Binging is a simple tool to query Bing search engine. It will use your Bing API key and fetch multiple results. This particular tool can be used for cross domain footprinting for Web 2.0 applications, site discovery, reverse lookup, host enumeration etc. One can use various different directives like site, ip etc. and run queries against the engine. On top of it tool provides filtering capabilities so you can ask for unique URLs or hosts. It is also possible to filter results by applying power of regular expression. Get your Bing API key and use this tool for your audit, assessment and research.
AppPrint - Web, Application Server and Web 2.0 Fingerprinting tool (Beta)
AppPrint scans IP range, IP or host for Web and Application servers. It scans port 80 for a particular target and tries to deduce the banner using httprint methodology. This gives best guessed banner for Web Server. In next step it uses method of forced plug-in invoke and scan for application server type. At this point it tries to fingerprint Tomcat, WebLogic, WebSphere, Orion, ColdFusion and Resin. It also fingerprints Web 2.0 libraries and components. It requires .NET framework installed. In future version we will build several other technology mapping and fingerprinting technologies like Flash, Laszlo etc. Also, planning to add WAF fingerprinting module.
Web2Fuzz - AppSec Labs Tool....
This tool is coded by our research and consulting team to test Web 2.0 applications. It is simple utility to check vulnerabilities while doing pen-testing and assessment. It is effective to use with Web2Proxy.
Here is tool detail..
Web2Fuzz (Beta)
Web 2.0 Application Auto Fuzzing tool
This tool helps in fuzzing next generation application running on Web/enterprise 2.0 platform. It can be used with Web2Proxy by harvesting JSON, XML, JS-Object etc. from already profiled HTTP requests. Adding various fuzz loads and injecting them into particular request. One can encode fuzz load in various forms to pollute/poison Web 2.0 streams. It is possible to analyze responses by using various techniques like response behavior, stream structure or patterns. Tool contains sample payload and pdf/slides can help you in giving better understanding of its behavior.
Here is tool detail..
Web2Fuzz (Beta)
Web 2.0 Application Auto Fuzzing tool
This tool helps in fuzzing next generation application running on Web/enterprise 2.0 platform. It can be used with Web2Proxy by harvesting JSON, XML, JS-Object etc. from already profiled HTTP requests. Adding various fuzz loads and injecting them into particular request. One can encode fuzz load in various forms to pollute/poison Web 2.0 streams. It is possible to analyze responses by using various techniques like response behavior, stream structure or patterns. Tool contains sample payload and pdf/slides can help you in giving better understanding of its behavior.
Web Hacking Training at Syscan
We are conducting 2 days hands-on training at Syscan 09. This event is going to be in Singapore starting from 30th June.
Training detail over here...
Training detail over here...
OWASP Event at Poland
Blueinfy is having training for a day at OWASP
Detail on training
There is a talk on Web 2.0 Exploits as well. Agneda
Web 2.0 Hacking – Attacks & Countermeasures, by Shreeraj Shah, Blueinfy
Introduction and adaptation of new technologies like Ajax, Rich Internet Applications and Web Services has changed the dimension of Application Hacking. We are witnessing new ways of hacking web based applications and it needs better understanding of technologies to secure applications. The only constant in this space is change. In this dynamically changing scenario in the era of Web 2.0 it is important to understand new threats that emerge in order to build constructive strategies to protect corporate application assets. Application layers are evolving and lot of client side attack vectors are on the rise like Ajax based XSS, CSRF, Widget injections, RSS exploits, Mashup manipulations and client side logic exploitations. At the same time various new attack vectors are evolving around SOA by attacking SOAP, XML-RPC and REST. It is time to understand these advanced attack vectors and defense strategies.Detail on training
There is a talk on Web 2.0 Exploits as well. Agneda
Web2Proxy (Beta) - Web 2.0 Application Proxy, Profiling and Fuzzing tool
This tool helps in assessing next generation application running on Web/enterprise 2.0 platform. It profiles HTTP requests and responses at runtime by configuring it as proxy. It identifies structures like JSON, XML, XML-RPC etc. along with key HTTP parameters like cookie, login forms, hidden values etc. Based on profile one can take decision to trap and fuzz requests to identify potential vulnerabilities. This tool needs .NET framework and tested on Windows platform. We are adding several new features to upcoming edition.
Blueinfy's tool page
Demo page for tool
Blueinfy's tool page
Demo page for tool
Next class in Singapore...
We are having a class in Singapore on 12th April.
Here is the detail on it.
Looking forward to meet few folks.
Here is the detail on it.
Looking forward to meet few folks.
Subscribe to:
Posts (Atom)