• IP Server
• CMS Detect & Version
• DNS Lookup
• Nmap ports IP SERVER
• Enumeration Users
• Enumeration Plugins
• Find Exploit Core CMS
• Find Exploit DB
• CloudFlare Resolver

• SQL Injection (SQLI)
• Cross-site scripting (XSS)
• Remote File Inclusion (RFI)
• Local File Inclusion (LFI)
• Directory Traversal or Path Traversal (DT/PT)
• Source Code Disclosure (SCD)
• OS Command Injection (OSCI)
• PHP Code Injection

• Code Analyzer: composed by tree generator and taint analyser. The tool has integrated a lexer and a parser generated by ANTLR, and based in a grammar and a tree grammar written to PHP language. The tree generator uses the lexer and the parser to build the AST (Abstract Sintatic Tree) to each PHP file. The taint analyzer performs the taint analysis navigating through the AST to detect potentials vulnerabilities.


• False Positives Predictor: composed by a supervised trained data set with instances classified as being vulnerabilities and false positives and by the Logistic Regression machine learning algorithm. For each potential vulnerability detected by code analyser, this module collects the presence of the attributes that define a false positive. Then, the Logistic Regression algorithm receives them and classifies the instance as being a false positive or not (real vulnerability).


• Code Corrector: Each real vulnerability is removed by correction of its source code. This module for the type of vulnerability selects the fix that removes the vulnerability and signalizes the places in the source code where the fix will be inserted. Then, the code is corrected with the insertion of the fixes and new files are created.     

Features

• AutomatedDetection Automated XSS/SQL Detection
• AttackLists Self-Defined Attack Lists
• Sessions Session Definition
• Categorizer Categorizer
• Reporter Generate Report
• FirefoxAddon Firefox Addon

• Beautify
• UI-Diff Diff
• UI-Link Link

Pick your audit

End the discussion

Keep it simple

• Flexible: Supports dozens of advanced techniques for mapping out networks filled with IP filters, firewalls, routers, and other obstacles. This includes many port scanning mechanisms (both TCP & UDP), OS detection, version detection, ping sweeps, and more. See the documentation page.
• Powerful: Nmap has been used to scan huge networks of literally hundreds of thousands of machines.
• Portable: Most operating systems are supported, including Linux, Microsoft Windows, FreeBSD, OpenBSD, Solaris, IRIX, Mac OS X, HP-UX, NetBSD, Sun OS, Amiga, and more.
• Easy: While Nmap offers a rich set of advanced features for power users, you can start out as simply as "nmap -v -A targethost". Both traditional command line and graphical (GUI) versions are available to suit your preference. Binaries are available for those who do not wish to compile Nmap from source.
• Free: The primary goals of the Nmap Project is to help make the Internet a little more secure and to provide administrators/auditors/hackers with an advanced tool for exploring their networks. Nmap is available for free download, and also comes with full source code that you may modify and redistribute under the terms of the license.
• Well Documented: Significant effort has been put into comprehensive and up-to-date man pages, whitepapers, tutorials, and even a whole book! Find them in multiple languages here.
• Supported: While Nmap comes with no warranty, it is well supported by a vibrant community of developers and users. Most of this interaction occurs on the Nmap mailing lists. Most bug reports and questions should be sent to the nmap-dev list, but only after you read the guidelines. We recommend that all users subscribe to the low-traffic nmap-hackers announcement list. You can also find Nmap on Facebook and Twitter. For real-time chat, join the #nmap channel on Freenode or EFNet.
• Acclaimed: Nmap has won numerous awards, including "Information Security Product of the Year" by Linux Journal, Info World and Codetalker Digest. It has been featured in hundreds of magazine articles, several movies, dozens of books, and one comic book series. Visit the press pagefor further details.
• Popular: Thousands of people download Nmap every day, and it is included with many operating systems (Redhat Linux, Debian Linux, Gentoo, FreeBSD, OpenBSD, etc). It is among the top ten (out of 30,000) programs at the Freshmeat.Net repository. This is important because it lends Nmap its vibrant development and user support communities.  

o Integrated all of your IPv4 OS fingerprint submissions since June 2013
  (2700+ of them). Added 366 fingerprints, bringing the new total to 4485.
  Additions include Linux 3.10 - 3.14, iOS 7, OpenBSD 5.4 - 5.5, FreeBSD 9.2,
  OS X 10.9, Android 4.3, and more. Many existing fingerprints were improved.
  Highlights: http://seclists.org/nmap-dev/2014/q3/325 [Daniel Miller]

o (Windows, RPMs) Upgraded the included OpenSSL to version 1.0.1i. [Daniel Miller]

o (Windows) Upgraded the included Python to version 2.7.8. [Daniel Miller]

o Removed the External Entity Declaration from the DOCTYPE in Nmap's XML. This
  was added in 6.45, and resulted in trouble for Nmap XML parsers without
  network access, as well as increased traffic to Nmap's servers. The doctype
  is now:
  

o [Ndiff] Fixed the installation process on Windows, which was missing the
  actual Ndiff Python module since we separated it from the driver script.
  [Daniel Miller]

o [Ndiff] Fixed the ndiff.bat wrapper in the zipfile Windows distribution,
  which was giving the error, "\Microsoft was unexpected at this time." See
  https://support.microsoft.com/kb/2524009 [Daniel Miller]

o [Zenmap] Fixed the Zenmap .dmg installer for OS X. Zenmap failed to launch,
  producing this error:
    Could not import the zenmapGUI.App module:
    'dlopen(/Applications/Zenmap.app/Contents/Resources/lib/python2.6/lib-dynload/glib/_glib.so, 2):
    Library not loaded: /Users/david/macports-10.5/lib/libffi.5.dylib\n
    Referenced from:
    /Applications/Zenmap.app/Contents/Resources/lib/python2.6/lib-dynload/glib/_glib.so\n
    Reason: image not found'.

