{"id":390,"date":"2020-04-11T14:32:11","date_gmt":"2020-04-11T14:32:11","guid":{"rendered":"https:\/\/temp.ashkerala.com\/?p=390"},"modified":"2020-04-11T14:32:11","modified_gmt":"2020-04-11T14:32:11","slug":"tools-vulnerability-assessment-and-penetration-testing","status":"publish","type":"post","link":"https:\/\/temp.ashkerala.com\/?p=390","title":{"rendered":"Tools Vulnerability Assessment And Penetration Testing"},"content":{"rendered":"

Acunetix Web Vulnerability Scanner<\/strong><\/p>\n

Features:<\/strong><\/em><\/p>\n

1. AcuSensor Technology
2. An automatic client script analyzer allowing for security testing of Ajax and Web 2.0 applications.
3. Industries’ most advanced and in-depth SQL injection and Cross site scripting testing.
4. Advanced penetration testing tools, such as the HTTP Editor and the HTTP Fuzzer.
5. Visual macro recorder makes testing web forms and password protected areas easy
6. Support for pages with CAPTHCA, single sign-on and Two Factor authentication mechanisms.
7. Extensive reporting facilities including VISA PCI compliance reports.
8.Multi-threaded and lightning fast scanner crawls hundreds of thousands of pages with ease.
9. Intelligent crawler detects web server type and application language.
11. Acunetix crawls and analyzes websites including flash content, SOAP and AJAX.
12. Port scans a web server and runs security checks against network services running on the server.<\/p>\n

Burp Suite Free Edition v1.4 \u0393\u00c7\u00f4Web Application Security Testing Tool<\/strong><\/p>\n

Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application\u0393\u00c7\u00d6s attack surface, through to finding and exploiting security vulnerabilities.
Burp gives you full control, letting you combine advanced manual techniques with state-of-the-art automation, to make your work faster, more effective, and more fun.<\/p>\n

ZAProxy v1.3.0 \u0393\u00c7\u00f4 Integrated Penetration Testing Tool<\/strong><\/p>\n

ZAP is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing.
ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually.<\/p>\n

Main Features<\/em><\/p>\n

Intercepting Proxy, Automated scanner,\u00a0 Passive scanner, Brute Force, scanner, Spider, Fuzzer, Port scanner, Dynamic SSL certificates, API, Beanshell integration.<\/p>\n

FIMAP<\/strong><\/p>\n

FIMAP is a Local and Remote file inclusion auditing Tool (LFI\/RFI).
Fimap is a little python tool which can find, prepare, audit, exploit and even google automatically for local and remote file inclusion bugs in webapps. fimap should be something like sqlmap just for LFI\/RFI bugs instead of sql injection.<\/p>\n

Web Application Attack and Audit Framework<\/strong><\/p>\n

W3af is an extremely popular, powerful, and flexible framework for finding and exploiting web application vulnerabilities. It is easy to use and extend and features dozens of web assessment and exploitation plugins
\u00a0
New Features:<\/strong>
-Considerably increased performance by implementing gzip encoding
-Enhanced embedded bug report system using Trac’s XMLRPC
-Fixed hundreds of bugs * Fixed critical bug in auto-update feature
-Enhanced integration with other tools (bug fixed and added more info to the file)<\/p>\n

WebSploit Toolkit V 1.6<\/strong><\/p>\n

WebSploit Is An Open Source Project For Scan And Analysis Remote System From Vulnerability
Description :
Autopwn – Used From Metasploit For Scan and Exploit Target Service
wmap – Scan,Crawler Target Used From Metasploit wmap plugin
format infector – inject reverse & bind payload into file format
phpmyadmin – Search Target phpmyadmin login page
lfi – Scan,Bypass local file inclusion Vulnerability & can be bypass some WAF
apache users – search server username directory (if use from apache webserver)
Dir Bruter – brute target directory with wordlist
admin finder – search admin & login page of target
MLITM Attack – Man Left In The Middle, XSS Phishing Attacks
MITM – Man In The Middle Attack
Java Applet Attack – Java Signed Applet Attack
MFOD Attack Vector – Middle Finger Of Doom Attack Vector
USB Infection Attack – Create Executable Backdoor For Infect USB For Windows<\/p>\n

Penetration Testing Oriented Browser – Sandcat Browser<\/strong><\/p>\n

Sandcat Browser is a freeware portable pen-test oriented multi-tabbed web browser with extensions support developed by the Syhunt team,
Features<\/p>\n

Live HTTP Headers, Request Editor extension,
Fuzzer extension with multiple modes and support for filters,
JavaScript Executor extension which allows you to load and run external\u00a0\u00a0\u00a0\u00a0\u00a0 JavaScript files,
Lua Executor extension — allows you to load and run external Lua scripts
Syhunt Gelo, HTTP Brute Force, CGI Scanner scripts and more.<\/p>\n

PHP Vulnerability Hunter v.1.1.4.6 – Automated fuzz testing tool<\/strong><\/p>\n

This is the application that detected almost all of the web application vulnerabilities listed on the advisories page. PHP Vulnerability Hunter is an advanced automated whitebox fuzz testing tool capable of triggering a wide range of exploitable faults in PHP web applications. Minimal configuration is necessary to begin a scan; PHP Vulnerability Hunter doesn\u0393\u00c7\u00d6t even need a user specified starting URI.
\u00a0 \u00a0
Updated GUI validation
Several instrumentation fixes
Fixed lingering connection issue
Fixed GUI and report viewer crashes related to working directory<\/p>\n

