Adblock Detected

Read

OWASP Xenotix XSS Exploit Framework 6

Read

OWASP Xenotix XSS Exploit Framework is an advanced Cross Site Scripting (XSS) vulnerability detection and exploitation framework. Xenotix provides Zero False Positive XSS Detection by performing the Scan within the browser engines where in real world, payloads get reflected. Xenotix Scanner Module is incorporated with 3 intelligent fuzzers to reduce the scan time and produce better results. If you really don't like the tool logic, then leverage the power of Xenotix API to make the tool work like you wanted it to be. It is claimed to have the world’s 2nd largest XSS Payloads of about 4800+ distinctive XSS Payloads. It is incorporated with a feature rich Information Gathering module for target Reconnaissance. The Exploit Framework includes real world offensive XSS exploitation modules for Penetration Testing and Proof of Concept creation.

Features

SCANNER MODULES

GET Request Manual Mode
GET Request Auto Mode
Multiple Parameter Scanner
GET Request Fuzzer
POST Request Fuzzer
Advanced Request Fuzzer
OAuth 1.0a Request Scanner
DOM Scanner
Hidden Parameter Detector

INFORMATION GATHERING MODULES

WAF Fingerprinting
Victim Fingerprinting
- IP to Location
- IP to GeoLocation
Network
- Network IP (WebRTC)
- Ping Scan
- Port Scan
- Internal Network Scan
Browser
- Fingerprinting
- Features Detector

EXPLOITATION MODULES

Send Message
Cookie Thief
Keylogger
HTML5 DDoSer
Load File
Grab Page Screenshot
JavaScript Shell
Reverse HTTP WebShell
Metasploit Browser Exploit
Social Engineering
- Phisher
- Tabnabbing
- Live WebCam Screenshot
- Download Spoofer
- Geolocation HTML5 API
- Java Applet Drive-By (Windows)
- Java Applet Drive-By Reverse Shell (Windows)
- HTA Network Configuration (Windows, IE)
- HTA Drive-By (Windows, IE)
- HTA Drive-By Reverse Shell (Windows, IE)
Firefox Addons
- Reverse TCP Shell Addon (Windows, Persistent)
- Reverse TCP Shell Addon (Linux, Persistent)
- Session Stealer Addon (Persistent)
- Keylogger Addon (Persistent)
- DDoSer Addon (Persistent)
- Linux Credential File Stealer Addon (Persistent)
- Drop and Execute Addon (Persistent)

AUXILIARY MODULES

WebKit Developer Tools
Encoder/Decoder
JavaScript Encoders
- JSFuck 6 Char Encoder
- jjencode Encoder
- aaencode Encoder
JavaScript Beautifier
Hash Calculator
Hash Detector
View Injected JavaScript
View XSS Payloads

XENOTIX SCRIPTING ENGINE

Xenotix API
IronPython Scripting Support
Trident and Gecko Web Engine Support

Download OWASP Xenotix XSS Exploit Framework 6

OWASP iOSForensic - Tool to help in forensics analysis on iOS

Read

OWASP iOSForensic is a python tool to help in forensics analysis on iOS.
It get files, logs, extract sqlite3 databases and uncompress .plist files in xml.

OWASP iOSForensic provides:

Application's files
Conversion of .plist files in XML
Extract all databases
Conversion of binary cookies
Application's logs
A List of all packages
Extraction multiple packages

Options

-h --help : show help message
-a --about : show informations
-v --verbose : verbose mode
-i --ip : local ip address of the iOS terminal
-p --port : ssh port of the iOS terminal (default 22)
-P --password : root password of the iOS terminal (default alpine)

Examples:

./iOSForensic.py -i 192.168.1.10 [OPTIONS] APP_NAME.app INCOMPLETE_APP_NAME APP_NAME2_WITHOUT_DOT_APP
./iOSForensic.py -i 192.168.1.10 -p 1337 -P pwd MyApp.app angry MyApp2

Download OWASP iOSForensic

OWASP Mantra Security Toolkit - Browser Based Security Framework

Read

OWASP ZAP v2.3.1 - An easy to use integrated penetration testing tool for finding vulnerabilities in web applications

Read

OWASP Zed Attack Proxy (ZAP) An easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing as well as being a useful addition to an experienced pen testers toolbox.

Changelog v2.3.1

The following changes were made in this release:

ZAP changes request data (while switching views) ( Issue 81 )
Unfulfilled dependencies hang the active scan ( Issue 377 )
Cant remove scripts marked as ‘load on start’ ( Issue 1073 )
core.newSession doesn’t clear Sites ( Issue 1114 )
Historical Request Tab Doesn’t allow formatting changes ( Issue 1155 )
Proxy gzip decoder doesn’t update content length in response headers ( Issue 1156 )
Unable to set a home directory with a space on the command line ( Issue 1163 )
Redundant indexes in zapdb.script ( Issue 1166 )
Add proxy support for “deflate” content encoding ( Issue 1168 )
Spider Context/User pop up menus no longer shown ( Issue 1170 )
Unable to select 2 requests in fuzz results (Ctrl + click) ( Issue 1179 )
Vulnerable pages active scanned only once ( Issue 1181 )
Alerts of same type for different parameters of same vulnerable page shown only once in “Alerts” tree ( Issue 1182 )
NullPointerException while selecting a node in the “Alerts” tab after deleting a message ( Issue 1183 )
Cmdline session params have no effect ( Issue 1191 )
Scan URL path elements – turn off by default ( Issue 1193 )
Command line arguments are not passed to extensions when starting ZAP in daemon mode ( Issue 1194 )
AbstractPlugin.bingo incorrectly sets evidence to attack ( Issue 1196 )
Issue with loading addons that did not initialize correctly ( Issue 1202 )
WordPress Authentication Script ( Issue 1203 )
‘History’ tab is not cleared when a new session is created through the API with ZAP in GUI mode ( Issue 1206 )

