Webapps | Penetration Testing Tools

Gobuster

February 6, 2017dookieWeb Applicationsenumeration, http, https, infogathering, webapps

Gobuster is a web content scanner that looks for existing (and/or hidden) web objects. It basically works by launching a dictionary based attack against a web server and analyzing the response.

Commix

February 1, 2016g0t mi1kExploitation Toolsexploitation, webapps

commix Package Description Commix (short for [comm]and [i]njection e[x]ploiter) has a simple environment and it can be used, from web developers, penetration testers or even security researchers to test web applications with the view to find bugs, errors or vulnerabilities related to command injection attacks. By using this tool, it is very easy to find…

Parsero

June 9, 2014adminInformation Gathering, Web Applicationsinfogathering, webapps

Parsero is a free script written in Python which reads the Robots.txt file of a web server and looks at the Disallow entries. The Disallow entries tell the search engines what directories or files hosted on a web server mustn’t be indexed.

Arachni

February 19, 2014portsWeb Applicationsexploitation, gui, infogathering, webapps

Arachni is an Open Source, feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of web applications.

deblaze

February 18, 2014portsWeb Applicationswebapps

Through the use of the Flex programming model and the ActionScript language, Flash Remoting was born. Flash applications can make request to a remote server to call server side functions, such as looking up accounts, retrieving additional data and graphics, and performing complex business operations.

DIRB

February 18, 2014portsWeb Applicationsenumeration, http, https, infogathering, webapps

DIRB is a Web Content Scanner. It looks for existing (and/or hidden) Web Objects. It basically works by launching a dictionary based attack against a web server and analizing the response.

DirBuster

February 18, 2014portsWeb Applicationsenumeration, gui, http, https, infogathering, webapps

DirBuster is a multi threaded java application designed to brute force directories and files names on web/application servers.

fimap

February 18, 2014portsWeb Applicationsexploitation, http, https, vulnanalysis, webapps

fimap is a little python tool which can find, prepare, audit, exploit and even google automaticly for local and remote file inclusion bugs in webapps. fimap should be something like sqlmap just for LFI/RFI bugs instead of sql injection.

FunkLoad

February 18, 2014portsStress Testing, Web Applicationsstresstesting, webapps

FunkLoad is a functional and load web tester, written in Python.

GoLismero

February 18, 2014portsInformation Gatheringinfogathering, recon, webapps

GoLismero is an open source framework for security testing. It’s currently geared towards web security, but it can easily be expanded to other kinds of scans.

Tag: webapps