This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Phoenix/Tools"

From OWASP

Jump to: navigation, search

Latest revision as of 15:27, 18 October 2017

Please send comments or questions to the Phoenix-OWASP mailing-list.

1 Testing grounds
- 1.1 LiveCDs
- 1.2 Test sites
2 External Assessment
3 Server side stuff
4 Code
5 Database security assessment
6 Threat modeling
7 Misc
8 Browser Privacy/ Defenses
- 8.1 Browser Defenses
- 8.2 Browser Privacy

Testing grounds

LiveCDs

OWASP Live CD - http://www.owasp.org/index.php/Category:OWASP_Live_CD_Project
Web Security Dojo - http://dojo.mavensecurity.com/
Samurai WTF - http://samurai.inguardians.com
DVL (Damn Vulnerable Linux) - http://www.damnvulnerablelinux.org/
moth - http://www.bonsai-sec.com/en/research/moth.php
OWASP Broken Web Applications - http://code.google.com/p/owaspbwa/
Hacking-Lab Live CD - https://www.hacking-lab.com/Remote_Sec_Lab/livecd.html

Test sites

SPI Dynamics (live) - http://zero.webappsecurity.com/
Trustwave (live) - http://crackme.trustwave.com/
Watchfire (live) - http://demo.testfire.net/
Acunetix (live) - http://testphp.vulnweb.com/ http://testasp.vulnweb.com http://testaspnet.vulnweb.com
WebMaven / Buggy Bank - http://www.mavensecurity.com/webmaven
Foundstone SASS tools - http://www.foundstone.com/us/resources-free-tools.asp
Updated HackmeBank - http://www.o2-ounceopen.com/technical-info/2008/12/8/updated-version-of-hacmebank.html
OWASP WebGoat - http://www.owasp.org/index.php/OWASP_WebGoat_Project
OWASP SiteGenerator - http://www.owasp.org/index.php/Owasp_SiteGenerator
Stanford SecuriBench - http://suif.stanford.edu/~livshits/securibench/
SecuriBench Micro - http://suif.stanford.edu/~livshits/work/securibench-micro/
Google’s web application training - http://jarlsberg.appspot.com/part1/
OWASP TOP 10 LAB (Online) - https://www.hacking-lab.com/Remote_Sec_Lab/free-owasp-top10-lab.html

Java ORM Testing Playground - https://github.com/0ang3el/HQLi-playground

External Assessment

Browser

Add-ons for Firefox that help with general web application security

Browser-based HTTP tampering / editing / replaying

TamperIE - http://www.bayden.com/Other/
isr-form - http://www.infobyte.com.ar/developments.html
Modify Headers (Firefox Add-on) - http://modifyheaders.mozdev.org/
Tamper Data (Firefox Add-on) - http://tamperdata.mozdev.org/
UrlParams (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1290/
TestGen4Web (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1385/
DOM Inspector / Inspect This (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1806/ https://addons.mozilla.org/en-US/firefox/addon/1913/
LiveHTTPHeaders / Header Monitor (Firefox Add-on) - http://livehttpheaders.mozdev.org/ https://addons.mozilla.org/en-US/firefox/addon/575/

Add-ons for Firefox that help with Javascript and Ajax web application security

Selenium IDE - http://www.openqa.org/selenium-ide/
Firebug - http://www.joehewitt.com/software/firebug/
Venkman - http://www.mozilla.org/projects/venkman/
Chickenfoot - http://groups.csail.mit.edu/uid/chickenfoot/
Greasemonkey - http://www.greasespot.net/
Greasemonkey compiler - http://www.letitblog.com/greasemonkey-compiler/
User script compiler - http://arantius.com/misc/greasemonkey/script-compiler
Extension Developer's Extension (Firefox Add-on) - http://ted.mielczarek.org/code/mozilla/extensiondev/
Smart Middle Click (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/3885/

Bookmarklets that aid in web application security

RSnake's security bookmarklets - http://ha.ckers.org/bookmarklets.html
BMlets - http://optools.awardspace.com/bmlet.html
Huge list of bookmarklets - http://www.squarefree.com/bookmarklets/
Blummy: consists of small widgets, called blummlets, which make use of Javascript to provide rich functionality - http://www.blummy.com/
Bookmarklets every blogger should have - http://www.micropersuasion.com/2005/10/bookmarklets_ev.html
Flat Bookmark Editing (Firefox Add-on) - http://n01se.net/chouser/proj/mozhack/
OpenBook and Update Bookmark (Firefox Add-ons) - http://www.chuonthis.com/extensions/

Footprinting for web application security

Evolution - http://www.paterva.com/evolution-e.html
GooSweep - http://www.mcgrewsecurity.com/projects/goosweep/
Aura: Google API Utility Tools - http://www.sensepost.com/research/aura/
Edge-Security tools - http://www.edge-security.com/soft.php
Fierce Domain Scanner - http://ha.ckers.org/fierce/
Googlegath - http://www.nothink.org/perl/googlegath/
Advanced Dork (Firefox Add-on) - https://addons.mozilla.org/firefox/2144/
Passive Cache (Firefox Add-on) - https://addons.mozilla.org/firefox/977/
CacheOut! (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1453/
BugMeNot Extension (Firefox Add-on) - http://roachfiend.com/archives/2005/02/07/bugmenot/
TrashMail.net Extension (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1813/
DiggiDig (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/2819/
Digger (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1467/

Tools

SSL certificate checking / scanning

SSL Labs - https://www.ssllabs.com/ssldb/
[ZIP] THCSSLCheck - http://thc.org/root/tools/THCSSLCheck.zip
[ZIP] Foundstone SSLDigger - http://www.foundstone.com/us/resources/termsofuse.asp?file=ssldigger.zip
Cert Viewer Plus (Firefox Add-on) - https://addons.mozilla.org/firefox/1964/
testssl.sh - http://drwetter.eu/software/ssl/
O-Saft - OWASP SSL audit for testers: list information about and test remote SSL certificate and connection Download

HTTP proxying / editing

WebScarab - http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project
Burp Suite - http://www.portswigger.net/
Paros - http://www.parosproxy.org/
Paros fork #1: Zed Attack Proxy (ZAP) - http://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
Paros fork #2: Andiparos - http://code.google.com/p/andiparos/
Fiddler - http://www.fiddlertool.com/
Web Proxy Editor - http://www.microsoft.com/mspress/companion/0-7356-2187-X/
Pantera - http://www.owasp.org/index.php/Category:OWASP_Pantera_Web_Assessment_Studio_Project
Suru - http://www.sensepost.com/research/suru/
httpedit (curses-based) - http://www.neutralbit.com/en/rd/httpedit/
Charles - http://www.xk72.com/charles/
Odysseus - http://www.bindshell.net/tools/odysseus
Burp, Paros, and WebScarab for Mac OS X - http://www.corsaire.com/downloads/
Web-application scanning tool from `Network Security Tools'/O'Reilly - http://examples.oreilly.com/networkst/
JS Commander - http://jscmd.rubyforge.org/
Ratproxy - http://code.google.com/p/ratproxy/
Arachni - https://github.com/Zapotek/arachni/
WATOBO - http://watobo.sourceforge.net/

