8. [RAFT V3.0.1] RESPONSE ANALYSIS AND FURTHER TESTING TOOL
RAFT adalah testing tool untuk mengidentifikasi kelemahan terhadap aplikasi web.
RAFT bisa digunakan untuk fuzzing.
Download Raft v3.0.1
Download Raft v3.0.1
6. [COOKIECATCHER] SESSION HIJACKING TOOL
Fitur-fitur yang tersedia:
- Prebuilt payloads to steal cookie data
- Just copy and paste payload into a XSS vulnerability
- Will send email notification when new cookies are stolen
- Will attempt to refresh cookies every 3 minutes to avoid inactivity timeouts
- Provides full HTTP requests to hijack sessions through a proxy (BuRP, etc)
- Will attempt to load a preview when viewing the cookie data
- PAYLOADS
- Basic AJAX Attack
- HTTPONLY evasion for Apache CVE-20120053
- More to come
- Prebuilt payloads to steal cookie data
- Just copy and paste payload into a XSS vulnerability
- Will send email notification when new cookies are stolen
- Will attempt to refresh cookies every 3 minutes to avoid inactivity timeouts
- Provides full HTTP requests to hijack sessions through a proxy (BuRP, etc)
- Will attempt to load a preview when viewing the cookie data
- PAYLOADS
- Basic AJAX Attack
- HTTPONLY evasion for Apache CVE-20120053
- More to come
Video Demo: http://www.youtube.com/watch?v=2GH6RRozOpY
5. [SPEARPHISHER] A SIMPLE PHISHING EMAIL GENERATION TOOL
SpearPhisher
adalah sebuah tools yang digunakan untuk menyebarkan halaman phising.
Tools ini sangat mudah digunakan dan sangat powerfull untuk kegiatan
phising.
Fitur-Fitur yang tersedia:
- The tool supports specifying different sending names and email addresses, multiple recipients via TO, CC, BCC, and allows bulk loading with one recipient email address per line in a file.
- It allows customization of the subject, adding one attachment, and SSL support for SMTP enabled mail servers. One of the popular features with our client is the WYSIWYG HTML editor that allows virtually anyone to use the tool; previewing results as you point and click edit your malicious email body.
- If you want to add custom XSS exploits, client side attacks, or other payloads such as a Java Applet code generated by the Social Engineer Toolkit (SET), its split screen editor allows more advanced users to edit HTML directly.
4. [JSQL INJECTION V0.5] JAVA TOOL FOR AUTOMATIC DATABASE INJECTION
jSQL Injection adalah aplikasi yang ringan untuk mendapatkan informasi database dan mengexploitasi database.
jSQL free, open source and cross-platform (Windows, Linux, Mac OS X, Solaris).
Fitur- Fitur jSQL Injection – Versi 0.5:
- SQL shell
- Uploader
- Admin page checker and preview
- Brute forcer (md5 mysql)
- Coder (encode decode base64 hex md5)
- Distant file reading
- Webshell deposit
- Terminal for webshell commands
- Configuration backup
- Update checker
- Time based algorithm
- Multi-thread control (start/pause/resume/stop)
- Shows URL calls
- GET, POST, header, cookie methods
- Normal, error based, blind algorithms
- Automatic best algorithm selection
- Progression bars
- Simple evasion
- Proxy setting
- Supports MySQL
3. [WHATWEB V0.4.7] CMS TECHNOLOGY SCANNER
WhatWeb digunakan untuk mengidentifikasi websites. Tujuannya adalah untuk menjawab pertanyaan, “What is that Website?”. Detail website akan diberikan sesuai dengan kebutuhan. Biasanya digunakan untuk Content Management System seperti “WordPress, Joomla, dsb”.
Fitur-fitur yang tersedia:
* Over 900 plugins
* Control the trade off between speed/stealth and reliability
* Plugins include example URLs
* Performance tuning. Control how many websites to scan concurrently.
* Multiple log formats: Brief (greppable), Verbose (human readable), XML, JSON, MagicTree, RubyObject, MongoDB.
* Recursive web spidering
* Proxy support including TOR
* Custom HTTP headers
* Basic HTTP authentication
* Control over webpage redirection
* Nmap-style IP ranges
* Fuzzy matching
* Result certainty awareness
* Custom plugins defined on the command line
* Over 900 plugins
* Control the trade off between speed/stealth and reliability
* Plugins include example URLs
* Performance tuning. Control how many websites to scan concurrently.
* Multiple log formats: Brief (greppable), Verbose (human readable), XML, JSON, MagicTree, RubyObject, MongoDB.
* Recursive web spidering
* Proxy support including TOR
* Custom HTTP headers
* Basic HTTP authentication
* Control over webpage redirection
* Nmap-style IP ranges
* Fuzzy matching
* Result certainty awareness
* Custom plugins defined on the command line
Contoh penggunaan:
Check beberapa website:
Menggunakan fitur untuk mencari informasi yang lebih detail.
Menggunakan fitur untuk mencari informasi yang lebih detail.
2. [ARACHNI V0.4.5.1-0.4.2] OPEN SOURCE WEB APPSEC SCANNER
Arachni adalah
aplikasi gratis (Open Source project) untuk mencari kelemahan dan
mendukung keamanan aplikasi, release code dibawah Apache License Version 2.0 dan kita semua gratis menggunakannya.
Fitur-Fitur dan Perubahan yang tersedia:
- Optimized pattern matching to use less resources by grouping patterns to only be matched against the per-platform payloads. Bottom line, pattern matching operations have been greatly reduced overall andvulnerabilities can be used to fingerprint the remote platform.
- Modules
- Path traversal ( path_traversal)
- Updated to use more generic signatures.
- Added dot-truncation for MS Windows payloads.
- Moved non-traversal payloads to the file_inclusion module.
- File inclusion ( file_inclusion) — Extracted from path_traversal.
- Uses common server-side files and errors to identify issues.
- SQL Injection ( sqli) — Added support for the following databases:
- Firebird
- SAP Max DB
- Sybase
- Frontbase
- IngresDB
- HSQLDB
- MS Access
- localstart_asp — Checks if localstart.asp is accessible.
- Path traversal ( path_traversal)
- Plugins — Added:
- Uncommon headers ( uncommon_headers) — Logs uncommon headers.
Langganan:
Postingan (Atom)