BreakTheSecurity is proud to release the Hash Code Cracker Version 1.2. Our latest release supports Online Cracking function.
Description:
This password cracker is developed for PenTesters and Ethical hackers. Please Use this software for legal purposes(Testing the Password Strength).
Features:
This software will crack the MD5, SHA1,NTLM(Windows Password) hash codes. No need to install. Supports All platforms(windows XP/7,Linux,..).
V1.2 Changelog :
Included Online cracking Support
Minimum Requirements:
Java Runtime Environment: JRE 1.6 should be installed.(you can get it from oracle.com)
How to Run the Application?

    Download the .zip file and extract.
    Extract the zip file.
    Open the Terminal or command prompt.
    Navigate to the path of Extracted zip file (i mean HashCodeCracker
    Folder) in Terminal/CMD.
    Type this command "java -jar HashCodeCracker.jar".
    Now the application will run.

[Download] [Mirror]


Project HomePage:
http://projects.breakthesecurity.com/

A Complete Suite Of Web Security Tools

The Suite provides a complete and functional marketplace of highly integrated web application security tools. You will find that different areas are covered by various domain-specific solutions. The Suite consists of automated scanners, fuzzers, utilities and many other tools useful in numerous situations.

Consistent And Easy To Use

The look and feel is consistent across all applications, which makes them incredibly easy to work with. You no longer have to look for hidden options, remember commands or even change the way you go about doing your work. It all just makes sense.

Wide Coverage Of Security Vulnerabilities

The Suite scanning technology is able to discover variety of issues from XSS, SQL Injection, Local File Includes to Default Logins, Session Problems and many others. OWASP TOP 10, WASC and variety of other lists are well supported. For the complete list of vulnerabilities we can discover just click here.

[Download Websecurify]

Basics of Pen Test: A Lesson for Beginners
Pentester Career: How to Begin?
Professional Penetration Testing: How to Get Started?
Penetration Testing with Nessus
BackTrack for Pentesting?
Network Scanning: The Basic Tools
Blind Command Line Injection
CSRF Testing and its Protection Using RequestRodeo
Python for Coders and Pentesters
Pentesting a Nation – Is Australia Safe From Attack?
Interview with Rod Soto


Download: 

Features:
- Simple and friendly GUI.
- Open installers into the application with only drag and drop executables from Windows Explorer.
- Explore the internal content (files and more) of the installer.
- Extract the embedded files and script to a local folder, to a zip package or to a self-extracting module (portable).
- Decompiles the "CompiledCode.bin" file of the Installer to get the assembly code, corresponding to the "Code" script section (for advanced users only).
- Open internal files of the installer into the same application.
- Perform file searches by keyword.
- Input panel, that allows you to enter a valid password to extract encrypted installers.
- Properties panel to see advanced information about the installer.
- History for recently opened installer.
- Other miscellaneous options.
- Support older and latest versions of Inno Setup.
- Support older and latest versions of InnoUnp.
- Full Unicode support.
- Application available in multiple languages.
- Much more!

Download: Mediafire Solidfiles

Evasi0n Jailbreaking tools available for Apple iOS 7 users. This jailbreak utility/tool made by Evad3rs team after 3 months of iOS 7 launched. evasi0n is available for Mac and Windows, and is untethered. Here are the requirements posted on the evasi0n website:

• A computer, running Windows (XP minimum), Mac OS X (10.6 minimum) or Linux (x86 / x86_64)
• iTunes installed if you’re running Windows
• An iPhone, iPad or iPod running iOS 7.0 through 7.0.4 (you may check in Settings / General / About => Version)
• A USB cable to connect the device to the computer

evasi0n7 is an untethered jailbreak which supports iOS 7, iOS 7.0.1, iOS 7.0.2, iOS 7.0.3, iOS 7.0.4.

