Jaeles is a powerful, flexible, and extensible Go-based framework for automated web application vulnerability scanning and security testing.
The Swiss Army knife for automated Web Application Testing
Jaeles is designed for security professionals and developers to automate the detection of web application vulnerabilities using customizable signatures. It is ideal for penetration testers, bug bounty hunters, and DevSecOps teams looking to integrate automated scanning into their workflows for continuous security assessment.
Jaeles requires Go version 1.17 or higher for installation from source and supports modular signature management via a separate signatures repository. It is recommended to review and customize signatures to fit specific testing needs. Integration with tools like Burp Suite enhances workflow efficiency. Users should be aware of concurrency settings to balance scan speed and resource usage.
Download precompiled binaries from the GitHub releases page
Ensure Go environment is installed with version >= 1.17 and Go Modules enabled
Run `go install github.com/jaeles-project/jaeles@latest` to install from source
Refer to the official documentation at https://jaeles-project.github.io/ for detailed setup
Optionally, clone and install signatures from the jaeles-signatures repositoryjaeles scan -s <signature> -u <url>
Scan a single URL with a specified signature
jaeles scan -c 50 -s <signature> -U <list_urls> -L <level-of-signatures>
Scan multiple URLs concurrently with specified signature and signature level
jaeles scan -c 50 -s <signature> -U <list_urls> -p 'dest=xxx.burpcollaborator.net'
Run concurrent scans with custom parameters for payload destinations
jaeles scan -c 50 -s <signature> -U <list_urls> -f 'noti_slack "{{.vulnInfo}}"'
Scan URLs and send vulnerability notifications to Slack
jaeles scan -v -c 50 -s <signature> -U list_target.txt -o /tmp/output
Verbose scan of multiple targets with output saved to a directory
jaeles scan -s <signature> -s <another-selector> -u http://example.com
Scan a URL with multiple signature selectors
jaeles scan -G -s <signature> -s <another-selector> -x <exclude-selector> -u http://example.com
Run a scan with included and excluded signature selectors
cat list_target.txt | jaeles scan -c 100 -s <signature>
Pipe a list of URLs into Jaeles for concurrent scanning
docker pull j3ssie/jaeles
Pull the official Jaeles Docker image
docker run j3ssie/jaeles scan -s '<selector>' -u http://example.com
Run a scan inside a Docker container