wig identifies a websites CMS by searching for fingerprints of static files and extracting version numbers from known files.
OS identification is done by using the value of the 'server' and 'X-Powered-By' in the response header. These values are compared to a database of which package versions are include with different operating systems.
There are currently three profiles:
1. Only send one request: wig only sends a request for '/'. All fingerprints matching this url are tested.
2. Only send one request per plugin: The url used in most fingerprints is used
4. All fingerprints: All fingerprints are tested
Help screen:

# wig.py --help
usage: wig.py [-h] [-v] [-p {1,2,4}] host

WebApp Information Gatherer

positional arguments:
  host        the host name of the target

optional arguments:
  -h, --help  show this help message and exit
  -v          list all the urls where matches have been found
  -p {1,2,4}  select a profile: 1) Make only one request - 2) Make one request
              per plugin - 4) All

Example of run:

# python3 wig.py www.example.com

CMS                  Drupal CMS: [7.25, 7.24, 7.26, 7.23, 7.22]
Operating System     Microsoft Windows Server: [2008 R2]
Server Info          Microsoft-IIS: [7.5, 6.0]
______________________________________________________________
Time: 18.0 sec | Plugins: 65 | Urls: 324 | Fingerprints: 14178

Requirements:

• Python 3
• requests

[Download]

READ MORE

[Download] [Mirror]

READ MORE

PySQLi is a python framework designed to exploit complex SQL injection vulnerabilities. It provides dedicated bricks that can be used to build advanced exploits or easily extended/improved to fit the case.

PySQLi is thought to be easily modified and extended through derivated classes and to be able to inject into various ways such as command line, custom network protocols and even in anti-CSRF HTTP forms.

PySQLi is still in an early stage of development, whereas it has been developed since more than three years. Many features lack but the actual version but this will be improved in the next months/years.

Download PySQLi

READ MORE

Think Python

 Learn Python the Hard way, 3rd edition

Advance Python Features Gone Bad

Invent Your Own Computer Game With Python

Hacking Secret Ciphers With Python

Python Programming for Absolute Beginner

Byte Of Python

Beginning Python from Newbies to Professional

READ MORE

Patator is a multi-purpose brute-forcer, with a modular design and a flexible usage.

Currently it supports the following modules:

* ftp_login : Brute-force FTP

* ssh_login : Brute-force SSH

* telnet_login : Brute-force Telnet

* smtp_login : Brute-force SMTP

* smtp_vrfy : Enumerate valid users using the SMTP VRFY command

* smtp_rcpt : Enumerate valid users using the SMTP RCPT TO command

* finger_lookup : Enumerate valid users using Finger

* http_fuzz : Brute-force HTTP/HTTPS

* pop_login : Brute-force POP

* pop_passd : Brute-force poppassd (not POP3)

* imap_login : Brute-force IMAP

* ldap_login : Brute-force LDAP

* smb_login : Brute-force SMB

* smb_lookupsid : Brute-force SMB SID-lookup

* vmauthd_login : Brute-force VMware Authentication Daemon

* mssql_login : Brute-force MSSQL

* oracle_login : Brute-force Oracle

* mysql_login : Brute-force MySQL

* mysql_query : Brute-force MySQL queries

* pgsql_login : Brute-force PostgreSQL

* vnc_login : Brute-force VNC

* dns_forward : Brute-force DNS

* dns_reverse : Brute-force DNS (reverse lookup subnets)

* snmp_login : Brute-force SNMPv1/2 and SNMPv3

* unzip_pass : Brute-force the password of encrypted ZIP files

* keystore_pass : Brute-force the password of Java keystore files

[Download]

READ MORE