to talk about useful tools for pen testers. In the new article, we will review tools for analyzing the security of web applications.
Our colleague did a similar about seven years ago. It's interesting to see which tools have maintained and strengthened their positions, and which have fallen by the wayside and are now rarely used.
It's worth noting that Burp Suite also falls under this category, but there will be a separate publication about it and its useful plugins.
Contents:
Amass
β a Go tool for finding and enumerating DNS subdomains and mapping external networks. Amass is an OWASP project created to show how organizations appear to an outside observer on the Internet. Amass gathers subdomain names in various ways, using both recursive subdomain enumeration and searches of open sources.
To discover interconnected network segments and autonomous system numbers, Amass uses IP addresses obtained during operation. All found information is used to build a network map.
Pros:
- Information gathering techniques include:
* DNS β subdomain enumeration using a dictionary, brute-forcing subdomains, 'smart' enumeration using mutations based on found subdomains, reverse DNS queries, and searching for DNS servers where a zone transfer request (AXFR) might be made;* Open source searching β Ask, Baidu, Bing, CommonCrawl, DNSDB, DNSDumpster, DNSTable, Dogpile, Exalead, FindSubdomains, Google, IPv4Info, Netcraft, PTRArchive, Riddler, SiteDossier, ThreatCrowd, VirusTotal, Yahoo;
* Searching through TLS certificate databases β Censys, CertDB, CertSpotter, Crtsh, Entrust;
* Using search engine APIs β BinaryEdge, BufferOver, CIRCL, HackerTarget, PassiveTotal, Robtex, SecurityTrails, Shodan, Twitter, Umbrella, URLScan;
* Searching through Internet web archives: ArchiveIt, ArchiveToday, Arquivo, LoCArchive, OpenUKArchive, UKGovArchive, Wayback;
- Integration with Maltego;
- Provides the most comprehensive coverage for the task of finding DNS subdomains.
Cons:
- Be careful with amass.netdomains β it will attempt to reach every IP address in the identified infrastructure and retrieve domain names from reverse DNS queries and TLS certificates. This is a 'loud' technique; it may expose your reconnaissance efforts within the organization being investigated.
- High memory consumption, potentially using up to 2 GB of RAM in various settings, which will prevent this tool from running on a cheap VDS in the cloud.
Altdns
β a Python tool for building dictionaries for DNS subdomain enumeration. It allows generation of numerous subdomain variations through mutations and permutations. This utilizes words frequently found in subdomains (e.g., test, dev, staging), with all mutations and permutations applied to known subdomains that can be fed into Altdns. The output is a list of subdomain variations that may exist, which can further be used for DNS brute-forcing.
Pros:
- Works well with large datasets.
aquatone
β was previously better known as another tool for subdomain discovery, but the author moved away from this in favor of the aforementioned Amass. Now aquatone is rewritten in Go and more focused on initial reconnaissance of websites. For this purpose, aquatone goes through specified domains and searches for websites on different ports, after which it collects all the information about the site and takes screenshots. It is convenient for quick initial reconnaissance of websites, after which prioritizing targets for attacks can be selected.
Pros:
- Produces a group of files and folders that are convenient for further work with other tools:
* HTML report with collected screenshots and grouped by similarity response headers;* File with all URLs where websites were found;
* File with statistics and page data;
* Folder with files containing response headers from found targets;
* Folder with files containing the response body from found targets;
* Screenshots of found websites;
- Supports working with XML reports from Nmap and Masscan;
- Uses headless Chrome/Chromium for rendering screenshots.
Cons:
- May attract the attention of intrusion detection systems, so it requires configuration.
Screenshot taken for an older version of aquatone (v0.5.0), which had DNS subdomain discovery implemented. Older versions can be found on .
MassDNS
β another tool for DNS subdomain discovery. Its main distinction is that it makes DNS queries directly to multiple different DNS resolvers and does so at significant speed.
Pros:
- Fast β capable of resolving over 350 thousand names per second.
Cons:
- MassDNS can place a significant load on the DNS resolvers used, which may lead to bans on those servers or complaints to your provider. Additionally, it will impose a heavy load on the company's DNS servers, if they have any, and if they are responsible for the domains you are trying to resolve.
- The list of resolvers is currently outdated; however, if non-working DNS resolvers are filtered out and new known ones are added, everything will work well.
Screenshot of aquatone v0.5.0
nsec3map
β a Python tool to obtain a complete list of domains protected by DNSSEC.
Pros:
- Quickly discovers hosts in DNS zones with a minimal number of queries, provided the zone supports DNSSEC;
- Includes a plugin for John the Ripper that can be used to crack obtained NSEC3 hashes.
Cons:
- Many DNS errors are handled incorrectly;
- There is no automatic parallel processing of NSEC records β one has to manually split the namespace;
- High memory consumption.
