Acunetix Web Vulnerability Scanner (WVS) is an automated web application security testing tool that audits your web applications by checking for exploitable hacking vulnerabilities. Automated scans may be supplemented and cross-checked with the variety of manual tools to allow for comprehensive web site and web application penetration testing.

This week the latest version was released, Acunetix Vulnerability Scanner 9.5.

Features

• AcuSensor Technology
• Industry’s most advanced and in-depth SQL injection and Cross site scripting testing
• Advanced penetration testing tools, such as the HTTP Editor and the HTTP Fuzzer
• Visual macro recorder makes testing web forms and password protected areas easy
• Support for pages with CAPTCHA, single sign-on and Two Factor authentication mechanisms
• Extensive reporting facilities including PCI compliance reports
• Multi-threaded and lightning fast scanner – processes thousands of pages with ease
• Intelligent crawler detects web server type, application language and smartphone-optimized sites.
• Acunetix crawls and analyzes different types of websites including HTML5, SOAP and AJAX
• Port scans a web server and runs security checks against network services running on the server

This new release adds the ability to run security scans on applications built with Google Web Toolkit (GWT). It can also automatically test JSON and XML data objects for vulnerabilities. In addition, vulnerabilities are now also classified using CVE, CWE and CVSS, and AcuSensor has been updated for .NET 4.5 web applications.

Download Acunetix Vulnerability Scanner 9.5

READ MORE

Protect your business. Protect your customers. Here's how: websites built on open source Content Management Systems (CMSs) are uniquely vulnerable. If you are responsible for maintaining one, or if you are the executive or business owner in charge of approving IT budgets, you need to know what's in this book. Here's the lowdown on very real security threats, how attacks are carried out, what security measures you need to take, and how to compile a disaster recovery plan. Don't wait. Your business may depend on the action you take.

2011 | 432 Pages | ISBN: 0470916214 | EPUB | 14 MB

[Download]

READ MORE

[Download]

READ MORE

• A checker (site and tool) for CVE-2014-0160: https://github.com/FiloSottile/Heartbleed
• ssltest.py: Quick and dirty demonstration of CVE-2014-0160 by Jared Stafford http://pastebin.com/WmxzjkXJ
• SSL Server Test https://www.ssllabs.com/ssltest/index.html
• Metasploit Module: https://github.com/rapid7/metasploit-framework/pull/3206/files
• Nmap NSE script: Detects whether a server is vulnerable to the OpenSSL Heartbleed: https://svn.nmap.org/nmap/scripts/ssl-heartbleed.nse
• Nmap NSE script: Quick'n'Dirty OpenVAS nasl wrapper for ssl_heartbleed based on ssl_cert_expiry.nas https://gist.github.com/RealRancor/10140249
• Heartbleeder: Tests your servers for OpenSSL: https://github.com/titanous/heartbleeder?files=1
• Heartbleed Attack POC and Mass Scanner: https://bitbucket.org/fb1h2s/cve-2014-0160
• Heartbleed Honeypot Script: http://packetstormsecurity.com/files/126068/hb_honeypot.pl.txt

Credit: http://hack-tools.blackploit.com/2014/04/collection-of-heartbleed-tools-openssl.html

READ MORE

The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).
The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.
Read more at http://heartbleed.com/

READ MORE

Madspot Shell 1.0 Have Following Features:
Madspot shell works both on Windows and Linux OS.
- Process
- Eval
- SQL
- Hash
- Perl and PHP Back Connect
- Zone-h mass defacer
- Powerfull DDOS tool
- Auto Safe mood Off
- Whole Server Auto Symlink
- Perl 500 Internal Error Bypass
- Killcode

[Download]
Pass=http://madspot.net

READ MORE

What is Malwr?

Malwr is a free malware analysis service and community launched in January 2011. You can submit files to it and receive the results of a complete dynamic analysis back.

Mission

Existing online analysis services are all based on closed and commercial technologies, often with intents to leverage people's data to own profit and with no real transparency on how the data is being used. We are researchers ourselves and felt the need of an alternative solution.
Our mission is to provide a powerful, free, independent and non-commercial service to the security community, independent or academic researchers with no other goal than facilitating everyone's daily work and give a contribution to the community.