It is compatible with the following iOS 7.x.x devices:

• iPhone 5s, iPhone 5c, iPhone 5, iPhone 4S, iPhone 4, iPhone 3GS
• iPad Air, iPad 4, iPad 3, iPad 2
• Retina iPad mini, iPad mini
• iPod touch 5G

[Download evasi0n7]

A graphical application created in C# .Net 1.1 that helps the penetration tester to inject SQL commands on a web page. Its main strength is its capacity to automate tedious blind SQL injection with several threads. Under Clarified Artistic License.
[Screenshot]

[download]

DirBuster is a multi threaded java application designed to brute force directories and files names on web/application servers.
[Screenshot]

[Download]

Description

How to use : - Just give it a target after that select what type of site is that (joomla or wprdpress)
then click on start button. After finish the scan it will give you a popup about result. Now you have to click on Save Report .
Now copy the exploitable link .. and search in google
For a better tut visit http://www.madleets.com/Thread-MAD-SCAN-Exploit-Scanner-Beta

[Download]

[Download]

Description

Vuln Hunter 2014 - Website Vulnerability Scanner By Pooria Sharaffodin

Features:
Dork Search
Dorks Included
Custom Dork Search
Live Website Injection Viewer
Live Url Injection Viewer
Live Vulnerability Found Counter
Mass SQLi ((i)Injection) Scanner
Mass XSS Injection Scanner
Mass /etc/passwd Injection Scanner
Single SQLi Scanner
Single XSS Scanner
Single /etc/passwd Scanner
SQLi - Commands, Examples
XSS - Commands, Examples
/etc/passwd - Commands, Examples
Send to SQLi, XSS, etc/passwd Scanner
Save SQLi, XSS, etc/passwd Vulnerabilities
Clear SQLi, XSS, etc/passwd Vulnerabilities
Add, Remove Dork - Dorklist

Decode and Encode Functions Text(ASCii) to:
Text to Base64 - Base64 to Text De-Encode
Text to Binary - Binary to Text De-Encode
Text to Hex - Hex to Text De-Encode
Decimal to Octal - Octal to Decimal

This Software is made for the security, do not hack people sites.
You can Check your Website for Vulnerabilities to Fix and Warn other Admins.

[Download]

[Download]
VirusTotal: https://www.virustotal.com/en/file/4085699351e0b76242d04a6a2eda43e3e3fb4a195db62d0e77a8e384a48d3154/analysis/

Feature Overview

Convenient virtual machine image
(VirtualBox v3.2 or later recommended, VMware provided)
Targets include:

    OWASP’s WebGoat
    Google’s Gruyere
    Damn Vulnerable Web App
    Hacme Casino
    OWASP InsecureWebApp
    w3af’s test website
    simple training targets by Maven Security (including REST and JSON)

Tools: (starred = new this version)

    Burp Suite (free version)
    w3af
    sqlmap
    arachni *
    metasploit
    Zed Attack Proxy *
    OWASP Skavenger
    OWASP Dirbuster
    Paros
    Webscarab
    Ratproxy
    skipfish
    websecurify
    davtest
    J-Baah
    JBroFuzz
    Watobo *
    RATS
    helpful Firefox add-ons

[Download]

Source: https://www.mavensecurity.com/web_security_dojo/

Another interesting tool was drawn to my attention yesterday - Chrome Extension Exploitation Framework or XSS ChEF, which exploits XSS vulnerabilities in Chrome extensions. What you can acctualy do with this tool (when you have appropriate privileges):
 - Monitor open tabs of victims
 - Execute JS on every tab (global XSS)
 - Extract HTML, read/write cookies (also httpOnly), localStorage
 - Get and manipulate browser history
 - Stay persistent until whole browser is closed (or even futher if you can persist in extensions localStorage)
 - Make screenshot of victims window
 - Further exploit e.g. via attaching BeEF hooks, keyloggers etc.
 - Explore filesystem through file:// protocol
 - Bypass Chrome extensions content script sandbox to interact directly with page JS
Demo video:

Demo video 2:

More information about XSS ChEF @ : http://blog.kotowicz.net/2012/07/xss-chef-chrome-extension-exploitation.html
Download from github: https://github.com/koto/xsschef