Acunetix
β a web vulnerability scanner that automates the process of testing web application security. It tests the application for SQL injections, XSS, XXE, SSRF, and many other web vulnerabilities. However, like any other scanner for a multitude of web vulnerabilities, it cannot replace a pentester, as complex vulnerability chains or logic vulnerabilities may go undetected. Still, it covers many different vulnerabilities, including various CVEs that a pentester might overlook, making it very useful for freeing up from routine checks.
Pros:
- Low false positive rate;
- Results can be exported as reports;
- Performs a large number of checks for various vulnerabilities;
- Parallel scanning of multiple hosts.
Cons:
- There is no deduplication algorithm (Acunetix will consider functionally identical pages different, as they lead to different URLs), but the developers are working on this;
- Requires installation on a separate web server, complicating the testing of client systems connecting via VPN and using the scanner in an isolated segment of the local client network;
- May 'noise' the researched service, for example, sending too many attack vectors to a contact form on the website, thereby significantly complicating business processes.
- It is a proprietary and therefore non-free solution.
Dirsearch
β a Python tool for brute-forcing directories and files on websites.
Pros:
- It can distinguish real β200 OKβ pages from β200 OKβ pages that contain the text βpage not foundβ;
- Comes with a convenient dictionary that strikes a good balance between size and search efficiency. It contains standard paths typical for many CMS and technology stacks;
- Its own dictionary format, which achieves good efficiency and flexibility in traversing files and directories;
- User-friendly output β plain text, JSON;
- It can perform throttling β a pause between requests, which is vital for any weak service.
Cons:
- Extensions need to be passed as a string, which is inconvenient if multiple extensions need to be specified at once;
- To use your dictionary, it will need slight modifications to fit Dirsearch dictionary format for maximum efficiency.
wfuzz
β a Python fuzzer for web applications. Probably one of the most well-known web fuzzers. The principle is simple: wfuzz allows fuzzing any part of the HTTP request, enabling fuzzing of GET/POST parameters, HTTP headers, including Cookies and other authentication headers. At the same time, it is also convenient for simple brute-forcing of directories and files, which requires a good dictionary. It also has a flexible filtering system that can filter responses from the website based on various parameters, allowing for effective results.
Pros:
- Multifunctional β modular structure, assembly takes just a few minutes;
- Convenient filtering and fuzzing mechanism;
- Can fuzz any HTTP method, as well as any part of the HTTP request.
Cons:
- In development.
ffuf
β a web fuzzer in Go, created in the βimage and likenessβ of wfuzz, allows brute-forcing files, directories, URL paths, names and values of GET/POST parameters, HTTP headers, including the Host header for brute-forcing virtual hosts. Compared to its counterpart wfuzz, it features higher speeds and some new features, such as support for Dirsearch format dictionaries.
Pros:
- Filters are similar to wfuzz filters, providing flexible brute-forcing configuration;
- Allows fuzzing values of HTTP headers, POST request data, and various parts of the URL, including names and values of GET parameters;
- Any HTTP method can be specified.
Cons:
- In development.
gobuster
β a Go tool for reconnaissance, featuring two operational modes. The first is used for bruteforcing files and directories on websites, while the second is for enumerating DNS subdomains. The tool does not initially support recursive iteration over files and directories, which certainly saves time, but on the other hand, each new endpoint on the website needs to be initiated separately for bruteforce.
Pros:
- High speed for both DNS subdomain enumeration and bruteforcing files and directories.
Cons:
- The current version does not support setting HTTP headers;
- By default, it only considers some HTTP status codes as valid (200, 204, 301, 302, 307).
Arjun
β a tool for bruteforcing hidden HTTP parameters in GET/POST parameters and JSON. The built-in dictionary contains 25,980 words, which Ajrun checks in about 30 seconds. The focus is that Ajrun does not check each parameter separately but checks approximately 1,000 parameters at once and observes if the response changes. If the response changes, it divides those 1,000 parameters into two parts and checks which part affects the response. Thus, using a simple binary search, it identifies the parameter or several hidden parameters that influenced the response and may therefore exist.
Pros:
- High operational speed due to binary search;
- Support for GET/POST parameters as well as parameters in JSON format;
A similar principle applies to the Burp Suite plugin β , which is also very effective in discovering hidden HTTP parameters. We'll discuss it in detail in an upcoming article about Burp and its plugins.
LinkFinder
β a Python script for finding links in JavaScript files. Useful for discovering hidden or forgotten endpoints/URLs in web applications.
Pros:
- Fast;
- There is a special Chrome plugin based on LinkFinder.
.
Cons:
- Cumbersome final output;
- Does not analyze JavaScript in real-time;
- The logic for link searching is relatively straightforward β if JavaScript is obfuscated in any way, or if links are initially absent and generated dynamically, it will not be able to find anything.
JSParser
β a Python script that uses and to analyze relative URLs from JavaScript files. Very useful for detecting AJAX requests and compiling a list of API methods that the application interacts with. Works effectively in tandem with LinkFinder.
