-
Notifications
You must be signed in to change notification settings - Fork 2
Home
Joro is a web exploitation framework for penetration testing. It bundles an intercepting HTTP/HTTPS proxy, passive vulnerability detection, blind vulnerability detection, web shell generation, C2 integration, team collaboration, a sandboxed JavaScript scripting tier, and an MCP server that serves scoped, audited capabilities to a local automation client into a single binary with an embedded web UI. Joro is the MCP server: it embeds no model and makes no outbound AI calls.
The Joro web UI's top navigation bar, in order. Each page documents the features available on that tab.
- Dashboard
- Map
- History
- Detect
- Intercept
- Manipulate
- Fuzz
- Generate
- Execute
- Interact
- Notes
- Transform
- Settings
Reached from the app header or Settings rather than the top navigation bar.
- Projects: save an engagement to a portable file, and switch between engagements.
- Testing-Browser: launch a browser already proxied through Joro, with no CA install.
- Dead-Drop: package captured requests into a file another operator can open.
- Automation: issue scoped capability tokens and serve them to a local MCP client.
- Scripting: install automations that fire on an event, on a request you pick, or as a viewer tab — sandboxed JavaScript against Joro's SDK, or a local command run against captured traffic.
- Webhooks: post to a chat client or a machine receiver when a finding, a matching response, a finished campaign or a completed automation says something worth knowing.
- Automation-Examples: worked examples of pointing a constrained agent at Joro.
- Plugins: extend Joro with native Go plugins, managed from Settings.
Both are driven from the Execute tab.
Joro has three run modes:
-
Proxy mode (the default) is covered by the tab pages above. The other two run on a publicly reachable host and are configured from Settings on the proxy side.
-
Listener-Mode: out-of-band callback server (DNS, HTTP/HTTPS, SMTP/SMTPS, FTP/FTPS, LDAP/LDAPS) for blind-vulnerability and JNDI/Log4Shell detection and XSS Hunter integration.
-
Team-Server: listener mode plus authenticated team collaboration (shared chat, shared notes, shared findings, shareable project configurations, and operator presence).