RSnake's XSS cheat sheet based-tools, webapp fuzzing, and encoding tools

Wfuzz - http://www.edge-security.com/wfuzz.php
ProxMon - http://www.isecpartners.com/proxmon.html
Wapiti - http://wapiti.sourceforge.net/
Grabber - http://rgaucher.info/beta/grabber/
XSSScan - http://darkcode.ath.cx/scanners/XSSscan.py
CAL9000 - http://www.owasp.org/index.php/Category:OWASP_CAL9000_Project
EnDe - http://www.owasp.org/index.php/Category:OWASP_EnDe
HTMangLe - http://www.fishnetsecurity.com/Tools/HTMangLe/publish.htm
JBroFuzz - http://www.owasp.org/index.php/JBroFuzz
J-Baah - http://www.sensepost.com/labs/tools/pentest/j-baah
XSSFuzz - http://ha.ckers.org/blog/20060921/xssfuzz-released/
WhiteAcid's XSS Assistant - http://www.whiteacid.org/greasemonkey/
Overlong UTF - http://www.microsoft.com/mspress/companion/0-7356-2187-X/
[TGZ] MielieTool (SensePost Research) - http://packetstormsecurity.org/UNIX/utilities/mielietools-v1.0.tgz
RegFuzzer: test your regular expression filter - http://rgaucher.info/b/index.php/post/2007/05/26/RegFuzzer%3A-Test-your-regular-expression-filter
screamingCobra - http://www.dachb0den.com/projects/screamingcobra.html
SPIKE and SPIKE Proxy - http://immunitysec.com/resources-freesoftware.shtml
RFuzz - http://rfuzz.rubyforge.org/
WebFuzz - http://www.codebreakers-journal.com/index.php?option=com_content&task=view&id=112&Itemid=99999999
TestMaker - http://www.pushtotest.com/Docs/downloads/features.html
ASP Auditor - http://michaeldaw.org/projects/asp-auditor-v2/
WSTool - http://wstool.sourceforge.net/
Web Hack Control Center (WHCC) - http://ussysadmin.com/whcc/
Web Text Converter - http://www.microsoft.com/mspress/companion/0-7356-2187-X/
HackBar (Firefox Add-on) - https://addons.mozilla.org/firefox/3899/
Net-Force Tools (NF-Tools, Firefox Add-on) - http://www.net-force.nl/library/downloads/
PostIntercepter (Greasemonkey script) - http://userscripts.org/scripts/show/743
fuzzdb - https://code.google.com/p/fuzzdb/

Fuzzer

Browser-based security fuzzing / checking

Zalewski's MangleMe - http://freecode.com/projects/mangleme tool see here http://lcamtuf.coredump.cx/soft/mangleme.tgz (mangle.cgi dead link)
hdm's tools: Hamachi, CSSDIE, DOM-Hanoi, AxMan - http://metasploit.com/users/hdm/tools/
Peach Fuzzer Framework - http://peachfuzzer.com/ (old link)/
TagBruteForcer - http://research.eeye.com/html/tools/RT20060801-3.html
PROTOS Test-Suite: c05-http-reply - http://www.ee.oulu.fi/research/ouspg/protos/testing/c05/http-reply/index.html
COMRaider - https://github.com/dzzie/COMRaider (dead link)
BrowserCheck - http://www.heise-security.co.uk/services/browsercheck/
Stealing information using DNS pinning demo - http://www.jumperz.net/index.php?i=2&a=1&b=7
Javascript Website Login Checker - http://ha.ckers.org/weird/javascript-website-login-checker.html
Mozilla Activex - http://www.adamlock.com/mozilla/ (old link)
Mr. T (Master Recon Tool, includes Read Firefox Settings PoC) - http://ha.ckers.org/mr-t/
Test your installation of Java software - http://java.com/en/download/installed.jsp?detect=jre&try=1
WebPageFingerprint - Light-weight Greasemonkey Fuzzer - http://userscripts.org/scripts/show/30285

dead, vanished links (March/2012)

bcheck - http://bcheck.scanit.be/bcheck/
Cross-browser Exploit Tests - http://www.jungsonnstudios.com/cool.php
Jungsonn's Black Dragon Project - http://blackdragon.jungsonnstudios.com/
Vulnerable Adobe Plugin Detection For UXSS PoC - http://www.0x000000.com/?i=324
About Flash: is your flash up-to-date? - http://www.macromedia.com/software/flash/about/
Stop-Phishing: Projects page - http://www.indiana.edu/~phishing/?projects
LinkScanner - http://linkscanner.explabs.com/linkscanner/default.asp (seems to be a vendor link now)

Application and protocol fuzzing (random instead of targeted)

Sulley - http://fuzzing.org/
taof: The Art of Fuzzing - http://sourceforge.net/projects/taof/
zzuf: multipurpose fuzzer - http://sam.zoy.org/zzuf/
autodafé: an act of software torture - http://autodafe.sourceforge.net/

dead, vanished links (March/2012)

EFS and GPF: Evolutionary Fuzzing System - http://www.appliedsec.com/resources.html

Ajax and XHR scanning

Sahi - http://sahi.co.in/
scRUBYt - http://scrubyt.org/
jQuery - http://jquery.com/
jquery-include - http://www.gnucitizen.org/projects/jquery-include
Sprajax - http://www.denimgroup.com/sprajax.html
Watir - http://wtr.rubyforge.org/
Watij - http://watij.com/
Watin - http://watin.sourceforge.net/
RBNarcissus - http://idontsmoke.co.uk/2005/rbnarcissus/
SpiderTest (Spider Fuzz plugin) - http://blog.caboo.se/articles/2007/2/21/the-fabulous-spider-fuzz-plugin
Javascript Inline Debugger (jasildbg) - http://jasildbg.googlepages.com/
Firebug Lite - http://www.getfirebug.com/lite.html
firewaitr - http://code.google.com/p/firewatir/

SQL injection scanning

0x90.org: home of Absinthe, Mezcal, etc - http://0x90.org/releases.php
SQLiX - http://www.owasp.org/index.php/Category:OWASP_SQLiX_Project
sqlninja: a SQL Server injection and takover tool - http://sqlninja.sourceforge.net/
JustinClarke's SQL Brute - http://www.justinclarke.com/archives/2006/03/sqlbrute.html
BobCat - http://www.northern-monkee.co.uk/projects/bobcat/bobcat.html
sqlmap - http://sqlmap.sourceforge.net/
Scully: SQL Server DB Front-End and Brute-Forcer - http://www.sensepost.com/research/scully/
FG-Injector - http://www.flowgate.net/?lang=en&seccion=herramientas
PRIAMOS - http://www.priamos-project.com/

Web services enumeration / scanning / fuzzing

WebServiceStudio2.0 - http://www.codeplex.com/WebserviceStudio
Net-square: wsChess - http://net-square.com/wschess/index.shtml
WSFuzzer - http://www.owasp.org/index.php/Category:OWASP_WSFuzzer_Project
SIFT: web method search tool - http://www.sift.com.au/73/171/sift-web-method-search-tool.htm
iSecPartners: WSMap, WSBang, etc - http://www.isecpartners.com/tools.html

3rd party services that aid in web application security assessment

Netcraft - http://www.netcraft.net
AboutURL - http://www.abouturl.com/
The Scrutinizer - http://www.scrutinizethis.com/
net.toolkit - http://clez.net/
ServerSniff - http://www.serversniff.net/
Online Microsoft script decoder - http://www.greymagic.com/security/tools/decoder/
Webmaster-Toolkit - http://www.webmaster-toolkit.com/
myIPNeighbbors, et al - http://digg.com/security/MyIPNeighbors_Find_Out_Who_Else_is_Hosted_on_Your_Site_s_IP_Address
PHP charset encoding - http://h4k.in/encoding
data: URL testcases - http://h4k.in/dataurl

Server side stuff

PHP static analysis and file inclusion scanning

Pixy: Open source flow based discovery of XSS and SQLi - http://pixybox.seclab.tuwien.ac.at/pixy/
PHP-SAT.org: Static analysis for PHP - http://www.program-transformation.org/PHP/
Unl0ck Research Team: tool for searching in google for include bugs - http://unl0ck.net/tools.php
FIS: File Inclusion Scanner - http://www.segfault.gr/index.php?cat_id=3&cont_id=25
PHPSecAudit - http://developer.spikesource.com/projects/phpsecaudit