Independent

Malwr is operated by volunteer security professionals with the exclusive intent to help the community. It's not associated or influenced by any commercial or government organization of any sort.

Non-Commercial

We do not profit on your data. The files you submit, the information you provide and any other use you make of the website is not commercialized in any way. We create and use open source technology. We're not advertising any commercial product, we are not collecting data to enrich any existing product.

Privacy

Unless you specify otherwise, the files you submit are not shared outside. While we believe in the value of sharing within our community and the larger public, we do strongly believe in respecting your privacy and the confidentiality of the data you handle.
We really invite you to read our Terms of Service for "detailed" "policies".

[Malware Analysis by Cuckoo Sandbox]

READ MORE

Web Application Vulnerabilities: Detect, Exploit, Prevent �Web Application Vulnerabilities: Detect, Exploit, Prevent� Syngress | 2007 | ISBN: 1597492094 9781597492096 9780080556642 | 476 pages | PDF | 17 MB This book describes how to make a computer bend to your will by finding and exploiting vulnerabilities specifically in Web applications. The book describes common security issues in Web applications, tells you how to find them, describes how to exploit them, and then tells you how to fix them. The book covers how and why some hackers (the bad guys) will try to exploit these vulnerabilities to achieve their own end. Author explains how to detect if hackers are actively trying to exploit vulnerabilities in your own Web applications. � Learn to defend Web-based applications developed with AJAX, SOAP, XMLPRC, and more. � See why Cross Site Scripting attacks can be so devastating. Contents Chapter 1 : Introduction to Web Application Hacking Introduction Web Application Architecture Components Complex Web Application Software Components Putting it all Together The Web Application Hacking Methodology The History of Web Application Hacking and the Evolution of Tools Summary Chapter 2 : Information Gathering Techniques Introduction The Principles of Automating Searches Applications of Data Mining Collecting Search Terms Summary Chapter 3 : Introduction to Server Side Input Validation Issues Introduction Cross Site Scripting (XSS) Chapter 4 : Client-Side Exploit Frameworks Introduction AttackAPI BeEF CAL9000 Overview of XSS-Proxy Summary Solutions Fast Track Frequently Asked Questions Chapter 5 : Web-Based Malware Introduction Attacks on the Web Hacking into Web Sites Index Hijacking DNS Poisoning (Pharming) Malware and the Web: What, Where, and How to Scan Parsing and Emulating HTML Browser Vulnerabilities Testing HTTP-scanning Solutions Tangled Legal Web Summary Solutions Fast Track Frequently Asked Questions Chapter 6 : Web Server and Web Application Testing with BackTrack Objectives Introduction Approach Core Technologies Open Source Tools Case Studies: The Tools in Action Chapter 7 : Securing Web Based Services Introduction Web Security Instant Messaging Web-based Vulnerabilities Buffer Overflows Making Browsers and E-mail Clients More Secure Securing Web Browser Software CGI Break-ins Resulting from Weak CGI Scripts FTP Security Directory Services and LDAP Security Summary Solutions Fast Track Frequently Asked Questions Index Web Application Vulnerabilities: Detect, Exploit, Prevent  
[Download]

READ MORE

Salted Hash Kracker is the free all-in-one tool to recover the Password from Salted Hash text. These days most websites and applications use salt based hash generation to prevent it from being cracked easily using precomputed hash tables such as Rainbow Crack. In such cases, 'Salted Hash Kracker' will help you to recover the lost password from salted hash text.

It also allow you to specify the salt position either in the beginning of password(salt+password) or at the end of the password (password+salt). In case you want to perform normal hash cracking without the salt then just leave the 'Salt field' blank.

Currently it supports password recovery from following popular Hash types

• MD5
• SHA1
• SHA256
• SHA384
• SHA512

It uses dictionary based cracking method which makes the cracking operation simple and easier. You can find good collection of password dictionaries (also called wordlist) here & here

It is fully portable and works on all Windows platforms starting from Windows XP to Windows 8.

[Download]

READ MORE

A tool to help developers and security professionals conduct manual security code reviews in a consistent and repeatable way. Agnitio aims to replace the adhoc nature of manual security code review documentation, create an audit trail and reporting.

Features

• Security code reviews
• Security code review metrics and reporting
• Application security code review tool
• Static analysis security guidance and reporting

[Download]

READ MORE