|
Package pathtraversal is the active path-traversal / LFI rule. |
|
activescan/reflectedxss
Package reflectedxss is the active reflected-XSS rule.
|
Package reflectedxss is the active reflected-XSS rule. |
|
activescan/sqli
Package sqli is the active SQL-injection rule.
|
Package sqli is the active SQL-injection rule. |
|
activescan/ssti
Package ssti is the active server-side template injection rule.
|
Package ssti is the active server-side template injection rule. |
|
activescan/templatesig
Package templatesig is the active-scan signature rule: it sends crafted HTTP requests and files a finding when the response matches a check.
|
Package templatesig is the active-scan signature rule: it sends crafted HTTP requests and files a finding when the response matches a check. |
|
anomaly
Package anomaly finds endpoints that don't look like anything else on their host — the lone JSON handler in an HTML app, a single 200 among 403s, an unusually large or slow response, a rare extension or parameter, an endpoint exposing a framework header the rest of the host does not.
|
Package anomaly finds endpoints that don't look like anything else on their host — the lone JSON handler in an HTML app, a single 200 among 403s, an unusually large or slow response, a rare extension or parameter, an endpoint exposing a framework header the rest of the host does not. |
|
apiscan
Package apiscan drives requests built from an API description document.
|
Package apiscan drives requests built from an API description document. |
|
apispec
Package apispec parses API description documents into one normalized model and projects that model into raw HTTP requests.
|
Package apispec parses API description documents into one normalized model and projects that model into raw HTTP requests. |
|
atomicfile
Package atomicfile writes a file so that an interrupted write leaves the previous content rather than a truncated file.
|
Package atomicfile writes a file so that an interrupted write leaves the previous content rather than a truncated file. |
|
automation
Package automation holds the bearer tokens that authenticate automation clients, and the grant sets that bound what each one may do.
|
Package automation holds the bearer tokens that authenticate automation clients, and the grant sets that bound what each one may do. |
|
browser
Package browser locates an installed Chromium-family browser and launches it pointed at the proxy with the proxy CA trusted via an SPKI hash pin.
|
Package browser locates an installed Chromium-family browser and launches it pointed at the proxy with the proxy CA trusted via an SPKI hash pin. |
|
capability
Package capability is the authorization layer for Joro's automation surface.
|
Package capability is the authorization layer for Joro's automation surface. |
|
capreg
Package capreg is the single place capabilities are declared.
|
Package capreg is the single place capabilities are declared. |
|
cdp
Package cdp is a minimal Chrome DevTools Protocol client: JSON-RPC 2.0 over a single WebSocket to a locally launched headless browser.
|
Package cdp is a minimal Chrome DevTools Protocol client: JSON-RPC 2.0 over a single WebSocket to a locally launched headless browser. |
|
chain
Package chain models a multi-step workflow — a login, a checkout, a password reset — as an ordered chain of captured requests plus the data dependencies between them, and produces the mutated orderings that test whether the application enforces its own sequence.
|
Package chain models a multi-step workflow — a login, a checkout, a password reset — as an ordered chain of captured requests plus the data dependencies between them, and produces the mutated orderings that test whether the application enforces its own sequence. |
|
chainrun
Package chainrun executes the chains internal/chain describes.
|
Package chainrun executes the chains internal/chain describes. |
|
detect
Package detect implements passive vulnerability detection over HTTP traffic already captured by the proxy.
|
Package detect implements passive vulnerability detection over HTTP traffic already captured by the proxy. |
|
echo
Package echo maps every value a request sent to every place it comes back in the response, the transform it came back through, and the syntactic context it landed in.
|
Package echo maps every value a request sent to every place it comes back in the response, the transform it came back through, and the syntactic context it landed in. |
|
feeds
Package feeds aggregates curated external threat-intelligence sources (high-severity CVEs, the CISA KEV catalog, and reputable security advisory headlines) into a single normalized, in-memory snapshot the dashboard renders.
|
Package feeds aggregates curated external threat-intelligence sources (high-severity CVEs, the CISA KEV catalog, and reputable security advisory headlines) into a single normalized, in-memory snapshot the dashboard renders. |
|
httptools
Package httptools implements the token-efficient HTTP capabilities Joro exposes to automation clients.
|
Package httptools implements the token-efficient HTTP capabilities Joro exposes to automation clients. |
|
jsautomation
Package jsautomation runs installed automations: sandboxed JavaScript against Joro's capability registry, and local commands.
|
Package jsautomation runs installed automations: sandboxed JavaScript against Joro's capability registry, and local commands. |
|
jsruntime
Package jsruntime executes one JavaScript program under hard limits.
|
Package jsruntime executes one JavaScript program under hard limits. |
|
localcmd
Package localcmd runs one local operating-system command under hard limits.
|
Package localcmd runs one local operating-system command under hard limits. |
|
mcp
Package mcp implements a Model Context Protocol server over the capability registry.
|
Package mcp implements a Model Context Protocol server over the capability registry. |
|
mythic
Package mythic implements a lightweight client for the Mythic C2 framework.
|
Package mythic implements a lightweight client for the Mythic C2 framework. |
|
oast
Package oast confirms out-of-band interactions by correlating the callback server's response hash back into captured traffic.
|
Package oast confirms out-of-band interactions by correlating the callback server's response hash back into captured traffic. |
|
techfp
Package techfp is Joro's passive technology fingerprinter.
|
Package techfp is Joro's passive technology fingerprinter. |
|
trigger
Package trigger owns what makes an automation run: the event it watches, and the graph of conditions an event has to satisfy before it is worth a run.
|
Package trigger owns what makes an automation run: the event it watches, and the graph of conditions an event has to satisfy before it is worth a run. |
|
webhook
Package webhook delivers Joro's own events to an endpoint the operator configured.
|
Package webhook delivers Joro's own events to an endpoint the operator configured. |
|
sdk
module
|
|
|
tools
|
|
|
nucleigen
command
Command nucleigen is Joro's design-time converter: it reads a reviewed nuclei-templates checkout and emits the normalized signature dataset that internal/activescan/templatesig embeds.
|
Command nucleigen is Joro's design-time converter: it reads a reviewed nuclei-templates checkout and emits the normalized signature dataset that internal/activescan/templatesig embeds. |
Click to show internal directories.
Click to hide internal directories.