PHP Defensive Tools

PHPInfoSec - Check phpinfo configuration for security - http://phpsec.org/projects/phpsecinfo/
Greasemonkey Replacement can be found at http://yehg.net/lab/#tools.greasemonkey
Php-Brute-Force-Attack Detector - Detect your web servers being scanned by brute force tools - http://yehg.net/lab/pr0js/files.php/php_brute_force_detect.zip
PHP-Login-Info-Checker (Strictly enforce admins/users to select stronger passwords via url loginfo_checker.php?testlic) - http://yehg.net/lab/pr0js/files.php/loginfo_checkerv0.1.zip, http://yehg.net/lab/pr0js/files.php/phploginfo_checker_demo.zip
php-DDOS-Shield (prevent idiot distributed bots which discontinue their flooding attacks by identifying HTTP 503 header code) - http://code.google.com/p/ddos-shield/
PHPMySpamFIGHTER - http://yehg.net/lab/pr0js/files.php/phpmyspamfighter.zip, http://yehg.net/lab/pr0js/files.php/phpMySpamFighter_demo.rar

Web Application Firewall (WAF) and Intrusion Detection (APIDS) rules and resources

APIDS on Wikipedia - http://en.wikipedia.org/wiki/APIDS
PHP Intrusion Detection System (PHP-IDS) - http://php-ids.org/ http://code.google.com/p/phpids/
dotnetids - http://code.google.com/p/dotnetids/
Secure Science InterScout - http://www.securescience.com/home/newsandevents/news/interscout1.0.html
Remo: whitelist rule editor for mod_security - http://remo.netnea.com/
GotRoot: ModSecuirty rules - http://www.gotroot.com/tiki-index.php?page=mod_security+rules
The Web Security Gateway (WSGW) - http://wsgw.sourceforge.net/
mod_security rules generator - http://noeljackson.com/tools/modsecurity/
Mod_Anti_Tamper - http://www.wisec.it/projects.php?id=3
[TGZ] Automatic Rules Generation for Mod_Security - http://www.wisec.it/rdr.php?fn=/Projects/Rule-o-matic.tgz
AQTRONIX WebKnight - http://www.aqtronix.com/?PageID=99
Akismet: blog spam defense - http://akismet.com/
Samoa: Formal tools for securing web services - http://research.microsoft.com/projects/samoa/

Code

Web application non-specific static source-code analysis

Pixy: a static analysis tool for detecting XSS vulnerabilities - http://www.seclab.tuwien.ac.at/projects/pixy/
Brixoft.Net: Source Edit - http://www.brixoft.net/prodinfo.asp?id=1
Security compass web application auditing tools (SWAAT) - http://www.owasp.org/index.php/Category:OWASP_SWAAT_Project
An even more complete list here - http://www.cs.cmu.edu/~aldrich/courses/654/tools/
A nice list that claims some demos available - http://www.cs.cmu.edu/~aldrich/courses/413/tools.html
A smaller, but also good list - http://spinroot.com/static/
Yasca: A highly extensible source code analysis framework; incorporates several analysis tools into one package. http://www.yasca.org/

Static analysis for C/C++ (CGI, ISAPI, etc) in web applications

RATS - http://www.securesoftware.com/resources/download_rats.html
ITS4 - http://www.cigital.com/its4/
FlawFinder - http://www.dwheeler.com/flawfinder/
Splint - http://www.splint.org/
Uno - http://spinroot.com/uno/
BOON (Buffer Overrun detectiON) - http://www.cs.berkeley.edu/~daw/boon/ http://boon.sourceforge.net
Valgrind - http://www.valgrind.org/

Java static analysis, security frameworks, and web application security tools

LAPSE - http://suif.stanford.edu/~livshits/work/lapse/
CodePro Analytix - http://code.google.com/webtoolkit/tools/codepro/doc/index.html
HDIV Struts - http://hdiv.org/
Orizon - http://sourceforge.net/projects/orizon/
FindBugs: Find bugs in Java programs - http://findbugs.sourceforge.net/
PMD - http://pmd.sourceforge.net/
CUTE: A Concolic Unit Testing Engine for C and Java - http://osl.cs.uiuc.edu/~ksen/cute/
EMMA - http://emma.sourceforge.net/
JLint - http://jlint.sourceforge.net/
Java PathFinder - http://javapathfinder.sourceforge.net/
Fujaba: Move between UML and Java source code - http://wwwcs.uni-paderborn.de/cs/fujaba/
Checkstyle - http://checkstyle.sourceforge.net/
Cookie Revolver Security Framework - http://sourceforge.net/projects/cookie-revolver
tinapoc - http://sourceforge.net/projects/tinapoc
jarsigner - http://java.sun.com/j2se/1.5.0/docs/tooldocs/solaris/jarsigner.html
Solex - http://solex.sourceforge.net/
Java Explorer - http://metal.hurlant.com/jexplore/
HTTPClient - http://www.innovation.ch/java/HTTPClient/
another HttpClient - http://jakarta.apache.org/commons/httpclient/
a list of code coverage and analysis tools for Java - http://mythinkpond.blogspot.com/2007/06/java-foss-freeopen-source-software.html

Microsoft .NET static analysis and security framework tools, mostly for ASP.NET and ASP.NET AJAX, but also C# and VB.NET

Visual Studio 2008 Code Analysis, available in:
- VSTS 2008 Development Edition (http://msdn.microsoft.com/vsts2008/products/bb933752.aspx) and
- VSTS 2008 Team Suite (http://msdn.microsoft.com/vsts2008/products/bb933735.aspx)
Visual Studio 2005 Code Analyzer, available in:
- Visual Studio 2005 Team Edition for Software Developers (http://msdn.microsoft.com/en-us/vstudio/aa718806.aspx)
- Visual Studio 2005 Team Suite (http://msdn.microsoft.com/en-us/vstudio/aa718806.aspx)
Web Development Helper - http://www.nikhilk.net/Project.WebDevHelper.aspx
FxCop:
- (blog) http://blogs.msdn.com/fxcop/
- (download) http://code.msdn.microsoft.com/codeanalysis
Microsoft internal tools you can't have yet:

Database security assessment

Scuba by Imperva Database Vulnerability Scanner - http://www.imperva.com/scuba/

Threat modeling

Microsoft Threat Analysis and Modeling Tool v2.1 (TAM) - http://www.microsoft.com/downloads/details.aspx?FamilyID=59888078-9daf-4e96-b7d1-944703479451&displaylang=en
Amenaza: Attack Tree Modeling (SecurITree) - http://www.amenaza.com/software.php
Octotrike - http://www.octotrike.org/

Misc

RSS extensions and caching

rss-cache - http://www.dubfire.net/chris/projects/rss-cache/

Blackhat SEO and maybe some whitehat SEO

SearchStatus (Firefox Add-on) - http://www.quirk.biz/searchstatus/
SEO for Firefox (Firefox Add-on) - http://tools.seobook.com/firefox/seo-for-firefox.html
SEOQuake (Firefox Add-on) - http://www.seoquake.com/
Analytics seo - http://www.analyticsseo.com/

