Web-Pentesting is a recon & information-gathering toolkit. Use it only on systems you are explicitly authorized to test (your own infrastructure, or environments covered by a written engagement / rules of engagement).

• Scan only networks, hosts, and domains you own or have written permission to test.
• The subdomain checker is read-only — it never writes or modifies anything.
• Respect rate limits and the ToS of any external service.

This project includes a stress command — a basic load/resilience tester that opens a burst of TCP (and optional HTTP) connections to a SINGLE target you name. It is intended only for authorized resilience assessments of infrastructure you own or are contracted to test.

Safeguards enforced in code:

• Requires an explicit authorization confirmation (--authorized, or typing AUTHORIZED in the interactive menu).
• Targets only the host/port you provide — no mass targeting.
• Bounded by a thread cap and optional --requests / --duration limits.
• No source-IP spoofing, no reflection, no amplification.

Do NOT point it at systems you are not authorized to test.

To report a security issue in the toolkit itself (unsafe default, injection, credential-handling bug), open a private security advisory on GitHub rather than a public issue.