o [Ncat] Fixed SOCKS5 username/password authentication. The password length was
  being written in the wrong place, so authentication could not succeed.
  Reported with patch by Pierluigi Vittori.

o Avoid formatting NULL as "%s" when running nmap --iflist. GNU libc converts
  this to the string "(null)", but it caused segfault on Solaris. [Daniel Miller]

o [Zenmap][Ndiff] Avoid crashing when users have the antiquated PyXML package
  installed. Python tries to be nice and loads it when we import xml, but it
  isn't compatible. Instead, we force Python to use the standard library xml
  module. [Daniel Miller]

o Handle ICMP admin-prohibited messages when doing service version detection.
  Crash reported by Nathan Stocks was: Unexpected error in NSE_TYPE_READ
  callback.  Error code: 101 (Network is unreachable) [David Fifield]

o [NSE] Fix a bug causing http.head to not honor redirects. [Patrik Karlsson]

o [Zenmap] Fix a bug in DiffViewer causing this crash:
     TypeError: GtkTextBuffer.set_text() argument 1 must be string or read-only
     buffer, not NmapParserSAX
  Crash happened when trying to compare two scans within Zenmap. [Daniel Miller]

Intro

• Data grabbing:
  • URL's (geturl/massurl) -> (scan)
  • Configs, Databases, SQLi's (dork)
  • Full Path Disclosures / Users (fpds) -> (brutefpds)
  • Top websites info (top)
• Massive scanning
  • XSS, SQLi, LFI, RFI (scan)
  • FTP, SSH, DB's, IMAP (multibruter)
  • Accurate SSH bruteforce (brutefpds)

Plan

• Web Apps
  • Grab url's via 'geturl' or 'massurl' (massurl requires list of tags as file)
  • Scan url's parameters for vulns with 'scan'
• Servers
  • Pick target, get ip range
  • Scan for services on each IP and bruteforce with 'multibruter'
  • Grab full path disclosures, and so linux usernames
  • Perform SSH bruteforce for specific user with 'brutefpds'
• Info grabbing
  • Use 'dork' for automatic dorking
  • Use 'fpds' for full path disclosure grabbing
  • Use 'search' for searching someone in ur databases
  • Use 'top' for scanning all top websites of specific nation
• Others
  • 'Stat' shows actual statistics and informations
  • 'Show' display specific file
  • 'Clear' and 'filter' - remove duplicates, remove blacklisted url's

Others

• php5-mysql - for mysql connections
• php5-pgsql - for postgresql connections
• libssh2-php - for ssh connections
• php5-sybase - for mssql connections
• php5-imap - for imap connections

Changelog v2.3.1

• ZAP changes request data (while switching views) ( Issue 81 )
• Unfulfilled dependencies hang the active scan ( Issue 377 )
• Cant remove scripts marked as ‘load on start’ ( Issue 1073 )
• core.newSession doesn’t clear Sites ( Issue 1114 )
• Historical Request Tab Doesn’t allow formatting changes ( Issue 1155 )
• Proxy gzip decoder doesn’t update content length in response headers ( Issue 1156 )
• Unable to set a home directory with a space on the command line ( Issue 1163 )
• Redundant indexes in zapdb.script ( Issue 1166 )
• Add proxy support for “deflate” content encoding ( Issue 1168 )
• Spider Context/User pop up menus no longer shown ( Issue 1170 )
• Unable to select 2 requests in fuzz results (Ctrl + click) ( Issue 1179 )
• Vulnerable pages active scanned only once ( Issue 1181 )
• Alerts of same type for different parameters of same vulnerable page shown only once in “Alerts” tree ( Issue 1182 )
• NullPointerException while selecting a node in the “Alerts” tab after deleting a message ( Issue 1183 )
• Cmdline session params have no effect ( Issue 1191 )
• Scan URL path elements – turn off by default ( Issue 1193 )
• Command line arguments are not passed to extensions when starting ZAP in daemon mode ( Issue 1194 )
• AbstractPlugin.bingo incorrectly sets evidence to attack ( Issue 1196 )
• Issue with loading addons that did not initialize correctly ( Issue 1202 )
• WordPress Authentication Script ( Issue 1203 )
• ‘History’ tab is not cleared when a new session is created through the API with ZAP in GUI mode ( Issue 1206 )

• You need to provide range of ip's (e.g. 127.0.0.1 - 127.0.0.10); program will perform operations on each address separately, basing on selected options, then it will print out the response.
• By default, program will only check open ports, print http response headers, test for HTTP methods and check FTP for anonymous login.
• If 'SSH/IMAP/DB's' are checked, program will try to bruteforce SSH,IMAP,MySQL,PostgreSQL & MsSQL using array of passwords and users defined on the beggining of script. Notice, that it will try to login as user with grand permissions (e.g. root, postgres), although you're able to edit it.
• If 'FTP User' is set, program will also try to bruteforce FTP with specific user using mentioned passwords array. By default it's not, and it will only test for anonymous login.
• If 'Deep Scan' is set, program will perform all aforementioned operations. Further, it will use nmap with specific parameters you're able to edit, also, the traceroute scan will be performed and displayed - just like nmap. Deep Scan also gather some useful informations about a website (if it's running), such as interesting files/folders and www title.
• ?url=website.com for quick IP address of specific website.
  ...so - what it does it do? Nmap, traceroute, port scan, ftp anonymous login, ftp/ssh/imap/mysql/pgsql/mssql bruteforce, http (website) info gathering, 
  Crawler accepts as a parameter array of files and folders that you can manually edit, just like others options.