Go to Tools II
For those dedicated stuffs like Joomla!, we write targeted tools.
For others, we add new/improve plugins in w3af (Web Application Audit and Attack Framework) for generic web application bugs. We've become a part of w3af team. Submit ideas/tool requests based on your findings/experience via the contact form.
-
W3af Plugins
- /plugins/discovery/phpinfo.py
We improved it by adding phpinfo() configuration audit checks feature from our greasemonkey phpinfosechecker.
- /plugins/discovery/fingerprint_WAF.py
We contributed four signatures - F5 Traffic Shield, NetContinuum, TEROS, BinarySec
- /plugins/discovery/findBackdoor.py
We added a dozen of new shell file names to database.
- /plugins/grep/findComments.py
We added 'secret','@', 'email','security','captcha' to self._interestingWords
- Joomla! Security/Vulnerability Scanner
Description: A regularly-updated scanner that can detect file inclusion, sql injection, command execution vulnerabilities of a target Joomla! web site.
Requirements: Perl
Start-Date: Dec 2008
- Web Firewall Stress Tester
Description: A tool to be used for newly created OSS web firewall/proxy/servers 'coz I found vulnerability in this way. Submit (GET/POST/HEAD) user-defined packets to web firewall to test its security strength. Tell you at which packet length a firewall will crash. Good for Heap/buffer overflow hunting.
[REQUEST] <----> | Web Firewall | <----> [WebServer]
Requirements: Perl
Date: Nov 2008
- Web Firewall Detector
Description: Typical Web Firewalls use a mechanism to classify anomaly traffics. This tool submits an old-school malicious (not dangerous) request, and tells you the type of firewall a particular web site use (if any). Mainly useful for blackbox security assessment. Coded years ago. Ref: Web Hacking Exposed 2nd Edition, ISBN:9780072262995
[REQUEST] <----> | Web Firewall | <----> [WebServer]
Requirements: Perl
Date: Nov 2008
No longer updated. We've contributed this wafd's signatures to w3af finger_WAF.py plugin.
- WFuzzFE
Description: WFuzz FrontEnd (WFuzz UI) is what we just wrap GUI to the all-time famous wfuzz.py by Carlos del ojo & Christian Martorella (
Edge-security.com). WFuzz is known as a Web Brute Forcer. It's a tool that got its fame thanks to its multithreading and flexibility to show only desired results based on HTTP Response Code, No. of Lines/Words. When fuzzing is done, firefox will open and show the result.
Requirements: Python, JRE 1.5 >=
Date: Oct 2008
- NiktoFE
Description: Nikto FrontEnd (Nikto UI) is what we just wrap GUI to the all-time famous nikto.pl by Sullo (
CIRT Inc).It usually takes several minutes(even hours) for a complete scan. When it's done, firefox will open and show the result.
Requirements: Perl, JRE 1.5 >=
Date: Oct 2008
- Ultimate Hackerfox Addons
Description: We've found it impossible to run Portable Firefox with several security addons thanks to our contributing testers (Ko Soe Min,
http://soemin.net & Ko Phyo,
http://myanmaritpros.com). To work around this problem, we zip-bundle hacking addons with runnable invokers (run.exe in Windows, run.pl in Linux). You must have firefox installed in your system. Make sure you already close any Firefox beforehand. Our Greasemonkey scripts Included .
Date: Auguest 2008
- GreaseMonkey:: Web Security Toolkit
Description: A collection of our Greasemonkey scripts that aim to provide security for yourself and your site. We love to write Greasemonkey scripts than Browser Addons because Greasemonkey is more flexible. Any one can view and edit source codes with ease. They will forever be compatible with any versions of Gecko browsers while most security addons are no longer compatible with new versions unless their authors take pains to modify codes for compatibility.
Last added Scripts Date: July 18 2008
- JHijackv.02 beta
Description: A simple Java Fuzzer mainly used for numeric session hijacking and parameter enumeration.
Requirement: JRE/JDK 1.4 or above
Documentation:
aldeid.com
Date: April 2008
- HackerFirefox
Description: Portable Firefox With Web Hacking Tools Bundled
Started: Dec 2007
- GoogleHacker
Description: A lightweight Windows HTA Application useful as your regular google hacking tool on Windows platform.A comprehensive search form bundled with sensitive keywords. It's capable of saving searches on disk and directly modifying keyword files.
Started: Sept 2007
Privacy Policy: No data is sent to our server. Some guys in the wild have said that our tools send your pentesting results to us. They say without even actually knowing how to view source codes. We host our tools only at trusted opensource hosting sites - sourceforge.net and googe code base. Each tool has its own weakness and strength in various situations. It's your responsibility and smartness to make the best use of tools.