Web application security malware, backdoors, and evil code

Jikto - http://busin3ss.name/jikto-in-the-wild/
XSS Shell - http://ferruh.mavituna.com/article/?1338
XSS-Proxy - http://xss-proxy.sourceforge.net
AttackAPI - http://www.gnucitizen.org/projects/attackapi/
FFsniFF - http://azurit.elbiahosting.sk/ffsniff/
HoneyBlog's web-based junkyard - http://honeyblog.org/junkyard/web-based/
BeEF - http://www.beefproject.com
Firefox Extension Scanner (FEX) - http://www.gnucitizen.org/projects/fex/
What is my IP address? - http://reglos.de/myaddress/
xRumer: blogspam automation tool - http://www.botmaster.net/movies/XFull.htm
SpyJax - http://www.merchantos.com/makebeta/tools/spyjax/
Greasecarnaval - http://www.gnucitizen.org/projects/greasecarnaval
Technika - http://www.gnucitizen.org/projects/technika/
Load-AttackAPI bookmarklet - http://www.gnucitizen.org/projects/load-attackapi-bookmarklet
MD's Projects: JS port scanner, pinger, backdoors, etc - http://michaeldaw.org/my-projects/

Honeyclients, Web Application, and Web Proxy honeypots

Honeyclient Project: an open-source honeyclient - http://www.honeyclient.org/trac/
HoneyC: the low-interaction honeyclient - http://honeyc.sourceforge.net/
Capture: a high-interaction honeyclient - http://capture-hpc.sourceforge.net/
Google Hack Honeypot - http://ghh.sourceforge.net/
PHP.Hop - PHP Honeynet Project - http://www.rstack.org/phphop/
SpyBye - http://www.monkey.org/~provos/spybye/
Honeytokens - http://www.securityfocus.com/infocus/1713

Browser Privacy/ Defenses

Browser Defenses

Browser Privacy

BetterPrivacy (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/betterprivacy/
TrackMeNot (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/trackmenot/
Privacy Bird - http://www.privacybird.com/
HTTPS Everywhere - https://www.eff.org/https-everywhere

Retrieved from "https://wiki.owasp.org/index.php?title=Phoenix/Tools&oldid=234481"