Pros:
- Fast parsing of JavaScript files.
sqlmap
Probably one of the most well-known tools for web application analysis. Sqlmap automates the detection and exploitation of SQL injections, works with multiple SQL dialects, and has a vast arsenal of various techniques ranging from straightforward quote injections to complex time-based SQL injection vectors. Additionally, it provides many further exploitation techniques for different DBMSs, making it useful not just as an SQL injection scanner, but also as a powerful tool for exploiting already discovered SQL injections.
Pros:
- A large number of various techniques and vectors;
- Low false positive rate;
- Many configuration options, various techniques, targeted DB, tamper scripts to bypass WAF;
- Ability to create a dump of output data;
- Many different exploitation possibilities, for some DBs β automatic file upload/download, command execution capability (RCE), and others;
- Support for direct database connection using data obtained during the attack;
- You can provide a text file with the results from Burp β no need to manually assemble all the command line attributes.
Cons:
- Difficult to customize, for example, to write your own checks due to sparse documentation for this;
- Without proper settings, it conducts an incomplete set of checks, which can be misleading.
NoSQLMap
A Python tool for automating the detection and exploitation of NoSQL injections. Convenient not only for NoSQL databases but also directly during audits of web applications that use NoSQL.
Pros:
- Like sqlmap, it not only finds potential vulnerabilities but also checks the possibility of their exploitation for MongoDB and CouchDB.
Cons:
- Does not support NoSQL for Redis and Cassandra; development is ongoing in this direction.
oxml_xxe
A tool for embedding XXE XML exploits into various types of files that use the XML format in some way.
Pros:
- Supports many common formats, such as DOCX, ODT, SVG, XML.
Cons:
- PDF, JPEG, GIF support is not fully implemented;
- Creates only one file. To solve this problem, you can use the tool , which can create a large number of files with payloads in different locations.
The aforementioned utilities are excellent for testing XXE when loading documents that contain XML. However, do not forget that XML format handlers can be encountered in many other cases; for example, XML can be used as a data format instead of JSON.
Therefore, we recommend paying attention to the following repository that contains a large number of diverse payloads: .
tplmap
β a Python tool for automatically discovering and exploiting vulnerabilities in Server-Side Template Injection, has similar settings and flags to sqlmap. It employs several different techniques and vectors, including blind injections, and features techniques for executing code and uploading/downloading arbitrary files. Moreover, it has techniques for a dozen different template engines and some techniques for finding eval()-like code injections in Python, Ruby, PHP, and JavaScript. In the event of successful exploitation, it opens an interactive console.
Pros:
- A large number of various techniques and vectors;
- Supports multiple template rendering engines;
- Many exploitation techniques.
CeWL
β a dictionary generator in Ruby designed to extract unique words from a specified website, crawling through links on the site to a specified depth. The resulting dictionary of unique words can be used for brute-forcing passwords on services or brute-forcing files and directories on the same website, or for attacking captured hashes using hashcat or John the Ripper. It is useful for compiling a 'targeted' list of potential passwords.
Pros:
- Easy to use.
Cons:
- Care should be taken with the search depth to avoid capturing extraneous domains.
Weakpass
β a service that contains a multitude of dictionaries with unique passwords. Extremely helpful for various tasks related to password cracking, ranging from simple online brute-forcing of accounts on target services to offline brute-forcing of captured hashes using or . It includes around 8 billion passwords ranging from 4 to 25 characters long.
Pros:
- Contains both specific dictionaries and dictionaries of the most commonly used passwords β specific dictionaries can be tailored to your needs;
- Dictionaries are updated and filled with new passwords.
- Dictionaries are sorted by efficiency. You can choose an option for quick online brute force or for thorough password selection from a large dictionary with the latest leaks;
- There is a calculator showing the brute force time for your equipment.
We would like to highlight tools for CMS checks: WPScan, JoomScan, and AEM hacker.
AEM_hacker
β a tool for identifying vulnerabilities in Adobe Experience Manager (AEM) applications.
Pros:
- It can detect AEM applications from a list of URLs provided to it;
- It contains scripts for RCE by uploading a JSP shell or exploiting SSRF.
JoomScan
β a Perl tool for automating vulnerability detection when deploying Joomla CMS.
Pros:
- It can find configuration flaws and administrator settings issues;
- It lists Joomla versions and their associated vulnerabilities, similarly for individual components;
- Contains over 1000 exploits for Joomla components;
- Outputs final reports in text and HTML formats.
WPScan
β a tool for scanning WordPress sites, equipped with vulnerabilities for both the WordPress engine and some plugins.
Pros:
- It can list not only insecure WordPress plugins and themes but also obtain user lists and TimThumb files;
- It can conduct brute force attacks on WordPress sites.
Cons:
- Without proper settings, it conducts an incomplete set of checks, which can be misleading.
Overall, different people prefer different tools for work: they are all good in their own way, and what one person likes may not suit another at all. If you think we overlooked a good utility β let us know about it in the comments!
Source: habr.com
