Tools (17th Sept)

A weekly update on new and updated Information Security tools that I have come across or use. The tools are mainly those for PenTesting although other tools are sometimes included. As a bit of background into how I find these tools, I keep a close watch on twitter and other websites to find updates or new releases, I also search for pen testing and security projects on Source Forge. Some of the best sites I have found for details of new tools and releases are http://www.toolswatch.org/, http://tools.hackerjournals.com/

Nikto 2.1.5
http://cirt.net/node/89
Nikto is an open source web server scanner which performs comprehensive tests against web servers for multiple items, including over 6500 potentially dangerous files/CGIs, checks for outdated versions of over 1200 servers, and version specific problems on over 270 servers.

Prenus

https://github.com/AsteriskLabs/prenusThis is a quickly hacked together Ruby script that can consume version 2 nessus files (with the help of an udpated ruby-nessus gem) and allows the output of a few different formats, including:

• Static HTML files with jQuery Datatables and Highcharts graphs
• XLS file (Actually a HTML Table with an .xls extension) with unique Nessus vulns and associated IPs
• Afterglow (afterglow.sourceforge.net/), 2 column CSV files
• Circos (circos.ca) tableviewer text file
• Hosts information, formatted in a 3 column CSV output

Multillidae
http://sourceforge.net/projects/mutillidae/
NOWASP (Mutillidae) is a free, open source web application provided to allow security enthusiest to pen-test a web application. NOWASP (Mutillidae) can be installed on Linux, Windows XP, and Windows 7 using XAMMP making it easy for users who do not want to administrate a webserver. It is already installed on Samurai WTF and Rapid7 Metasploitable-2.

teenage-mutant-ninja-turtles

http://code.google.com/p/teenage-mutant-ninja-turtles/

This project is fork of fuzzdb project and is about Obfuscating fuzzdb Web Application payloads

The Teenage Mutant Ninja Turtles project is four things:

1. A Web Application payload database (heavily based on fuzzdb project for now)
2. A Web Application error database (e.g. contain error messages that might return while fuzzing).
3. A Web Application payload mutator.
4. A Web Application payload manager (e.g. does database clean up).