WebSurgery – Web Application Security Testing Suite

WebSurgery is a suite of tools for security testing of web applications. It was designed for security auditors to help them with the web application planning and exploitation. Currently, it uses an efficient, fast and stable Web Crawler, File/Dir Brute forcer, Fuzzer for advanced exploitation of known and unusual vulnerabilities such as SQL Injection, Cross site scripting (XSS), Brute force for login forms, identification of firewall-filtered rules, DOS Attacks and WEB Proxy to analyze, intercept and manipulate the traffic between your browser and the target web application.
WEB Crawler
WEB Crawler was designed to be fast, accurate, stable, completely parametrable and the use of advanced techniques to extract links from Javascript and HTML Tags. It works with parametrable timing settings (Timeout, Threading, Max Data Size, Retries) and a number of rules parameters to prevent infinitive loops and pointless scanning (Case Sensitive, Dir Depth, Process Above/Below, Submit Forms, Fetch Indexes/Sitemaps, Max Requests per File/Script Parameters). It is also possible to apply custom headers (user agent, cookies etc) and Include/Exclude Filters. WEB Crawler come with an embedded File/Dir Brute Forcer which helps to directly brute force for files/dirs in the directories found from crawling.
WEB Bruteforcer
WEB Bruteforcer is a brute forcer for files and directories within the web application which helps to identify the hidden structure. It is also multi-threaded and completely parametrable for timing settings (Timeout, Threading, Max Data Size, Retries) and rules (Headers, Base Dir, Brute force Dirs/Files, Recursive, File’s Extension, Send GET/HEAD, Follow Redirects, Process Cookies and List generator configuration).
By default, it will brute force from root / base dir recursively for both files and directories. It sends both HEAD and GET requests when it needs it (HEAD to identify if the file/dir exists and then GET to retrieve the full response).
WEB Fuzzer
WEB Fuzzer is a more advanced tool to create a number of requests based on one initial request. Fuzzer has no limits and can be used to exploit known vulnerabilities such (blind) SQL Inections and more unsual ways such identifing improper input handling, firewall/filtering rules, DOS Attacks.
WEB Editor
A simple WEB Editor to send individual requests. It also contains a HEX Editor for more advanced requests.
WEB Proxy
WEB Proxy is a proxy server running locally and will allow you to analyze, intercept and manipulate HTTP/HTTPS requests coming from your browser or other application which support proxies.
You can download WebSurgery here:
Setup – setup.msi
Portable – websurgery.zip

Read More

14 SepWAVSEP – Web Application Vulnerability Scanner Evaluation Project Want to Learn Penetration Testing

The author of WAVSEP (Shay Chen) e-mailed quite some time back about this project, but I have to say I honestly didn’t have time to look at it back then. It popped back up on my radar again when it was mentioned by the author of – Arachni v0.3 – his tool did extremely well in the WAVSEP tests.
The benchmark tests the SQL Injection and Reflected XSS vulnerability detection accuracy of12 commercial web application scanners and 48 free & open source web application scanners, and discusses the capabilities of many others (including information about a potential Trojan horse in one of them).
In addition to the benchmark, the author has published a detailed feature comparison between all the scanners (which generally include every open source or free to use web application vulnerability scanner commonly available)
The research compares the following aspects of these tools:

• Number & Type of Vulnerability Detection Features
• SQL Injection Detection Accuracy
• Reflected Cross Site Scripting Detection Accuracy
• General & Special Scanning Features

And what the author believes to me most important is that during his research he has developed a toolkit that can be used by any individual or organization to test the accuracy of web application scanners in a very detailed and accurate manner.
I for one applaud his efforts and I think this is a great project, of course there’s no completely objective ranking for these kind of things – but this study does give you a good idea of where different apps stand especially in terms of SQL Injection and XSS detection.
A lot of the tools we’ve written about here at Darknet come out tops (unsurprisingly).
The benchmark and reports (about 13 in total) can be found here:
http://sectooladdict.blogspot.com/
The framework for assessing vulnerability scanners was implemented in JEE and can be downloaded here:
wavsep-v1.0.3-war.zip

Read More

Lilith – Web Application Security Audit Tool

LiLith is a tool written in Perl to audit web applications. This tool analyses webpages and looks for html form tags , which often refer to dynamic pages that might be subject to SQL injection or other flaws. It works as an ordinary spider and analyses pages, following hyperlinks, injecting special characters that have a special meaning to any underlying platform.
Any Web applications scanner can never perform a full 100% correct audit. Therefore, a manual re-check is necessary. Hence, be aware that Lilith might come up with several false positives.
LiLith is a program that verifies the security of a web application. As a security consultant, the author often sees web applications that contain security flaws. A web application is a complex entity and cannot be fully checked with “just any tool”, therefor I recommend you to manually verify any results.
How the entire “scanning” process works is different from so called “CGI scanners”, such as nikto and n-stealth. This program will surf to a website and crawls through all the links, just as a user would to. On any possible input field, such as text boxes, page id’s, … LiLith will attempt to inject any characters that might have a special meaning for any underlying technology such as SQL.
For more information, it is recommended to read the following white paper: web dissection using lilith.
You can download Lilith here:
lilith-06atar.gz

Read More

NASA Web App Lets You Control Space & Time in 3D

NASA has released its “Eyes on the Solar System” 3D environment, a free web browser-based application that lets you navigate a 3D version of the solar system. The app uses video game technology to let you control your point of view from anywhere in our solar system, speeding up time so you can see the motion of the planets, their satellites and NASA spacecraft.

We tried the Eyes on the Solar System app (download here), which first requires a download of the Unity Web Player for Mac and PC. Once you’ve done that, you can fly around beautifully produced models of all the planets, asteroids and the Sun. Or you can enter custom modules created by NASA that highlight missions such as Juno, the recently launched probe that’s currently on a five-year mission to Jupiter.

According to NASA:

“This is the first time the public has been able to see the entire solar system and our missions moving together in real time,” said Jim Green, director of NASA’s Planetary Science Division at the agency’s Headquarters in Washington. “It demonstrates NASA’s continued commitment to share our science with everyone.”

You can even keep tabs on the current locations of NASA spacecraft, with the help of NASA’s actual mission data. Don’t forget to click the Full Screen button for the full effect. Fantastic stuff.

Download The App Here:

Read More