@@ Line 1: / Line 1: @@
-Please send comments or questions to the Phoenix-OWASP mailing-list.<br/ >
+Please send comments or questions to the [https://lists.owasp.org/mailman/listinfo/owasp-phoenix Phoenix-OWASP mailing-list].
-<br/ >
-<b>LiveCDs</b><br/ >
+=Testing grounds=
-Monday, January 29, 2007  4:02 PM    828569600 AOC_Labrat-ALPHA-0010.iso - http://www.packetfocus.com/hackos/<br/ >
+==LiveCDs==
-DVL (Damn Vulnerable Linux) - http://www.damnvulnerablelinux.org/<br/ >
+OWASP Live CD - http://www.owasp.org/index.php/Category:OWASP_Live_CD_Project <br />
-<br/ >
+Web Security Dojo - http://dojo.mavensecurity.com/<br />
-<b>Test sites / testing grounds</b><br/ >
+Samurai WTF - http://samurai.inguardians.com<br />
-SPI Dynamics (live) - http://zero.webappsecurity.com/<br/ >
+DVL (Damn Vulnerable Linux) - http://www.damnvulnerablelinux.org/<br />
-Cenzic (live) - http://crackme.cenzic.com/<br/ >
+moth - http://www.bonsai-sec.com/en/research/moth.php<br />
-Watchfire (live) - http://demo.testfire.net/<br/ >
+OWASP Broken Web Applications - http://code.google.com/p/owaspbwa/<br />
-Acunetix (live) - http://testphp.acunetix.com/ http://testasp.acunetix.com http://testaspnet.acunetix.com<br/ >
+Hacking-Lab Live CD - https://www.hacking-lab.com/Remote_Sec_Lab/livecd.html<br />
-WebMaven / Buggy Bank (includes live testsite) - http://www.mavensecurity.com/webmaven<br/ >
-Foundstone SASS tools - http://www.foundstone.com/index.htm?subnav=resources/navigation.htm&subcontent=/resources/s3i_tools.htm<br/ >
+==Test sites==
-OWASP WebGoat - http://www.owasp.org/index.php/OWASP_WebGoat_Project<br/ >
+SPI Dynamics (live) - http://zero.webappsecurity.com/<br />
-OWASP SiteGenerator - http://www.owasp.org/index.php/Owasp_SiteGenerator<br/ >
+Trustwave (live) - http://crackme.trustwave.com/<br />
-Stanford SecuriBench - http://suif.stanford.edu/~livshits/securibench/<br/ >
+Watchfire (live) - http://demo.testfire.net/<br />
-SecuriBench Micro - http://suif.stanford.edu/~livshits/work/securibench-micro/<br/ >
+Acunetix (live) - http://testphp.vulnweb.com/ http://testasp.vulnweb.com http://testaspnet.vulnweb.com<br />
-<br/ >
+WebMaven / Buggy Bank - http://www.mavensecurity.com/webmaven<br />
-<b>HTTP proxying / editing</b><br/ >
+Foundstone SASS tools - http://www.foundstone.com/us/resources-free-tools.asp<br />
-WebScarab - http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project<br/ >
+Updated HackmeBank - http://www.o2-ounceopen.com/technical-info/2008/12/8/updated-version-of-hacmebank.html<br />
-Burp - http://www.portswigger.net/<br/ >
+OWASP WebGoat - http://www.owasp.org/index.php/OWASP_WebGoat_Project<br />
-Paros - http://www.parosproxy.org/<br/ >
+OWASP SiteGenerator - http://www.owasp.org/index.php/Owasp_SiteGenerator<br />
-Fiddler - http://www.fiddlertool.com/<br/ >
+Stanford SecuriBench - http://suif.stanford.edu/~livshits/securibench/<br />
-Web Proxy Editor - http://www.microsoft.com/mspress/companion/0-7356-2187-X/<br/ >
+SecuriBench Micro - http://suif.stanford.edu/~livshits/work/securibench-micro/<br />
-Pantera - http://www.owasp.org/index.php/Category:OWASP_Pantera_Web_Assessment_Studio_Project<br/ >
+Google’s web application training - http://jarlsberg.appspot.com/part1/ <br />
-Suru - http://www.sensepost.com/research/suru/<br/ >
+OWASP TOP 10 LAB (Online) - https://www.hacking-lab.com/Remote_Sec_Lab/free-owasp-top10-lab.html
-httpedit (curses-based) - http://www.neutralbit.com/en/rd/httpedit/<br/ >
-Charles - http://www.xk72.com/charles/<br/ >
+Java ORM Testing Playground - https://github.com/0ang3el/HQLi-playground
-Odysseus - http://www.bindshell.net/tools/odysseus<br/ >
-Burp, Paros, and WebScarab for Mac OS X - http://www.corsaire.com/downloads/<br/ >
+<br />
-Web-application scanning tool from `Network Security Tools'/O'Reilly - http://examples.oreilly.com/networkst/<br/ >
-<br/ >
+=External Assessment=
-<b>RSnake's XSS cheat sheet based-tools, webapp fuzzing, and encoding tools</b><br/ >
+==Browser==
-Wfuzz - http://www.edge-security.com/wfuzz.php<br/ >
+===Add-ons for Firefox that help with general web application security===
-ProxMon - http://www.isecpartners.com/proxmon.html<br/ >
+Web Developer Toolbar - https://addons.mozilla.org/firefox/60/<br />
-Wapiti - http://wapiti.sourceforge.net/<br/ >
+Plain Old Webserver (POW) - https://addons.mozilla.org/firefox/3002/<br />
-Grabber - http://rgaucher.info/beta/grabber/<br/ >
+XML Developer Toolbar - https://addons.mozilla.org/firefox/2897/<br />
-XSSScan - http://darkcode.ath.cx/scanners/XSSscan.py<br/ >
+Public Fox - https://addons.mozilla.org/firefox/3911/<br />
-CAL9000 - http://www.owasp.org/index.php/Category:OWASP_CAL9000_Project<br/ >
+XForms Buddy - http://beaufour.dk/index.php?sec=misc&pagename=xforms<br />
-HTMangLe - http://www.fishnetsecurity.com/Tools/HTMangLe/publish.htm<br/ >
+MR Tech Local Install - http://www.mrtech.com/extensions/local_install/<br />
-JBroFuzz - http://sourceforge.net/projects/jbrofuzz<br/ >
+Nightly Tester Tools - http://users.blueprintit.co.uk/~dave/web/firefox/buildid/index.html<br />
-XSSFuzz - http://ha.ckers.org/blog/20060921/xssfuzz-released/<br/ >
+IE Tab - https://addons.mozilla.org/firefox/1419/<br />
-WhiteAcid's XSS Assistant - http://www.whiteacid.org/greasemonkey/<br/ >
+User-Agent Switcher - https://addons.mozilla.org/firefox/59/<br />
-Overlong UTF - http://www.microsoft.com/mspress/companion/0-7356-2187-X/<br/ >
+ServerSwitcher - https://addons.mozilla.org/firefox/2409/<br />
-[TGZ] MielieTool (SensePost Research) - http://packetstormsecurity.org/UNIX/utilities/mielietools-v1.0.tgz<br/ >
+HeaderMonitor - https://addons.mozilla.org/firefox/575/<br />
-RegFuzzer: test your regular expression filter - http://rgaucher.info/b/index.php/post/2007/05/26/RegFuzzer%3A-Test-your-regular-expression-filter<br/ >
+RefControl - https://addons.mozilla.org/firefox/953/<br />
-screamingCobra - http://www.dachb0den.com/projects/screamingcobra.html<br/ >
+refspoof - https://addons.mozilla.org/firefox/667/<br />
-SPIKE and SPIKE Proxy - http://immunitysec.com/resources-freesoftware.shtml<br/ >
+No-Referrer - https://addons.mozilla.org/firefox/1999/<br />
-RFuzz - http://rfuzz.rubyforge.org/<br/ >
+LocationBar^2 - https://addons.mozilla.org/firefox/4014/<br />
-WebFuzz - http://www.codebreakers-journal.com/index.php?option=com_content&task=view&id=112&Itemid=99999999<br/ >
+SpiderZilla - http://spiderzilla.mozdev.org/<br />
-TestMaker - http://www.pushtotest.com/Docs/downloads/features.html<br/ >
+Slogger - https://addons.mozilla.org/en-US/firefox/addon/143<br />
-ASP Auditor - http://michaeldaw.org/projects/asp-auditor-v2/<br/ >
+Fire Encrypter - https://addons.mozilla.org/firefox/3208/<br />
-WSTool - http://wstool.sourceforge.net/<br/ >
-Web Hack Control Center (WHCC) - http://ussysadmin.com/whcc/<br/ >
+===Browser-based HTTP tampering / editing / replaying===
-Web Text Converter - http://www.microsoft.com/mspress/companion/0-7356-2187-X/<br/ >
+TamperIE - http://www.bayden.com/Other/<br />
-HackBar (Firefox Add-on) - https://addons.mozilla.org/firefox/3899/<br/ >
+isr-form - http://www.infobyte.com.ar/developments.html<br />
-Net-Force Tools (NF-Tools, Firefox Add-on) - http://www.net-force.nl/library/downloads/<br/ >
+Modify Headers (Firefox Add-on) - http://modifyheaders.mozdev.org/<br />
-PostIntercepter (Greasemonkey script) - http://userscripts.org/scripts/show/743<br/ >