Today I came across to a new tool which seems to be interesting - SP Toolkit (Simple Phishing Toolkit). Since phishing is one of the biggest problem in IT security it seems logical to build a toolkit to test people/customers/organizations for phising emails. Combined with some other tools, e.g. metasploit, this could be a very useful tool when performing a pentest. The authors of the toolkit are information security proffesionals who needed a tool for phishing attacks, so they wrote a toolkit. From the website:
spt is a simple concept with powerful possibilities.  It is what it’s name implies:  a simple phishing toolkit.
The basic idea we (the spt project) had was that wouldn’t it be cool if there were a simple, effective, easy to use and free (most importantly!) tool that information security professionals could use to evaluate and train what we all know is the weakest link in any security minded organization:  the people.  Since the founders of the spt project are themselves information security professionals by day (and possibly either LOL cats or zombies by night), they themselves faced the frustration of dealing with people within their own organizations that claimed to know better, but 9 times out of 10 fell for the most absurdly obvious phishing emails ever seen.  A malware outbreak here, a stolen password and loss of critical organizational data there and the costs of dealing with the results of phishing can get to be astronomical pretty darn quickly!...

  

More information @: http://www.sptoolkit.com/
Watch the video:

Rob Dixon [ @304geek ] from AccuvantLABS published small but simple tool writen in bash called Scrape-DNS which can be used for quering cached DNS entries in search for malware and other "bad" sites. Short exerpt from 304geeks blog post:
"Back at my old job, we used cache snooping techniques (Scraping) to check for evidence of client systems that were attempting to resolve known malware sites.

We would use the list at Mayhemiclabs.com and compare it to our cached DNS entries.

So, why don't we do something badass like that, but to support the penetration test or red team mission?

Using standard cache snooping techniques you can determine what anti-virus vendors might be in use on a clients network.

HOW? Simple. By making non-recursive queries to the client's DNS servers for known AV update site domains.

Yes, it is that simple.

 

To query cached DNS entries, you need only to make a NON-recursive request a target DNS server..."

[Download]

Original post: http://304geeks.blogspot.com/

The Samurai Web Testing Framework is a LiveCD focused on web application testing. We have collected the top testing tools and pre-installed them to build the perfect environment for testing applications.

[Download]

ModSecurity is an embeddable web application firewall, which means it can be deployed as part of your existing web server infrastructure (Apache, IIS7 and Nginx).

This deployment method has certain advantages:

1. No changes to existing network. It only takes a few minutes to add ModSecurity to your existing web servers. And because it was designed to be completely passive by default, you are free to deploy it incrementally and only use the features you need. It is equally easy to remove or deactivate it should decide you don't want it any more.
2. No single point of failure. Unlike with network-based deployments, you will not be introducing a new point of failure to your system.
3. Implicit load balancing and scaling. Because it works embedded in web servers, ModSecurity will automatically take advantage of the additional load balancing and scalability features. You will not need to think of load balancing and scaling unless your existing system needs them.
4. Minimal overhead. Because it works from inside the web server process there is no overhead for network communication and minimal overhead in parsing and data exchange.
5. No problem with encrypted or compressed content. Many IDS systems have difficulties analysing SSL traffic. This is not a problem for ModSecurity because it is positioned to work when the traffic is decrypted and decompressed.

ModSecurity is known to work well on a wide range of operating systems. Our customers are successfully running it on Linux, Windows, Solaris, FreeBSD, OpenBSD, NetBSD, AIX, Mac OS X, and HP-UX.

[Download ModSecurity v2.7]

Description

its a Joomla Vulnerability Scanner made by .net  You need dotnet framework 4.5 for use it. made by skywalk3r for Madleets.

[Download]

PySQLi is a python framework designed to exploit complex SQL injection vulnerabilities. It provides dedicated bricks that can be used to build advanced exploits or easily extended/improved to fit the case.

PySQLi is thought to be easily modified and extended through derivated classes and to be able to inject into various ways such as command line, custom network protocols and even in anti-CSRF HTTP forms.

PySQLi is still in an early stage of development, whereas it has been developed since more than three years. Many features lack but the actual version but this will be improved in the next months/years.

