PenTestIT http://pentestit.com Your source for Information Security Related information! Wed, 08 Sep 2010 08:08:27 +0000 en hourly 1 http://wordpress.org/?v=3.0.1 28.510832277.0733619PenTestIThttp://feedburner.google.comFirefox Portable WEBTOOLS for Web Application Securityhttp://feedproxy.google.com/~r/PenTestIT/~3/qHhHn7HjtZw/ http://pentestit.com/2010/09/08/firefox-portable-webtools-web-application-security/#comments Wed, 08 Sep 2010 06:16:10 +0000 Black http://pentestit.com/?p=5604

If you are aware of the PenTestIT.Com’s WAPT FireFox Add-ons, this collection might ring a bell in your security inclined mind. This is a portable version of Mozilla Firefox with several addons that are useful for Web Application Security. The purpose of this package is to have the best available addons to manually test XSS, SQL, siXSS, CSRF, Trace XSS, RFI, LFI, etc.

c99d5246a8416bdcb4fc599f1e2b91bb Firefox Portable WEBTOOLS for Web Application Security

We have tested it on Windows XP SP2 and SP3 and found it very useful. But, with more manual intervention for reporting and other fine tuning of tools, this could be an awesome collection!

Download Firefox Portable WEBTOOLS here

If you enjoyed this article, you might also like:


]]> http://pentestit.com/2010/09/08/firefox-portable-webtools-web-application-security/feed/ 0 http://pentestit.com/2010/09/08/firefox-portable-webtools-web-application-security/ UPDATE: DLLHijackAuditor v2!http://feedproxy.google.com/~r/PenTestIT/~3/Pjbm_Dw9TIY/ http://pentestit.com/2010/09/08/update-dllhijackauditor-v2/#comments Wed, 08 Sep 2010 04:55:57 +0000 Black http://pentestit.com/?p=5601

Our first post regarding the DLLHijackAuditor can be found here. Now, the author has released an update – DLLHijackAuditor version 2!

“DllHijackAuditor is a smart tool to Audit against the Dll Hijacking Vulnerability in any Windows application. This is recently discovered critical security issue affecting almost all Windows systems on the planet. It appears that large amount of Windows applications are currently susceptible to this vulnerability which can allow any attacker to completely take over the system.”

This is the official changelog:

  • Smart Debugger based ‘Interception Engine’ for consistent and efficient performance without intrusion.
  • Support for specifying as well as auditing of application with custom & multiple Extensions.
  • Timeout Configuration to alter the waiting time for each Application.

Download DllHijackAuditor v2.0 here

If you enjoyed this article, you might also like:


]]> http://pentestit.com/2010/09/08/update-dllhijackauditor-v2/feed/ 0 http://pentestit.com/2010/09/08/update-dllhijackauditor-v2/ UPDATE: Hyenae_0.35-2!http://feedproxy.google.com/~r/PenTestIT/~3/K3EBa07YHY4/ http://pentestit.com/2010/09/06/update-hyenae0352/#comments Mon, 06 Sep 2010 12:17:45 +0000 Black http://pentestit.com/?p=5592

You can find our first post about Hyenae, which was written here. Now, the authors have released an updated Hyenae version 0.35-2.

“Hyenae is a highly flexible platform independent network packet generator. It allows you to reproduce several MITM, DoS and DDoS attack scenarios, comes with a clusterable remote daemon and an interactive attack assistant.“

Bugs were fixed in the updated version. Also, the documentation was updated. The command line usage information was extended and a memory leak patch was applied.

Download Hyenae v0.35-2 here.

If you enjoyed this article, you might also like:


]]> http://pentestit.com/2010/09/06/update-hyenae0352/feed/ 0 http://pentestit.com/2010/09/06/update-hyenae0352/ UPDATE: Artemisa v1.0.88!http://feedproxy.google.com/~r/PenTestIT/~3/achXTtyZcmw/ http://pentestit.com/2010/09/06/update-artemisa-v1088/#comments Mon, 06 Sep 2010 08:46:31 +0000 Black http://pentestit.com/?p=5578

We first wrote about Artemisa in our post here. Now, Artemisa version 1.0.88 has been released!

