whoof is an early stage lightweight web browser hooking framework. A web browser hook can be thought of as a backdoor in a web page allowing an attacker to execute commands in the page with or without the visitor noticing. whoof is a web application security tool to manage, execute and assess web browser vulnerabilities.

whoof uses Node/Express server-side, with React/Redux on the client-side.

Hooked browsers are managed via WebSockets.

Check out the wiki for details on features and getting started.

Use the attack builder to construct custom attacks on the fly.

Use the terminal to execute arbitrary commands or retrieve data from hooked pages.

One click download an exported attack which can easily be imported in the admin web app.

This repo was built off of and ejected from Facebook's create-react-app