Download PySQLi

Faraday introduces a new concept (IPE) Integrated Penetration-Test Environment a multiuser Penetration test IDE. Designed for distribution, indexation and analysis of the generated data during the process of a security audit.
The main purpose of Faraday is to re-use the available tools in the community to take advantage of them in a multiuser way.

Design for simplicity, users should feel no difference between their own terminal application and the one included in Faraday. Developed with a specialized set of functionalities that help users improve their own work. Do you remember yourself programming without an IDE? Well, Faraday does the same an IDE does for you when programming, but from the perspective of a penetration test.

[Download]

Features
PHP Server Based

SQLI Websites
XSS Websites
LFI Websites
RFI Websites
Admin Panels
Upload Vulnerability

ASP Server Based

ASP SQLI Websites
ASP XSS Websites
ASP Admin Panels
ASP Upload Vulnerability

Website Related Tools

Wordpress Website Finder
Joomla Website Finder
Sub Domain Scanner
Web Terminator ( DDos Attack )
IP Resolver
NS Lookup
Joomla Website Vulnerability Scanner

[Download]

Virustotal: https://www.virustotal.com/en/file/17da98c633d90be74c9c85d26dac8c84271a8135f40ef6ce36c0e46b26b34df2/analysis/1387476034/

[Download]

BTS PenTesting Lab is a vulnerable web application that helps you in learning basic to advanced vulnerability types. The App is still in Beta version(v0.2).
Currently, the app allows you to learn the following vulnerability types:
SQL Injection
XSS
CSRF
Clickjacking
SSRF
File Inclusion
Command Execution
I am trying to bring some advanced vulnerability types and advanced techniques. Hopefully, you can see in next update :)
The app is developed by Sabari Selvan, a security researcher at Cyber Security Privacy Foundation(cysecurity.org)

How to run BTS PenTesting Lab?
1. Install XAMPP or WAMPP in your machine
2. Extract the bts_lab zip file into the htdocs folder.
3.  Open the "http://localhost/bts_lab/setup.php" url in your browser.
4. Click the Setup.
Now you can use http://localhost/bts_lab in Browser

[Download]

Exploit Pack is an open source GPLv3 licensed bundle of scripts ( known as exploits ) with an easy to use GUI and a SID IDE. It’s built on JAVA and Python, which means it’s easy to customize and works very nicely on any device. Like every software that has an open source license you can patch, extend or add your own ideas to it. Just checkout the code and go for it. This tool was made thinking on the end-user, it's not going to replace any other security tool on the market, but it's for sure a must-have for every security enthusiast, researcher or paranoid user.

It's easy to use

Not a security savvy but wanna IDDQD?

Hello script kiddie. Don't you worry, you can always use this tool without reading any kind of documentation. But shame on you.

Multi OS support

No matter which platform you like.

It was developed thinking on multi platform support by default for x86 but it will run on Windows, Linux, FreeBSD and Mac OSX.

IDE for Exploit Dev's

Start coding your own exploits.

A must-have for effective exploit development, extend or add more features and include your own exploit codes. 

Download  Exploit Pack

Think Python

 Learn Python the Hard way, 3rd edition

Advance Python Features Gone Bad

Invent Your Own Computer Game With Python

Hacking Secret Ciphers With Python

Python Programming for Absolute Beginner

Byte Of Python

Beginning Python from Newbies to Professional

Download [Here]

Virustotal: https://www.virustotal.com/en/file/cd41b19cf465c17b81621b0428e0e1f4ed0a4e47cf84ac9da0bd84a29b1660cc/analysis/
Jotti.org: http://virusscan.jotti.org/en/scanresult/c9d7f8d5bc5e0ad0c71c9605ef98d667582e4226

SQLSentinel is an opensource tool that automates the process of finding the sql injection on a website. SQLSentinel includes a spider web and sql errors finder. You give in input a site and SQLSentinel crawls and try to exploit parameters validation error for you. When job is finished, it can generate a pdf report which contains the url vuln found and the url crawled. 

Please remember that SQLSentinel is not an exploiting tool. It can only finds url Vulnerabilities.

[Download SQLSentinel]

Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. It provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy. Individuals can use it to keep remote Websites from tracking them and their family members. They can also use it to connect to resources such as news sites or instant messaging services that are blocked by their local Internet service providers (ISPs).