Artemisa

Artemisa

“Artemisa is a VoIP/SIP-specific honeypot software designed to connect to a VoIP enterprise domain as a user-agent back-end in order to detect malicious activity at an early stage. It registers multiple SIP accounts, which do not represent real human subscribers, at one or more VoIP service providers, and wait for incomming attacks. Besides, Artemisa can play a role in the real-time adjustment of the security policies of the enterprise domain where it is deployed (e.g. setting rules in a firewall to ban IPs or in the VoIP PBX to ban caller-IDs).“

Download Artemisa v1.0.88 here

If you enjoyed this article, you might also like:


]]> http://pentestit.com/2010/09/06/update-artemisa-v1088/feed/ 0 http://pentestit.com/2010/09/06/update-artemisa-v1088/ ZAProxy: A Web Application Penetration Testing Tool Developers!http://feedproxy.google.com/~r/PenTestIT/~3/dNG9ATE_OUc/ http://pentestit.com/2010/09/06/zaproxy-tool-web-application-penetration-testing-tool/#comments Mon, 06 Sep 2010 06:57:23 +0000 Black http://pentestit.com/?p=5580

If you remember about Andiparos, you might remember that it was a fork of the famous Paros Proxy. Now, another fork of the open source Paros Proxy has been released. It’s name – ZAP – Zed Attack Proxy.

The Zed Attack Proxy (ZAP) is a penetration test tool designed to be used to make web applications more secure. While ZAP can detect some security issues automatically, it is primarily designed to help you find security vulnerabilities manually.

Unlike some security tools it is designed to be used by people with a wide range of security experience.
As such it is suitable for developers and functional testers who a new to penetration testing. You will still need to have a good understanding of how web applications work.

ZAProxy

Some of ZAP’s features:
- Intercepting proxy
- Automated scanner
- Passive scanner
- Spider

Some of ZAP’s characteristics:
- Easy to install (just requires java 1.6)
- Ease of use a priority
- Comprehensive help pages
- Under active development
- Open source
- Free (no paid for ‘Pro’ version)
- Cross platform

Operating system supported:
Windows XP SP2 and above 32-bit

As per the developer of tool it is cross platform, we did not got chance to test it on *nix systems will keep you posted on that.

We are running this tool and find it good result oriented.

Download ZAProxy version 1.0.0 here

Searches leading to this post:
zaproxy

If you enjoyed this article, you might also like:

  • June 25, 2010 -- Andiparos: A Paros Proxy Fork!
    We all love Paros Proxy! But, for some or the other reason, we always wished that Paros Proxy had a ...
  • August 20, 2010 -- UPDATE: XSSer v0.7a!
    All of you web application penetration testers, check out this release of XSSer version 0.7a, for i...
  • August 16, 2010 -- UPDATE: Websecurify 0.7!
    Good news for Websecurify lovers, as we have an updated Websecurify version 0.7 amongst us finally! ...
  • August 9, 2010 -- UPDATE: Websecurify 0.7RC2!
    Right on time this time! We have an updated Websecurify version 0.7RC2 amongst us now!“Websecu...
  • August 3, 2010 -- UPDATE: Websecurify 0.7RC1!
    Also, pretty late with this one (almost 6 days!), but here it is - we have an updated Websecurify ve...
  • July 2, 2010 -- UPDATE: XSSer v0.6a!
    All of you web application penetration testers, check out this release of XSSer version 0.6a, for i...
  • June 25, 2010 -- UPDATE: Websecurify 0.6!
    Websecurify has been updated to Websecurify 0.6 about 12 hours ago!“Websecurify is a web and w...
  • May 31, 2010 -- UPDATE: Websecurify 0.6RC1!
    Websecurify has recently been updated! It's current version is Websecurify 0.6RC1!"Websecurify...
  • April 19, 2010 -- UPDATE: XSSer v0.5a!
    All of you web application penetration testers, check out this release of XSSer version 0.5a!“C...


]]> http://pentestit.com/2010/09/06/zaproxy-tool-web-application-penetration-testing-tool/feed/ 2 http://pentestit.com/2010/09/06/zaproxy-tool-web-application-penetration-testing-tool/ UPDATE: Nikto v2.1.3!http://feedproxy.google.com/~r/PenTestIT/~3/z89IW2s2izs/ http://pentestit.com/2010/09/06/update-nikto-v213/#comments Mon, 06 Sep 2010 04:42:46 +0000 Black http://pentestit.com/?p=5575

We have discussed about Nikto in detail here. Now, in less that two months, a new version – Nikto v2.1.3 – has been released!

“NiktoNikto is an Open Source web server scanner which performs comprehensive tests against web servers for multiple items, including over 6100 potentially dangerous files/CGIs, checks for outdated versions of over 950 servers, and version specific problems on over 260 servers. It also checks for server configuration items such as the presence of multiple index files, HTTP server options, and will attempt to identify installed web servers and software. Scan items and plugins are frequently updated and can be automatically updated.”