+Tamper Data (Firefox Add-on) - http://tamperdata.mozdev.org/<br />
-<br/ >
+UrlParams (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1290/<br />
-<b>HTTP general testing / fingerprinting</b><br/ >
+TestGen4Web (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1385/<br />
-Wbox: HTTP testing tool - http://hping.org/wbox/<br/ >
+DOM Inspector / Inspect This (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1806/ https://addons.mozilla.org/en-US/firefox/addon/1913/<br />
-ht://Check - http://htcheck.sourceforge.net/<br/ >
+LiveHTTPHeaders / Header Monitor (Firefox Add-on) - http://livehttpheaders.mozdev.org/ https://addons.mozilla.org/en-US/firefox/addon/575/<br />
-Mumsie - http://www.lurhq.com/tools/mumsie.html<br/ >
-WebInject - http://www.webinject.org/<br/ >
+===Add-ons for Firefox that help with Javascript and Ajax web application security===
-Torture.pl Home Page - http://stein.cshl.org/~lstein/torture/<br/ >
+Selenium IDE - http://www.openqa.org/selenium-ide/<br />
-JoeDog's Seige - http://www.joedog.org/JoeDog/Siege/<br/ >
+Firebug - http://www.joehewitt.com/software/firebug/<br />
-OPEN-LABS: metoscan (http method testing) - http://www.open-labs.org/<br/ >
+Venkman - http://www.mozilla.org/projects/venkman/<br />
-Load-balancing detector - http://ge.mine.nu/lbd.html<br/ >
+Chickenfoot - http://groups.csail.mit.edu/uid/chickenfoot/<br />
-HMAP - http://ujeni.murkyroc.com/hmap/<br/ >
+Greasemonkey - http://www.greasespot.net/<br />
-Net-Square: httprint - http://net-square.com/httprint/<br/ >
+Greasemonkey compiler - http://www.letitblog.com/greasemonkey-compiler/<br />
-Wpoison: http stress testing - http://wpoison.sourceforge.net/<br/ >
+User script compiler - http://arantius.com/misc/greasemonkey/script-compiler<br />
-Net-square: MSNPawn - http://net-square.com/msnpawn/index.shtml<br/ >
+Extension Developer's Extension (Firefox Add-on) - http://ted.mielczarek.org/code/mozilla/extensiondev/<br />
-hcraft: HTTP Vuln Request Crafter - http://druid.caughq.org/projects/hcraft/<br/ >
+Smart Middle Click (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/3885/<br />
-rfp.labs: LibWhisker - http://www.wiretrip.net/rfp/lw.asp<br/ >
-Nikto - http://www.cirt.net/code/nikto.shtml<br/ >
+===Bookmarklets that aid in web application security===
-twill - http://twill.idyll.org/<br/ >
+RSnake's security bookmarklets - http://ha.ckers.org/bookmarklets.html<br />
-DirBuster - http://www.sittinglittleduck.com/DirBuster/<br/ >
+BMlets - http://optools.awardspace.com/bmlet.html<br />
-[ZIP] DFF Scanner - http://security-net.biz/files/dff/DFF.zip<br/ >
+Huge list of bookmarklets - http://www.squarefree.com/bookmarklets/<br />
-[ZIP] The Elza project - http://packetstormsecurity.org/web/elza-1.4.7-beta.zip http://www.stoev.org/elza.html<br/ >
+Blummy: consists of small widgets, called blummlets, which make use of Javascript to provide
-<br/ >
+rich functionality - http://www.blummy.com/<br />
-<b>Browser-based HTTP tampering / editing / replaying</b><br/ >
+Bookmarklets every blogger should have - http://www.micropersuasion.com/2005/10/bookmarklets_ev.html<br />
-TamperIE - http://www.bayden.com/Other/<br/ >
+Flat Bookmark Editing (Firefox Add-on) - http://n01se.net/chouser/proj/mozhack/<br />
-isr-form - http://www.infobyte.com.ar/developments.html<br/ >
+OpenBook and Update Bookmark (Firefox Add-ons) - http://www.chuonthis.com/extensions/<br />
-Modify Headers (Firefox Add-on) - http://modifyheaders.mozdev.org/<br/ >
-Tamper Data (Firefox Add-on) - http://tamperdata.mozdev.org/<br/ >
+===Footprinting for web application security===
-UrlParams (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1290/<br/ >
+Evolution - http://www.paterva.com/evolution-e.html<br />
-TestGen4Web (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1385/<br/ >
+GooSweep - http://www.mcgrewsecurity.com/projects/goosweep/<br />
-DOM Inspector / Inspect This (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1806/ https://addons.mozilla.org/en-US/firefox/addon/1913/<br/ >
+Aura: Google API Utility Tools - http://www.sensepost.com/research/aura/<br />
-LiveHTTPHeaders / Header Monitor (Firefox Add-on) - http://livehttpheaders.mozdev.org/ https://addons.mozilla.org/en-US/firefox/addon/575/<br/ >
+Edge-Security tools - http://www.edge-security.com/soft.php<br />
-<br/ >
+Fierce Domain Scanner - http://ha.ckers.org/fierce/<br />
-<b>Cookie editing / poisoning</b><br/ >
+Googlegath - http://www.nothink.org/perl/googlegath/<br />
-[TGZ] stompy: session id tool - http://lcamtuf.coredump.cx/stompy.tgz<br/ >
+Advanced Dork (Firefox Add-on) - https://addons.mozilla.org/firefox/2144/<br />
-Add'N Edit Cookies (AnEC, Firefox Add-on) - http://addneditcookies.mozdev.org/<br/ >
+Passive Cache (Firefox Add-on) - https://addons.mozilla.org/firefox/977/<br />
-CookieCuller (Firefox Add-on) - http://cookieculler.mozdev.org/<br/ >
+CacheOut! (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1453/<br />
-CookiePie (Firefox Add-on) - http://www.nektra.com/oss/firefox/extensions/cookiepie/<br/ >
+BugMeNot Extension (Firefox Add-on) - http://roachfiend.com/archives/2005/02/07/bugmenot/<br />
-CookieSpy - http://www.codeproject.com/shell/cookiespy.asp<br/ >
+TrashMail.net Extension (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1813/<br />
-Cookies Explorer - http://www.dutchduck.com/Features/Cookies.aspx<br/ >
+DiggiDig (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/2819/<br />
-<br/ >
+Digger (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1467/<br />
-<b>Ajax and XHR scanning</b><br/ >
-Sahi - http://sahi.co.in/<br/ >
+==Tools==
-scRUBYt - http://scrubyt.org/<br/ >
+===SSL certificate checking / scanning===
-jQuery - http://jquery.com/<br/ >
+SSL Labs - https://www.ssllabs.com/ssldb/<br />
-jquery-include - http://www.gnucitizen.org/projects/jquery-include<br/ >
+[ZIP] THCSSLCheck - http://thc.org/root/tools/THCSSLCheck.zip<br />
-Sprajax - http://www.denimgroup.com/sprajax.html<br/ >
+[ZIP] Foundstone SSLDigger - http://www.foundstone.com/us/resources/termsofuse.asp?file=ssldigger.zip<br />
-Watir - http://wtr.rubyforge.org/<br/ >
+Cert Viewer Plus (Firefox Add-on) - https://addons.mozilla.org/firefox/1964/<br />
-RBNarcissus - http://idontsmoke.co.uk/2005/rbnarcissus/<br/ >
+testssl.sh - http://drwetter.eu/software/ssl/<br />
-SpiderTest (Spider Fuzz plugin) - http://blog.caboo.se/articles/2007/2/21/the-fabulous-spider-fuzz-plugin<br/ >
+[[O-Saft]] - OWASP SSL audit for testers: list information about and test remote SSL certificate and connection [https://github.com/OWASP/O-Saft/archive/master.zip Download] <br />
-Firebug Lite - http://www.getfirebug.com/lite.html<br/ >
-firewaitr - http://code.google.com/p/firewatir/<br/ >
+===HTTP proxying / editing===
-<br/ >
+WebScarab - http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project<br />
-<b>RSS extensions and caching</b><br>
+Burp Suite - http://www.portswigger.net/<br />
-LiveLines (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/324/<br/ >
+Paros - http://www.parosproxy.org/<br />
-rss-cache - http://www.dubfire.net/chris/projects/rss-cache/<br/ >
+Paros fork #1: Zed Attack Proxy (ZAP) - http://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project<br />
-<br/ >
+Paros fork #2: Andiparos - http://code.google.com/p/andiparos/<br />
-<b>SQL injection scanning</b><br/ >
+Fiddler - http://www.fiddlertool.com/<br />
