README
¶
Joro
A web exploitation framework for offensive security professionals. Intercepting proxy, blind vulnerability detection, web shell generation, C2 integration, and collaboration tools in a single binary with an embedded web UI.
Warning: This tool is intended for authorized penetration testing and security research only. You must only use Joro against systems you own or have explicit written permission to test. Unauthorized access to computer systems is illegal. Bishop Fox assumes no liability and is not responsible for any misuse or damage caused by this tool. Use responsibly.
Features
Joro covers a web application engagement end to end: an intercepting proxy for viewing and editing requests and responses, a site map and searchable history, a fuzzer, passive scanning that surfaces secrets and misconfigurations in captured traffic, out-of-band listeners for blind vulnerabilities, web shell generation and execution, Sliver and Mythic C2 integration, and a team server for running an engagement alongside other operators. Work saves to portable project files, and Go plugins enable Linux and macOS users to add anything missing.
Installation
Grab a binary from Releases, then see the wiki for installation instructions and a quick start guide.
Help
For more information:
- Checkout the wiki
- Review outstanding issues or create your own.
- See CONTRIBUTING.md for information on how to contribute.
- See CLAUDE.md for detailed developer documentation.
- See SECURITY.md for information on reporting security issues.
License - GPLv3
Joro is licensed under GPLv3, some sub-components may have separate licenses. See their respective subdirectories in this project for details.
Documentation
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
internal
|
|
|
atomicfile
Package atomicfile writes a file so that an interrupted write leaves the previous content rather than a truncated file.
|
Package atomicfile writes a file so that an interrupted write leaves the previous content rather than a truncated file. |
|
automation
Package automation holds the bearer tokens that authenticate automation clients, and the grant sets that bound what each one may do.
|
Package automation holds the bearer tokens that authenticate automation clients, and the grant sets that bound what each one may do. |
|
browser
Package browser locates an installed Chromium-family browser and launches it pointed at the proxy with the proxy CA trusted via an SPKI hash pin.
|
Package browser locates an installed Chromium-family browser and launches it pointed at the proxy with the proxy CA trusted via an SPKI hash pin. |
|
capability
Package capability is the authorization layer for Joro's automation surface.
|
Package capability is the authorization layer for Joro's automation surface. |
|
capreg
Package capreg is the single place capabilities are declared.
|
Package capreg is the single place capabilities are declared. |
|
detect
Package detect implements passive vulnerability detection over HTTP traffic already captured by the proxy.
|
Package detect implements passive vulnerability detection over HTTP traffic already captured by the proxy. |
|
httptools
Package httptools implements the token-efficient HTTP capabilities Joro exposes to automation clients.
|
Package httptools implements the token-efficient HTTP capabilities Joro exposes to automation clients. |
|
jsautomation
Package jsautomation runs installed automations: sandboxed JavaScript against Joro's capability registry, and local commands.
|
Package jsautomation runs installed automations: sandboxed JavaScript against Joro's capability registry, and local commands. |
|
jsruntime
Package jsruntime executes one JavaScript program under hard limits.
|
Package jsruntime executes one JavaScript program under hard limits. |
|
localcmd
Package localcmd runs one local operating-system command under hard limits.
|
Package localcmd runs one local operating-system command under hard limits. |
|
mcp
Package mcp implements a Model Context Protocol server over the capability registry.
|
Package mcp implements a Model Context Protocol server over the capability registry. |
|
mythic
Package mythic implements a lightweight client for the Mythic C2 framework.
|
Package mythic implements a lightweight client for the Mythic C2 framework. |
|
trigger
Package trigger owns what makes an automation run: the event it watches, and the graph of conditions an event has to satisfy before it is worth a run.
|
Package trigger owns what makes an automation run: the event it watches, and the graph of conditions an event has to satisfy before it is worth a run. |
|
webhook
Package webhook delivers Joro's own events to an endpoint the operator configured.
|
Package webhook delivers Joro's own events to an endpoint the operator configured. |
|
sdk
module
|
|