This is the changelog for Nikto version 2.1.3:

  • Interactive scan pause feature
  • Metasploit logging (courtesy Ryan Linn)
  • Updated manual
  • Command line proxy specification
  • Scan status reports guesstimate of time remaining
  • Many updated software versions

So now, you can enable use Nikto with your favourite Metasploit.

Download Nikto version 2.1.3 here

If you enjoyed this article, you might also like:


]]> http://pentestit.com/2010/09/06/update-nikto-v213/feed/ 0 http://pentestit.com/2010/09/06/update-nikto-v213/ Blind Cat: A Blind SQL Injection Exploitation Tool!http://feedproxy.google.com/~r/PenTestIT/~3/2ZbrLfuYgnE/ http://pentestit.com/2010/09/04/blind-cat-blind-sql-injection-exploitation-tool/#comments Sat, 04 Sep 2010 15:09:42 +0000 Black http://pentestit.com/?p=5569

There are some and then there are some more! What we meant to say is that there are some blind SQL injection tools and then there are some more. This tool is a result of the author wanting to program a tool with a different approach to blind SQL injection. Before we actually get to the tool, lets see what blind SQL injection is. I know we must have described this a lot of time, but doing so will save us sometime going back to the first post that tells you about blind SQL injection.

So, blind SQL injection is identical to normal SQL Injection except that when an attacker attempts to exploit an application, rather then getting a useful error message, they get a generic page (or sometimes are redirected to some page) specified by the developer instead. This makes exploiting a potential SQL Injection attack more difficult but not impossible. Now that we know what blind SQL injection is, it will be a bit easier for use to see what this tool can do.

Blind Cat

Blind Cat

Back to this tool now – Blind Cat is not a fully automated tool, the ones we call – “one click ownage“. You are the driving force behind this tool. Once, you understand how this tool works, you will be able to exploit a lot more difficult SQL injections easily. Consider this tool as an automation tool/front-end for manual blind SQL injections. It helps you to send custom HTTP requests, get the response, modify the request, re-send, get the response again and compare and slowly exploit! This front-end has been programmed in Delphi and uses cURL to get its work done. This is how a typical Blind Cat interface looks like:

Blind CatThis tool supports almost all databases – MS SQL, MySQL, Oracle, DB2, Firebird, etc., while supporting both – HTTP and HTTPS! In addition to that, it can transmit custom HTTP requests.

In other words, Blind Cat runs multiple instances of CURL, to send parametrized HTTP requests to the vulnerable web application. The responses are analyzed and other requests with modified parameters are issued until the correct characters in SQL response are detected.

Before you actually run Blind Cat, there are two important files that you might want to edit. These are curl.config and BlindCat.ini. curl.config being most important of the two, holds your custom header information that could be used to simulate the web browser, the target URL, whether you would want to use a proxy or not, HTTP GET/POST parameters, etc. BlindCat.ini holds information such as the number of threads to run, the location of cURL on your computer, the keyword to be exploited, etc.

The author has not added a readme file as such that might help you know more about the program, but with a bit of trial and error, you sure will be able to get this little demon to work!

Download Blind Cat v0.0.1.0 here.

Searches leading to this post:
Blind Cat sql injection, Blind Cat v0 0 1 0, blind sql injection tol, blindcat, blindcat sql, dave aitel, oracle blind sql injection, pentestit 2010 blind cat sql injection exploitation tool

If you enjoyed this article, you might also like:


]]> http://pentestit.com/2010/09/04/blind-cat-blind-sql-injection-exploitation-tool/feed/ 0 http://pentestit.com/2010/09/04/blind-cat-blind-sql-injection-exploitation-tool/ DotDotPwn: A Tool for Directory Traversal Checking and Scanning!http://feedproxy.google.com/~r/PenTestIT/~3/mTtdP77JUis/ http://pentestit.com/2010/09/03/dotdotpwn-tool-directory-traversal-checkerscanning/#comments Fri, 03 Sep 2010 05:54:20 +0000 Black http://pentestit.com/?p=5558

DotDotPwn is a simple PERL tool which detects several Directory Traversal Vulnerabilities on HTTP/FTP Servers. This AttackDB version currently has 871 traversal payloads. This tool was tested against various Kolibri+ WebServer v2.0 and Gefest WebServer v1.0 (HTTP servers) giving good results identifying the right vulnerability strings. Those HTTP servers were vulnerable, and somebody reported those vulns on sites such as exploit-db, but those advisories just reported some (1 or 2) traversal strings with a difference with DotDotPwn which detected between 10 or 20 different attack strings on those vulnerable servers.