-x90.org: home of Absinthe, Mezcal, etc - http://0x90.org/releases.php<br/ >
+Web Proxy Editor - http://www.microsoft.com/mspress/companion/0-7356-2187-X/<br />
-SQLiX - http://www.owasp.org/index.php/Category:OWASP_SQLiX_Project<br/ >
+Pantera - http://www.owasp.org/index.php/Category:OWASP_Pantera_Web_Assessment_Studio_Project<br />
-sqlninja: a SQL Server injection and takover tool - http://sqlninja.sourceforge.net/<br/ >
+Suru - http://www.sensepost.com/research/suru/<br />
-JustinClarke's SQL Brute - http://www.justinclarke.com/archives/2006/03/sqlbrute.html<br/ >
+httpedit (curses-based) - http://www.neutralbit.com/en/rd/httpedit/<br />
-BobCat - http://www.northern-monkee.co.uk/projects/bobcat/bobcat.html<br/ >
+Charles - http://www.xk72.com/charles/<br />
-sqlmap - http://sqlmap.sourceforge.net/<br/ >
+Odysseus - http://www.bindshell.net/tools/odysseus<br />
-Scully: SQL Server DB Front-End and Brute-Forcer - http://www.sensepost.com/research/scully/<br/ >
+Burp, Paros, and WebScarab for Mac OS X - http://www.corsaire.com/downloads/<br />
-FG-Injector - http://www.flowgate.net/?lang=en&seccion=herramientas<br/ >
+Web-application scanning tool from `Network Security Tools'/O'Reilly - http://examples.oreilly.com/networkst/<br />
-PRIAMOS - http://www.priamos-project.com/<br/ >
+JS Commander - http://jscmd.rubyforge.org/<br />
-<br/ >
+Ratproxy - http://code.google.com/p/ratproxy/<br />
-<b>Web application security malware, backdoors, and evil code</b><br/ >
+Arachni - https://github.com/Zapotek/arachni/<br />
-W3AF: Web Application Attack and Audit Framework - http://w3af.sourceforge.net/<br/ >
+WATOBO - http://watobo.sourceforge.net/<br />
-Jikto - http://busin3ss.name/jikto-in-the-wild/<br/ >
-XSS Shell - http://ferruh.mavituna.com/article/?1338<br/ >
+==RSnake's XSS cheat sheet based-tools, webapp fuzzing, and encoding tools==
-XSS-Proxy - http://xss-proxy.sourceforge.net<br/ >
+Wfuzz - http://www.edge-security.com/wfuzz.php<br />
-AttackAPI - http://www.gnucitizen.org/projects/attackapi/<br/ >
+ProxMon - http://www.isecpartners.com/proxmon.html<br />
-FFsniFF - http://azurit.elbiahosting.sk/ffsniff/<br/ >
+Wapiti - http://wapiti.sourceforge.net/<br />
-HoneyBlog's web-based junkyard - http://honeyblog.org/junkyard/web-based/<br/ >
+Grabber - http://rgaucher.info/beta/grabber/<br />
-BeEF - http://www.bindshell.net/tools/beef/<br/ >
+XSSScan - http://darkcode.ath.cx/scanners/XSSscan.py<br />
-Firefox Extension Scanner (FEX) - http://www.gnucitizen.org/projects/fex/<br/ >
+CAL9000 - http://www.owasp.org/index.php/Category:OWASP_CAL9000_Project<br />
-What is my IP address? - http://reglos.de/myaddress/<br/ >
+EnDe - http://www.owasp.org/index.php/Category:OWASP_EnDe<br />
-xRumer: blogspam automation tool - http://www.botmaster.net/movies/XFull.htm<br/ >
+HTMangLe - http://www.fishnetsecurity.com/Tools/HTMangLe/publish.htm<br />
-SpyJax - http://www.merchantos.com/makebeta/tools/spyjax/<br/ >
+JBroFuzz - http://www.owasp.org/index.php/JBroFuzz<br />
-Greasecarnaval - http://www.gnucitizen.org/projects/greasecarnaval<br/ >
+J-Baah - http://www.sensepost.com/labs/tools/pentest/j-baah<br />
-Technika - http://www.gnucitizen.org/projects/technika/<br/ >
+XSSFuzz - http://ha.ckers.org/blog/20060921/xssfuzz-released/<br />
-Load-AttackAPI bookmarklet - http://www.gnucitizen.org/projects/load-attackapi-bookmarklet<br/ >
+WhiteAcid's XSS Assistant - http://www.whiteacid.org/greasemonkey/<br />
-MD's Projects: JS port scanner, pinger, backdoors, etc - http://michaeldaw.org/my-projects/<br/ >
+Overlong UTF - http://www.microsoft.com/mspress/companion/0-7356-2187-X/<br />
-<br/ >
+[TGZ] MielieTool (SensePost Research) - http://packetstormsecurity.org/UNIX/utilities/mielietools-v1.0.tgz<br />
-<b>Web application services that aid in web application security assessment</b><br/ >
+RegFuzzer: test your regular expression filter - http://rgaucher.info/b/index.php/post/2007/05/26/RegFuzzer%3A-Test-your-regular-expression-filter<br />
-Netcraft - http://www.netcraft.net<br/ >
+screamingCobra - http://www.dachb0den.com/projects/screamingcobra.html<br />
-AboutURL - http://www.abouturl.com/<br/ >
+SPIKE and SPIKE Proxy - http://immunitysec.com/resources-freesoftware.shtml<br />
-net.toolkit - http://clez.net/<br/ >
+RFuzz - http://rfuzz.rubyforge.org/<br />
-ServerSniff - http://www.serversniff.net/<br/ >
+WebFuzz - http://www.codebreakers-journal.com/index.php?option=com_content&task=view&id=112&Itemid=99999999<br />
-Online Microsoft script decoder - http://www.greymagic.com/security/tools/decoder/<br/ >
+TestMaker - http://www.pushtotest.com/Docs/downloads/features.html<br />
-Webmaster-Toolkit - http://www.webmaster-toolkit.com/<br/ >
+ASP Auditor - http://michaeldaw.org/projects/asp-auditor-v2/<br />
-myIPNeighbbors, et al - http://digg.com/security/MyIPNeighbors_Find_Out_Who_Else_is_Hosted_on_Your_Site_s_IP_Address<br/ >
+WSTool - http://wstool.sourceforge.net/<br />
-PHP charset encoding - http://h4k.in/encoding<br/ >
+Web Hack Control Center (WHCC) - http://ussysadmin.com/whcc/<br />
-data: URL testcases - http://h4k.in/dataurl<br/ >
+Web Text Converter - http://www.microsoft.com/mspress/companion/0-7356-2187-X/<br />
-<br/ >
+HackBar (Firefox Add-on) - https://addons.mozilla.org/firefox/3899/<br />
-<b>Browser-based security fuzzing / checking</b><br/ >
+Net-Force Tools (NF-Tools, Firefox Add-on) - http://www.net-force.nl/library/downloads/<br />
-Zalewski's MangleMe - http://lcamtuf.coredump.cx/mangleme/mangle.cgi<br/ >
+PostIntercepter (Greasemonkey script) - http://userscripts.org/scripts/show/743<br />
-hdm's tools: Hamachi, CSSDIE, DOM-Hanoi, AxMan - http://metasploit.com/users/hdm/tools/<br/ >
+fuzzdb - https://code.google.com/p/fuzzdb/<br />
-Peach Fuzzer Framework - http://peachfuzz.sourceforge.net/<br/ >
-TagBruteForcer - http://research.eeye.com/html/tools/RT20060801-3.html<br/ >
+===HTTP general testing / fingerprinting===
-PROTOS Test-Suite: c05-http-reply - http://www.ee.oulu.fi/research/ouspg/protos/testing/c05/http-reply/index.html<br/ >
+Wbox: HTTP testing tool - http://hping.org/wbox/<br />
-COMRaider - http://labs.idefense.com<br/ >
+ht://Check - http://htcheck.sourceforge.net/<br />
-bcheck - http://bcheck.scanit.be/bcheck/<br/ >
+WebInject - http://www.webinject.org/<br />
-Stop-Phishing: Projects page - http://www.indiana.edu/~phishing/?projects<br/ >
+Torture.pl Home Page - http://stein.cshl.org/~lstein/torture/<br />
-LinkScanner - http://linkscanner.explabs.com/linkscanner/default.asp<br/ >
+JoeDog's Seige - http://www.joedog.org/JoeDog/Siege/<br />
-BrowserCheck - http://www.heise-security.co.uk/services/browsercheck/<br/ >
+OPEN-LABS: metoscan (http method testing) - http://www.open-labs.org/<br />
-Cross-browser Exploit Tests - http://www.jungsonnstudios.com/cool.php<br/ >
+Load-balancing detector - http://ge.mine.nu/lbd.html<br />
-Stealing information using DNS pinning demo - http://www.jumperz.net/index.php?i=2&a=1&b=7<br/ >
+HMAP - http://ujeni.murkyroc.com/hmap/<br />
-Javascript Website Login Checker - http://ha.ckers.org/weird/javascript-website-login-checker.html<br/ >
+Net-Square: httprint - http://net-square.com/httprint/<br />
-Mozilla Activex - http://www.iol.ie/~locka/mozilla/mozilla.htm<br/ >
+Wpoison: http stress testing - http://wpoison.sourceforge.net/<br />
-Jungsonn's Black Dragon Project - http://blackdragon.jungsonnstudios.com/<br/ >
+Net-square: MSNPawn - http://net-square.com/msnpawn/index.shtml<br />