Changes: This release reduces directory overhead, provides enormous crypto performance improvements for fast relays on recent hardware, a new v3 TLS handshake protocol that can better resist fingerprinting, support for protocol obfuscation plugins, better scalability for hidden services, IPv6 support for bridges, performance improvements like allowing clients to skip the first round-trip on the circuit ("optimistic data") and refilling token buckets more often, a new "stream isolation" design to isolate different applications on different circuits, and many stability, security, and privacy fixes. 

DOWNLOAD TOR 

OSForensics updated to version 2.0. OSForensics allows you to identify suspicious files and activity with hash matching, drive signature comparisons, e-mails, memory and binary data. It lets you extract forensic evidence from computers quickly with advanced file searching and indexing and enables this data to be managed effectively. New version having ability to capture pages from web sites and add them to a case and Support for multiple drives & folders when indexing, searching multiple set of index files in a single search, Faster search times of indexes (up to 500% faster) ,Much improved E-mail browser, Dozens of other improvements and bug fixes.

[Download OSForensics]

Weevely is a stealth PHP web shell that provides a telnet-like console. It is an essential tool for web application post exploitation, and can be used as stealth backdoor or as a web shell to manage legit web accounts, even free hosted ones.

Weevely is currently included in Backtrack and Backbox and all the major Linux distributions oriented for penetration testing.

• More than 30 modules to automatize administration and post exploitation tasks:
• Execute commands and browse remote filesystem, even with PHP security restriction
• Audit common server misconfigurations
• Run SQL console pivoting on target machine
• Proxy your HTTP traffic through target
• Mount target filesystem to local mount point
• Simple file transfer from and to target
• Spawn reverse and direct TCP shells
• Bruteforce SQL accounts through target system
• Run port scans from target machine
• And so on..
• Backdoor communications are hidden in HTTP Cookies
• Communications are obfuscated to bypass NIDS signature detection
• Backdoor polymorphic PHP code is obfuscated to avoid HIDS AV detection

You can download Weevely v1.0 here:

weevely-1.0.tar.gz

Or read more here.

PenQ is an open source Linux based penetration testing browser bundle we built over Mozilla Firefox. It comes pre-configured with security tools for spidering, advanced web searching, fingerprinting, anonymous browsing, web server scanning, fuzzing, report generating and more. 

PenQ is configured to run on Debian based distributions including Ubuntu and its derivative distros, and penetration testing operating systems such as BackTrack and Kali.With all its integrations, PenQ is a powerful tool. Be mindful of what use you put it to. Responsible use of PenQ can help secure web apps in a zap.

Features

• OWASP ZAP
• OWASP WebScarab
• OWASP WebSlayer
• Nikto Web Server Scanner

• Wfuzz Web Application Fuzzer
• Mozilla Add-ons Collection
• Integrated Tor
• OWASP Penetration Testing Checklist

• PenTesting Report Generator
• Vulnerability Databases Search
• Access to Shell and System Utilities
• Collection of Useful Links

[Download]

Patator is a multi-purpose brute-forcer, with a modular design and a flexible usage.

Currently it supports the following modules:

* ftp_login : Brute-force FTP

* ssh_login : Brute-force SSH

* telnet_login : Brute-force Telnet

* smtp_login : Brute-force SMTP

* smtp_vrfy : Enumerate valid users using the SMTP VRFY command

* smtp_rcpt : Enumerate valid users using the SMTP RCPT TO command

* finger_lookup : Enumerate valid users using Finger

* http_fuzz : Brute-force HTTP/HTTPS

* pop_login : Brute-force POP

* pop_passd : Brute-force poppassd (not POP3)

* imap_login : Brute-force IMAP

* ldap_login : Brute-force LDAP

* smb_login : Brute-force SMB

* smb_lookupsid : Brute-force SMB SID-lookup

* vmauthd_login : Brute-force VMware Authentication Daemon

* mssql_login : Brute-force MSSQL

* oracle_login : Brute-force Oracle

* mysql_login : Brute-force MySQL

* mysql_query : Brute-force MySQL queries

* pgsql_login : Brute-force PostgreSQL

* vnc_login : Brute-force VNC

* dns_forward : Brute-force DNS

* dns_reverse : Brute-force DNS (reverse lookup subnets)