2ad1b0f28a7a777993b9d9d565137001 DotDotPwn: A Tool for Directory Traversal Checking and Scanning!

Features of DotDotPwn:

  • Detects Directory traversal vulnerabilities on remote HTTP/FTP server systems.
  • DotDotPwn checks the presence of boot.ini on the vulnerable systems through Directory traversal vulnerabilities, so it is assumed that the tested systems are Windows based HTTP/FTP servers.
  • Currently, the traversal database holds 871 attack payloads. Use the -update flag to perform an online fresh update.

Sample usage:

  • HTTP:
    • perl ddpwn.pl -http website.com
  • FTP:
    • perl ddpwn.pl -ftp ftphost.com

DotDotPwn is a very useful tool for web application penetration testers, who believe in open-source software. As it is PERL based, we can modify it as per the required environment. Hope there will be a nice front end which surely will make this tool more popular! It is also very easy to update the directory traversal database of this tool!

Requirements:
Perl with support of HTTP::Lite and Net::FTP modules

Download DotDotPwn v1.0 here

Searches leading to this post:
dotdotpwn

If you enjoyed this article, you might also like:


]]> http://pentestit.com/2010/09/03/dotdotpwn-tool-directory-traversal-checkerscanning/feed/ 0 http://pentestit.com/2010/09/03/dotdotpwn-tool-directory-traversal-checkerscanning/ UPDATE: Microsoft Enhanced Mitigation Evaluation Toolkit v2!http://feedproxy.google.com/~r/PenTestIT/~3/XIdKl6OnqfE/ http://pentestit.com/2010/09/02/update-microsoft-enhanced-mitigation-evaluation-toolkit-v2/#comments Thu, 02 Sep 2010 17:34:14 +0000 Black http://pentestit.com/?p=5553

Nice! Our first post regarding the Microsoft Enhanced Mitigation Evaluation Toolkit or EMET can be found here. Now, Microsoft has released the EMET v2!

“EMET provides users with the ability to deploy security mitigation technologies to arbitrary applications.  This helps prevent vulnerabilities in those applications (especially line of business and 3rd party apps) from successfully being exploited.  By deploying these mitigation technologies on legacy products, the tool can also help customers manage risk while they are in the process of transitioning over to modern, more secure products.  In addition, it makes it easy for customers to test mitigations against any software and provide feedback on their experience to the vendor.“

This version sports a brand new GUI. In addition to SEHOP (Structured Error Handling Overwrite Protection), Dynamic DEP (Dynamic Data Execution Prevention), NULL page allocation, Heap Spray Allocation, this tool adds support for Export Address Table Access Filtering and the Mandatory Address Space Layout Randomization (ASLR)!

Download the EMET v2 here.

Searches leading to this post:
How to deploy Microsoft EMET

If you enjoyed this article, you might also like:


]]> http://pentestit.com/2010/09/02/update-microsoft-enhanced-mitigation-evaluation-toolkit-v2/feed/ 0 http://pentestit.com/2010/09/02/update-microsoft-enhanced-mitigation-evaluation-toolkit-v2/ UPDATE: ProcNetMonitor v2.7!http://feedproxy.google.com/~r/PenTestIT/~3/MzMALOLD34k/ http://pentestit.com/2010/09/02/update-procnetmonitor-v27/#comments Thu, 02 Sep 2010 16:47:22 +0000 Black http://pentestit.com/?p=5549

Whoa! It sure has been a long time since we updated information about ProcNetMonitor. We had mentioned about it in our first post here. Now, the author has released an update – ProcNetMonitor version 2.7.

“ProcNetMonitor is the free tool to monitor the network activity of all running process in the system. It displays all open network ports (TCP/UDP) and active network connections for each process. It has advanced color based auto analysis system to make it easy to distinguish network oriented processes from others with just one glance at the list.“

Since we last wrote about it, this tool can now display process information on 64 bit systems too. False positives from Antivirus have also been removed and support for Windows 7 with GUI related enhancements.

Download ProcNetMonitor v2.7 here

If you enjoyed this article, you might also like:


]]> http://pentestit.com/2010/09/02/update-procnetmonitor-v27/feed/ 0 http://pentestit.com/2010/09/02/update-procnetmonitor-v27/