Webapps | Penetration Testing Tools

Grabber

February 18, 2014portsWeb Applicationshttp, https, vulnanalysis, webapps

Grabber is a web application scanner. Basically it detects some kind of vulnerabilities in your website. Grabber is simple, not fast but portable and really adaptable.

jboss-autopwn

February 18, 2014portsExploitation Tools, Web Applicationsexploitation, webapps

This JBoss script deploys a JSP shell on the target JBoss AS server. Once deployed, the script uses its upload and command execution capability to provide an interactive session.

joomscan

February 18, 2014portsWeb Applicationshttp, https, vulnanalysis, webapps

Joomla! is probably the most widely-used CMS out there due to its flexibility, user-friendlinesss, extensibility to name a few. So, watching its vulnerabilities and adding such vulnerabilities as KB to Joomla scanner takes ongoing activity.

jSQL

February 18, 2014portsVulnerability Analysis, Web Applicationsgui, http, https, vulnanalysis, webapps

jSQL Injection is a lightweight application used to find database information from a distant server. jSQL is free, open source and cross-platform (Windows, Linux, Mac OS X, Solaris).

lbd

February 18, 2014portsInformation Gatheringinfogathering, recon, webapps

lbd (load balancing detector) detects if a given domain uses DNS and/or HTTP Load-Balancing (via Server: and Date: header and diffs between server answers).

Maltego Teeth

February 18, 2014portsExploitation Tools, Information Gathering, Password Attacks, Web Applicationsexploitation, gui, portscanning, webapps

Maltego is a unique platform developed to deliver a clear threat picture to the environment that an organization owns and operates. Maltego’s unique advantage is to demonstrate the complexity and severity of single points of failure as well as trust relationships that exist currently within the scope of your infrastructure.

PadBuster

February 18, 2014portsWeb Applicationsvulnanalysis, webapps

PadBuster is a Perl script for automating Padding Oracle Attacks. PadBuster provides the capability to decrypt arbitrary ciphertext, encrypt arbitrary plaintext, and perform automated response analysis to determine whether a request is vulnerable to padding oracle attacks.

Paros

February 18, 2014portsWeb Applicationsgui, http, https, infogathering, proxy, sniffing, webapps

A Java based HTTP/HTTPS proxy for assessing web application vulnerability. It supports editing/viewing HTTP messages on-the-fly. Other featuers include spiders, client certificate, proxy-chaining, intelligent scanning for XSS and SQL injections etc.

plecost

February 18, 2014portsWeb Applicationsenumeration, http, https, vulnanalysis, webapps

Wordpress finger printer tool, plecost search and retrieve information about the plugins versions installed in Wordpress systems. It can analyze a single URL or perform an analysis based on the results indexed by Google. Additionally displays CVE code associated with each plugin.

Powerfuzzer

February 18, 2014portsVulnerability Analysis, Web Applicationsfuzzing, gui, http, vulnanalysis, webapps

Powerfuzzer is a highly automated and fully customizable web fuzzer (HTTP protocol based application fuzzer) based on many other Open Source fuzzers available and information gathered from numerous security resources and websites. It was designed to be user friendly, modern, effective and working.

Tag: webapps