INSECT Pro 2.7 – Ultimate is here! This penetration security auditing and testing software solutionis designed to allow organizations of all sizes mitigate, monitor and manage the latest security threats vulnerabilities and implement active security policies by performing penetration tests across their infrastructure and applications. This is a partial list of the major changes implanted in version 2.7<\/p>\n

– Available targets now has a sub menu under right-click button
– Check update function added in order to verify current version
– Threading support for GET request
– Module log added and functional
– Sniffer support added
– 50 Remote exploits added
– Project saved on user land – Application Data special folder
– Executed module windows added and functionality for it
– Agent Connect now use telnet lib<\/p>\n

OWASP Zed Attack Proxy (ZAP) v.1.3.2 Released<\/strong><\/p>\n

The OWASP Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications.It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing as well as being a useful addition to an experienced pen testers toolbox.
Some of ZAP ‘s features:<\/p>\n

Intercepting Proxy
Automated scanner
Passive scanner
Brute Force scanner
Spider
Fuzzer
Port scanner
Dynamic SSL certificates
API
Beanshell integration<\/p>\n

Uniscan 4.0 vulnerability scanner Released<\/strong><\/p>\n

The Uniscan vulnerability scanner is aimed at information security, which aims at
finding vulnerabilities in Web systems and is licensed under the GNU GENERAL
PUBLIC LICENSE 3.0 (GPL 3). The Uniscan was developed using the Perl
programming language to be easier to work with text, has an easy to use regular expressions and is also multi-threaded.<\/p>\n

Uniscan Features<\/strong><\/p>\n

\u00a0\u00a0\u00a0 Identification of system pages through a Web Crawler.
\u00a0\u00a0\u00a0 Use of threads in the crawler.
\u00a0\u00a0\u00a0 Control the maximum number of requests the crawler.
\u00a0\u00a0\u00a0 Control of variation of system pages identified by Web Crawler.
\u00a0\u00a0\u00a0 Control of file extensions that are ignored.
\u00a0\u00a0\u00a0 Test of pages found via the GET method.
\u00a0\u00a0\u00a0 Test the forms found via the POST method.
\u00a0\u00a0\u00a0 Support for SSL requests (HTTPS).
\u00a0\u00a0\u00a0 Proxy support.<\/p>\n

IBM Rational AppScan<\/strong><\/p>\n

IBM Rational AppScan is a family of web security testing and monitoring tools from the Rational Software division of IBM. AppScan is intended to test Web applications for security vulnerabilities during the development process, when it is least expensive to fix such problems. The product learns the behavior of each application, whether an off-the-shelf application or internally developed, and develops a program intended to test all of its functions for both common and application-specific vulnerabilities.<\/p>\n

Editions<\/p>\n

AppScan Standard Edition – Desktop software for automated Web application security testing environment for IT Security, auditors, and penetration testers<\/p>\n

AppScan Tester Edition – An edition that integrates with IBM Rational Quality Manager to form a security testing QA environment<\/p>\n

AppScan Build Edition – A version that embeds web application security testing into the build management workflow<\/p>\n

AppScan Enterprise Edition – Client-server version used to scale security testing.<\/p>\n

AppScan OnDemand – Identifies and prioritizes Web Application Security vulnerabilities via SaaS Model<\/p>\n

AppScan OnDemand Production Site Monitoring – Monitors production Web content and sites for security vulnerabilities via SaaS Model<\/p>\n

AppScan Source Edition – Prevent data breaches by locating security flaws in the source code<\/p>\n

AppScan Reporting Console – Reporting add-on<\/p>\n

Paros – for web application security assessment \u00a0\u00a0 \u00a0<\/strong><\/p>\n

We wrote a program called “Paros” for people who need to evaluate the security of their web applications. It is free of charge and completely written in Java. Through Paros’s proxy nature, all HTTP and HTTPS data between server and client, including cookies and form fields, can be intercepted and modified.<\/p>\n

We hope you can benefit from our work and products.<\/p>\n

If you want to support our project or obtain formal support from us, please check out the product MileSCAN ParosPro, which is further developed by our core team member and supported by us as well.<\/p>\n","protected":false},"excerpt":{"rendered":"

Acunetix Web Vulnerability Scanner Features: 1. AcuSensor Technology 2. An automatic client script analyzer allowing for security testing of Ajax and Web 2.0 applications. 3. Industries’ most advanced and in-depth SQL injection and Cross site scripting testing. 4. Advanced penetration testing tools, such as the HTTP Editor and the HTTP Fuzzer. 5. Visual macro recorder…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"footnotes":""},"categories":[34],"tags":[],"class_list":["post-390","post","type-post","status-publish","format-standard","hentry","category-it-security"],"_links":{"self":[{"href":"https:\/\/temp.ashkerala.com\/index.php?rest_route=\/wp\/v2\/posts\/390","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/temp.ashkerala.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/temp.ashkerala.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/temp.ashkerala.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/temp.ashkerala.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=390"}],"version-history":[{"count":0,"href":"https:\/\/temp.ashkerala.com\/index.php?rest_route=\/wp\/v2\/posts\/390\/revisions"}],"wp:attachment":[{"href":"https:\/\/temp.ashkerala.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=390"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/temp.ashkerala.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=390"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/temp.ashkerala.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=390"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}