Download OWASP ZAP v2.3.1

OWASP OWTF – Offensive (Web) Testing Framework

Read

The purpose of this tool is to automate the manual, uncreative part of pen testing: For example, spending time trying to remember how to call "tool X", parsing results of "tool X" manually to feed "tool Y", etc.

By reducing this burden I hope pen testers will have more time to:

See the big picture and think out of the box
More efficiently find, verify and combine vulnerabilities
Have time to investigate complex vulnerabilities like business logic/architectural flaws or virtual hosting sessions
Perform more tactical/targeted fuzzing on seemingly risky areas
Demonstrate true impact despite the short timeframes we are typically given to test.

Some features like the passive and semi_passive test separation may also assist pen testers wishing to go the extra mile to get a head start and maybe even legitimately start report writing or preparing attacks before they are given the green light to test.

The tool is highly configurable and anybody can trivially create simple plugins or add new tests in the configuration files without having any development experience. Please share your tests with the community! :)

This tool is however not a silverbullet and will only be as good as the person using it: Understanding and experience will be required to correctly interpret tool output and decide what to investigate further in order to demonstrate impact.

Features

OWASP Testing Guide-oriented: owtf will try to classify the findings as closely as possible to the OWASP Testing Guide
Report updated on the fly: As soon as each plugin finishes or sometimes before (i.e. after each vulnerability scanner finishes)
"Scumbag spidering": Instead of implementing yet another spider (a hard job), owtf will scrub the output of all tools/plugins run to gather as many URLs as possible. This is somewhat "cheating" but tremendously effective since it combines the results of different tools, including several tools that perform brute forcing of files and directories.
Resilience: If one tool crashes owtf will move on to the next tool/test, saving the partial output of the tool until it crashed
Easy to configure: config files are easy to read and modify
Easy to run: No strange parameters, DB setup requirements, libraries, complex dependencies, etc
Full control of what tests to run, interactivity and hopefully easy to follow examples and help :)
Easy to review transaction logs and plain text files with URLs, simple for scripting
Basic Google Hacking without (annoying) API Key requirements via "blanket searches", trying a bunch of operators at once, you can then narrow the search down if you find something interesting.
Easy to extract data from the database to parse or pass to other tools: They are all text files

Requirements

Linux (any Ubuntu derivative should work just fine) and python 2.6.5 or greater
Latest Kali version not required but helpful (almost 0 setup time)
You do NOT have to have all tools installed: owtf will move on with an error for the missing tools

Download OWASP OWTF

OWASP ZAP v2.3.0 - An easy to use integrated penetration testing tool for finding vulnerabilities in web applications

Read

IronWASP 2014 - One of the world's best web security scannners

Read

Find security issues on your website automatically using IronWASP, one of the world's best web security scannners.

Here's what is new:

1) Login recording

Now you can easily just record a login sequence and use it in vulnerability scans and other automated tests. See video tutorial.

2) Automatically testing for CSRF, Broken Authentication, Privilege Escalation and Hidden Parameters

Now IronWASP has a new section called Interactive Testing tools that let you automatically discover vulnerabilities that could only be discovered by manual testing.

See video tutorials for CSRF Tester, Broken Authentication Tester, Hidden Parameter Tester and Privilege Escalation Tester

3) Browser pre-configured for Manual Crawling

The most common problem with intercepting proxies is that you have to change your browser's proxy settings and import the tool's certificate as a trusted CA for SSL traffic. Even after doing this there is change that traffic from your regular browsing will get mixed with your test traffic. IronWASP solves all of these problems, it comes with a browser pre-configured to use IronWASP as proxy, it handles SSL certificate errors automatically (no need to import as CA) and since this is a separate browser it does not affect the regular browsing that you are doing in your other browser. See video.

4) DOM XSS Analyzer

If you understand what DOM XSS sources and sinks are and have the ability to understand and analyse JavaScript code then you will find this new utility really useful. It makes the process of discovering DOM XSS really easy for manual testers. See video tutorial.

5) XmlChor - XPATH Injection Exploitation tool

This version comes with a new Module called XmlChor written by Harshal Jamdade. This module can be used to automatically exploit XPATH Injection vulnerabilities and extract the backend XML file from the server. See video tutorial.

6) WiHawk - WiFi Router Vulnerability Scanner

There version has one more awesome module called WiHawk written by Anamika Singh. This module can be used to scan a range of IP addresses for WiFi routers that have default password and authentication bypass vulnerabilities. It also supports Shodan API to scan large number of devices on the internet. See video tutorial.

Download IronWASP 2014

OWASP ZAP 2.3.0.1 - An easy to use integrated penetration testing tool for finding vulnerabilities in web applications

Read

OWASP Xenotix XSS Exploit Framework v5

Read