* snmp_login : Brute-force SNMPv1/2 and SNMPv3

* unzip_pass : Brute-force the password of encrypted ZIP files

* keystore_pass : Brute-force the password of Java keystore files

[Download]

With every website you visit, you’re vulnerable to malicious hackers out to steal your surfing history, passwords, email access, bank account numbers, medical info, and more. And the “big browsers” don’t do enough to stop it. But now you can protect yourself before you go on the Web – with WhiteHat Aviator, the Web’s most secure and private browser. With WhiteHat Aviator, you get the industry’s best and tightest security and privacy safeguards – all built-in, all activated, all ready-to-go.

[Download]

FruityWifi is a wireless network auditing tool based in the Wifi Pineapple idea. The application can be installed in any Debian based system. Tested in Debian, Kali Linux, Kali Linux ARM (Raspberry Pi), Raspbian (Raspberry Pi), Pwnpi (Raspberry Pi).

With the new version, it is possible to install external modules. This functionality gives the user more flexibility and the FruityWifi can be customized. The modules can be added or removed anytime using the on-line repository.

Available modules:

• Hostapd Karma
• URLsnarf
• DNSspoof
• Kismet
• Squid (code injection capabilities)
• SSLstrip (code injection capabilities)
• nmap
• mdk3
• ngrep
• Captive Portal

New modules are being developed continuously and can be installed from the modules page.

Using the installation script all the required dependencies, scripts and setup can be installed, or if you prefer you can download a SD image of Pwnpi 3.0 with FruityWifi v1.6 from the wiki page: 

https://github.com/xtr4nge/FruityWifi/wiki/Install

[Download]

WebSurgery is a suite of tools for security testing of web applications. It was designed for security auditors to help them with web application planning and exploitation. Suite currently contains a spectrum of efficient, fast and stable web tools (Crawler, Bruteforcer, Fuzzer, Proxy, Editor) and some extra functionality tools (Scripting Filters, List Generator, External Proxy).

Main Tools

Crawler

• High Performance Multi-Threading and Completely Parameterized Crawler
• Extracts Links from HTML / CSS / JavaScript / AJAX / XHR
• Hidden Structure Identification with Embedded Bruteforcer
• Parameterized Timing Settings (Timeout, Threading, Max Data Size, Retries)
• Parameterized Limit Rules (Case Sensitive, Process Above / Below, Dir Depth, Max Same File / Script Parameters / Form Action File)
• Parameterized Extra Rules (Fetch Indexes / Sitemaps, Submit Forms, Custom Headers)
• Supports Advanced Filters with Scripting & Regular Expressions (Process, Exclude, Page Not Found, Search Filters)

Bruteforcer

• High Performance Multi-Threading Bruteforcer for Hidden Structure (Files / Directories)
• Parameterized Timing Settings (Timeout, Threading, Max Data Size, Retries)
• Parameterized Rules (Base Dir, Bruteforce Dirs / Files, Recursive, File Extension, Custom Headers)
• Parameterized Advanced Rules (Send GET / HEAD, Follow Redirects, Process Cookies)
• Supports Advanced Filters with Scripting & Regular Expressions (Page Not Found, Search Filters)
• Supports List Generator with Advanced Rules

Fuzzer

• High Performance Multi-Threading Fuzzer Generates Requests based on Initial Request Template
• Exploitation for (Blind) SQL Injections, Cross Site Scripting (XSS), Denial of Service (DOS), Bruteforce for Username / Password Authentication Login Forms
• Identification of Improper Input Handling and Firewall / Filtering Rules
• Parameterized Timing Settings (Timeout, Threading, Max Data Size, Retries)
• Parameterized Advanced Rules (Follow Redirects, Process Cookies)
• Supports Advanced Filters with Scripting & Regular Expressions (Stop / Reset Level, Search Filters)
• Supports List Generator with Advanced Rules
• Supports Multiple Lists with Different Levels

