web-sorrow v 1.3.8 - remote security scanner for misconfig, version detection, and server enumeration scanning tool writen in perl

Update Web-sorrow v 1.3.8 - remote security scanner for misconfig, version detection, and server enumeration scanning tool writen in perl

A perl based tool used for checking a Web server for misconfiguration, version detection, enumeration, and server information. I will build more Functionality in the future. what is's NOT: Vulnerably scanner, inspection proxy, DDoS tool, exploitation framework. It's entirely focused on Enumeration and collecting Info on the target server

CURRENT functionality:

-S - stands for standard. a set of Standard tests and includes: indexing of directories testing, banner grabbing, language detection (should be obvious), robots.txt, and 200 response testing (some servers send a 200 ok for every req)

-auth - looks for login pages with a list of some of the most common login files and dirs. don't need to be very big list of URLs because what else are going to name it? notAlogin.php???

-Cp - scan with a huge list of plugins dirs. the list is a bit old (2010)

-I - searches the responses for interesting strings

-Ws - looks for web services such as hosting provider, blogging services, favicon fingerprinting, and cms version info

-Fd - look for generally things people don't want you to see. The list is generated form a TON of robot.txt so whatever it finds should be interesting.

-Fp - FingerPrint server based on behavior (unrefined as of yet)

-ninja - A light weight and undetectable scan that uses bits and peaces from other scans

-Sd - BruteForce Sub Domains

-Db - BruteForce Directories with the big dirbuster Database

-ua - use a custom UserAgent. PUT UA IN QUOTES if theres spaces

-proxy - send all http reqs via a proxy. example: 255.255.255.254:8080

-e - run all the scans in the tool

web-sorrow also has false positives checking on most of it's requests (it pretty accurate but not perfect)

EXAMPLES:

basic: perl Wsorrow.pl -host scanme.nmap.org -S

look for login pages: perl Wsorrow.pl -host 192.168.1.1 -auth

most intense scan possible: perl Wsorrow.pl -host 192.168.1.1 -e -ua "I come in peace"


Download latest Version : Web-Sorrow_v1.3.8.zip (7.0 MB)
Information on Other version |
For More Information : http://code.google.com/p/web-sorrow/

---------------------------------------------------------------------------------------------

you need to install perl for running web-sorrow on linux.

If you are running on windows machine then

Download Perl from  

http://strawberryperl.com/ 

---------------------------------------------------------------------------------------------

Previous Post about web-sorrow -

http://santoshdudhade.blogspot.in/2012/05/web-sorrow-remote-web-scanner-for.html