zombie-vdp 1.0.8

🧟‍♂️ Zombie VDP – Ultimate Offensive Security Framework for VDP/Bug Bounty

🧟‍♂️ ZOMBIE VDP – Ultimate Offensive Security Framework

---

⚠️ DISCLAIMER

FOR AUTHORIZED SECURITY TESTING ONLY

This tool is designed exclusively for:

• Vulnerability Disclosure Programs (VDP)
• Authorized Bug Bounty programs
• Security researchers with explicit written permission
• Educational purposes in controlled lab environments

Unauthorized scanning of systems you do not own or have permission to test is ILLEGAL. The authors assume no liability for misuse of this software. You are solely responsible for complying with all applicable laws and regulations.

---

🎯 What is ZOMBIE VDP?

ZOMBIE VDP is an all-in-one offensive security automation framework that transforms your bug bounty workflow into a relentless, intelligent machine. Like the undead, it never stops hunting.

🧬 The Philosophy

Traditional scanners are noisy, linear, and predictable. ZOMBIE breaks that mold:

Traditional Scanners	🧟 ZOMBIE VDP
Sequential scanning	🔀 Concurrent multi-vector attacks
Static payloads	🧬 DNA Cloning — mutating payloads
Easy to fingerprint	👻 Ghost Mode — invisible to WAF
Single perspective	🪞 Mirror Mode — multi-identity rotation
Manual recon chain	⛓️ Automated end-to-end kill chain
Basic crawling	🕸️ Deep JavaScript endpoint extraction

---

🩸 Core Architecture

---

🚀 Features

🔍 Reconnaissance (OSINT + Passive)

• ✅ Google/Bing/DDG Dorking — Automated dork generation from templates
• ✅ Wayback Machine — Historical endpoint discovery via CDX API
• ✅ CommonCrawl — Massive-scale URL indexing (billions of pages)
• ✅ crt.sh Integration — SSL certificate transparency log mining
• ✅ AlienVault OTX — Threat intelligence passive DNS/subdomain
• ✅ URLScan.io — Domain scan history & screenshot analysis
• ✅ WHOIS Lookup — Domain registration intelligence

🕷️ Advanced Crawler

• ✅ JavaScript-aware crawling — Executes JS, extracts dynamic content
• ✅ SPA Support — Single Page Application endpoint discovery
• ✅ Sourcemap Parser — Extract hidden paths from .js.map files
• ✅ JS Endpoint Extractor — Find API endpoints in minified JavaScript
• ✅ Robots.txt respect — Ethical crawling with configurable bypass
• ✅ Configurable depth & delay — Stealthy or aggressive modes

💉 Vulnerability Detection

Module	Description	CVEs Detected
IDOR	Insecure Direct Object Reference	Parameter manipulation, UUID prediction
XXE	XML External Entity Injection	Blind & error-based, SSRF chaining
JWT Attack	JSON Web Token exploitation	None algo, weak secrets, KID injection
GraphQL	Introspection & injection	Batching attacks, field suggestion abuse
WebSocket	WS message tampering	CSWSH, connection hijacking
Prototype Pollution	JS object prototype injection	Server-side & client-side vectors
SQL Injection	Time-based, boolean, error-based	MySQL, PostgreSQL, MSSQL, Oracle
XSS	Reflected, Stored, DOM-based	WAF bypass payloads included
SSRF	Server-Side Request Forgery	AWS metadata, GCP, internal services
LFI/RFI	Local/Remote File Inclusion	Log poisoning, PHP wrappers
CSRF	Cross-Site Request Forgery	Token validation, same-site bypass
Open Redirect	URL redirection	Header-based, meta-refresh, JS redirect

👻 Ghost/Mirror — Advanced Evasion

🛡️ Stealth & Anonymity

• ✅ Anonymous Mode — Tor/SOCKS5 proxy chaining
• ✅ Proxy Validation — Auto-test proxy health before use
• ✅ SSL Verification Toggle — Accept self-signed certs when needed
• ✅ Rate Limiting — Adaptive request throttling
• ✅ Random Delays — Human-like timing patterns
• ✅ Filter System — ninja, samurai, ghost presets

---

📦 Installation

Prerequisites

• Python 3.9 or higher
• pip (latest version recommended)
• git

Quick Install

# Clone the repository
git clone https://github.com/pormes-90/ZOMBIE.git
cd ZOMBIE

# Basic installation
pip install .

# Full installation with all features
pip install ".[all]"

# Development installation
pip install -e ".[dev,ghost]"