Proxy

• Proxy Server to Analyze, Intercept and Manipulate Traffic
• Parameterized Listening Interface IP Address & Port Number
• Supports Advanced Filters with Scripting & Regular Expressions (Process, Intercept, Match-Replace, Search Filters)

Editor

• Advanced ASCII / HEX Editor to Manipulate Individual Requests
• Parameterized Timing Settings (Timeout, Max Data Size, Retries)
• Automatically Fix Request (Content-Length, New Lines at End)

Extra Tools

Scripting Filters

• Advanced Scripting Filters to Filter Specific Requests / Responses
• Main Variables (url, proto, hostport, host, port, pathquery, path, query, file, ext)
• Request Variables (size, hsize, dsize, data, hdata, ddata, method, hasparams, isform)
• Response Variables (size, hsize, dsize, data, hdata, ddata, status, hasform)
• Operators =, !=, ~, !~, >=, <=, >, <
• Conjunctions &, |
• Supports Reverse Filters and Parenthesis

List Generator

• List Generator for Different List Types (File, Charset, Numbers, Dates, IP Addresses, Custom)
• Parameterized Rules (Prefix, Suffix, Case, Reverse, Fixed-Length, Match-Replace)
• Parameterized Crypto / Hash Rules (URL, URL All, HTML, BASE-64, ASCII, HEX, MD5, SHA-512)

External Proxy

• External Proxy Redirects Traffic to Another Proxy
• Supports Non-Authenticated Proxies (HTTP, SOCKS4, SOCKS5)
• Supports Authenticated Proxies (HTTP Basic, SOCKS5 Username/Password)
• Supports DNS Lookups at Proxy Side

          

[Download ]

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.

[Download]

Wapiti allows you to audit the security of your web applications.

It performs "black-box" scans, i.e. it does not study the source code of the application but will scans the webpages of the deployed webapp, looking for scripts and forms where it can inject data.

Once it gets this list, Wapiti acts like a fuzzer, injecting payloads to see if a script is vulnerable.

Wapiti can detect the following vulnerabilities :

• File disclosure (Local and remote include/require, fopen, readfile...)
• Database Injection (PHP/JSP/ASP SQL Injections and XPath Injections)
• XSS (Cross Site Scripting) injection (reflected and permanent)
• Command Execution detection (eval(), system(), passtru()...)
• CRLF Injection (HTTP Response Splitting, session fixation...)
• XXE (XmleXternal Entity) injection
• Use of know potentially dangerous files (thanks to the Nikto database)
• Weak .htaccess configurations that can be bypassed
• Presence of backup files giving sensitive information (source code disclosure)

Wapiti supports both GET and POST HTTP methods for attacks.

It also supports multipart and can inject payloads in filenames (upload).

Display a warning when an anomaly is found (for example 500 errors and timeouts)

Makes the difference beetween permanent and reflected XSS vulnerabilities.

General features :

• Generates vulnerability reports in various formats (HTML, XML, JSON, TXT...)
• Can suspend and resume a scan or an attack
• Can give you colors in the terminal to highlight vulnerabilities
• Different levels of verbosity
• Fast and easy way to activate/deactivate attack modules
• Adding a payload can be as easy as adding a line to a text file

Browsing features

Support HTTP and HTTPS proxies

Authentication via several methods : Basic, Digest, Kerberos or NTLM

Ability to restrain the scope of the scan (domain, folder, webpage)

Automatic removal of a parameter in URLs

Safeguards against scan endless-loops (max number of values for a parameter)

Possibility to set the first URLs to explore (even if not in scope)

Can exclude some URLs of the scan and attacks (eg: logout URL)

Import of cookies (get them with the wapiti-cookie and wapiti-getcookie tools)

Can activate / deactivate SSL certificates verification

Extract URLs from Flash SWF files

Try to extract URLs from javascript (very basic JS interpreter)

HTML5 aware (understand recent HTML tags)

Wapiti is a command-line application.

Here is an exemple of output against a vulnerable web application.

You may find some useful informations in the README and the INSTALL files.

[Download]