-Mr. T (Master Recon Tool, includes Read Firefox Settings PoC) - http://ha.ckers.org/mr-t/<br/ >
+hcraft: HTTP Vuln Request Crafter - http://druid.caughq.org/projects/hcraft/<br />
-Vulnerable Adobe Plugin Detection For UXSS PoC - http://www.0x000000.com/?i=324<br/ >
+rfp.labs: LibWhisker - http://www.wiretrip.net/rfp/lw.asp<br />
-About Flash: is your flash up-to-date? - http://www.macromedia.com/software/flash/about/<br/ >
+Nikto - http://www.cirt.net/code/nikto.shtml<br />
-Test your installation of Java software - http://java.com/en/download/installed.jsp?detect=jre&try=1<br/ >
+Websecurify - http://www.websecurify.com<br />
-<br/ >
+W3AF: Web Application Attack and Audit Framework - http://w3af.sourceforge.net/<br />
-<b>PHP static analysis and file inclusion scanning</b><br/ >
+twill - http://twill.idyll.org/<br />
-PHP-SAT.org: Static analysis for PHP - http://www.program-transformation.org/PHP/<br/ >
+DirBuster - http://www.owasp.org/index.php/Category:OWASP_DirBuster_Project<br />
-Unl0ck Research Team: tool for searching in google for include bugs - http://unl0ck.net/tools.php
+[ZIP] DFF Scanner - http://security-net.biz/files/dff/DFF.zip<br />
-<br/ >
+[ZIP] The Elza project - http://packetstormsecurity.org/web/elza-1.4.7-beta.zip ([http://www.stoev.org/elza.html dead link])<br />
-FIS: File Inclusion Scanner - http://www.segfault.gr/index.php?cat_id=3&cont_id=25<br/>
+HackerFox and Hacking Addons Bundled: Portable Firefox with web hacking addons bundled - http://sf.net/projects/hackfox <br />
-PHPSecAudit - http://developer.spikesource.com/projects/phpsecaudit<br/ >
-<br/ >
+===== dead, vanished links (March/2012) =====
-<b>Web Application Firewall (WAF) and Intrusion Detection (APIDS) rules and resources</b><br/ >
+Mumsie - http://www.secureworks.com/research/tools/mumsie/ ([http://www.lurhq.com/tools/mumsie.html dead link])<br />
-APIDS on Wikipedia - http://en.wikipedia.org/wiki/APIDS<br/ >
+Torture.pl Home Page - source probably here http://www.foo.be/docs/tpj/issues/vol2_4/tpj0204-0002.html ([http://stein.cshl.org/~lstein/torture/ dead link])<br />
-PHP Intrusion Detection System (PHP-IDS) - http://php-ids.org/ http://code.google.com/p/phpids/<br/ >
-dotnetids - http://code.google.com/p/dotnetids/<br/ >
+===Cookie editing / poisoning===
-Secure Science InterScout - http://www.securescience.com/home/newsandevents/news/interscout1.0.html<br/ >
+[TGZ] stompy: session id tool - http://freecode.com/projects/stompy ([http://lcamtuf.coredump.cx/stompy.tgz old link])<br />
-Remo: whitelist rule editor for mod_security - http://remo.netnea.com/<br/ >
+Add'N Edit Cookies (AnEC, Firefox Add-on) - http://addneditcookies.mozdev.org/<br />
-GotRoot: ModSecuirty rules - http://www.gotroot.com/tiki-index.php?page=mod_security+rules<br/ >
+CookieCuller (Firefox Add-on) - http://cookieculler.mozdev.org/<br />
-The Web Security Gateway (WSGW) - http://wsgw.sourceforge.net/<br/ >
+CookiePie (Firefox Add-on) - http://www.nektra.com/oss/firefox/extensions/cookiepie/<br />
-mod_security rules generator - http://noeljackson.com/tools/modsecurity/<br/ >
+CookieSpy - http://www.codeproject.com/shell/cookiespy.asp<br />
-Mod_Anti_Tamper - http://www.wisec.it/projects.php?id=3<br/ >
+Cookies Explorer - http://www.dutchduck.com/Features/Cookies.aspx<br />
-[TGZ] Automatic Rules Generation for Mod_Security - http://www.wisec.it/rdr.php?fn=/Projects/Rule-o-matic.tgz<br/ >
+Cookie Safe - https://addons.mozilla.org/de/firefox/addon/2497/ <br />
-AQTRONIX WebKnight - http://www.aqtronix.com/?PageID=99<br/ >
-Akismet: blog spam defense - http://akismet.com/<br/ >
+==Fuzzer==
-Samoa: Formal tools for securing web services - http://research.microsoft.com/projects/samoa/<br/ >
+===Browser-based security fuzzing / checking===
-<br/ >
+Zalewski's MangleMe - http://freecode.com/projects/mangleme tool see here http://lcamtuf.coredump.cx/soft/mangleme.tgz ([http://lcamtuf.coredump.cx/mangleme/mangle.cgi mangle.cgi dead link]) <br />
-<b>Web services enumeration / scanning / fuzzing</b><br/ >
+hdm's tools: Hamachi, CSSDIE, DOM-Hanoi, AxMan - http://metasploit.com/users/hdm/tools/<br />
-WebServiceStudio2.0 - http://www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=65a1d4ea-0f7a-41bd-8494-e916ebc4159c<br/ >
+Peach Fuzzer Framework - http://peachfuzzer.com/  ([http://peachfuzz.sourceforge.net old link])/<br />
-Net-square: wsChess - http://net-square.com/wschess/index.shtml<br/ >
+TagBruteForcer - http://research.eeye.com/html/tools/RT20060801-3.html<br />
-WSFuzzer - http://www.owasp.org/index.php/Category:OWASP_WSFuzzer_Project<br/ >
+PROTOS Test-Suite: c05-http-reply - http://www.ee.oulu.fi/research/ouspg/protos/testing/c05/http-reply/index.html<br />
-SIFT: web method search tool - http://www.sift.com.au/73/171/sift-web-method-search-tool.htm<br/ >
+COMRaider - https://github.com/dzzie/COMRaider ([http://labs.idefense.com dead link])<br />
-iSecPartners: WSMap, WSBang, etc - http://www.isecpartners.com/tools.html<br/ >
+BrowserCheck - http://www.heise-security.co.uk/services/browsercheck/<br />
-<br/ >
+Stealing information using DNS pinning demo - http://www.jumperz.net/index.php?i=2&a=1&b=7<br />
-<b>Web application non-specific static source-code analysis</b><br/ >
+Javascript Website Login Checker - http://ha.ckers.org/weird/javascript-website-login-checker.html<br />
-Pixy: a static analysis tool for detecting XSS vulnerabilities - http://www.seclab.tuwien.ac.at/projects/pixy/<br/ >
+Mozilla Activex - http://www.adamlock.com/mozilla/ ([http://www.iol.ie/~locka/mozilla/mozilla.htm old link])<br />
-Brixoft.Net: Source Edit - http://www.brixoft.net/prodinfo.asp?id=1<br/ >
+Mr. T (Master Recon Tool, includes Read Firefox Settings PoC) - http://ha.ckers.org/mr-t/<br />
-Security compass web application auditing tools (SWAAT) - http://www.owasp.org/index.php/Category:OWASP_SWAAT_Project<br/ >
+Test your installation of Java software - http://java.com/en/download/installed.jsp?detect=jre&try=1<br />
-An even more complete list here - http://www.cs.cmu.edu/~aldrich/courses/654/tools/<br/ >
+WebPageFingerprint - Light-weight Greasemonkey Fuzzer - http://userscripts.org/scripts/show/30285<br />
-A nice list that claims some demos available - http://www.cs.cmu.edu/~aldrich/courses/413/tools.html<br/ >
-A smaller, but also good list - http://spinroot.com/static/<br/ >
+===== dead, vanished links (March/2012) =====
-<br/ >
+bcheck - http://bcheck.scanit.be/bcheck/<br />
-<b>Static analysis for C/C++ (CGI, ISAPI, etc) in web applications</b><br/ >
+Cross-browser Exploit Tests - http://www.jungsonnstudios.com/cool.php<br />
-RATS - http://www.securesoftware.com/resources/download_rats.html<br/ >
+Jungsonn's Black Dragon Project - http://blackdragon.jungsonnstudios.com/<br />
-ITS4 - http://www.cigital.com/its4/<br/ >
+Vulnerable Adobe Plugin Detection For UXSS PoC - http://www.0x000000.com/?i=324<br />
-FlawFinder - http://www.dwheeler.com/flawfinder/<br/ >
+About Flash: is your flash up-to-date? - http://www.macromedia.com/software/flash/about/<br />
-Splint - http://www.splint.org/<br/ >
+Stop-Phishing: Projects page - http://www.indiana.edu/~phishing/?projects<br />
-Uno - http://spinroot.com/uno/<br/ >
+LinkScanner - <nowiki>http://linkscanner.explabs.com/linkscanner/default.asp</nowiki> (seems to be a vendor link now)<br />
-BOON (Buffer Overrun detectiON) - http://www.cs.berkeley.edu/~daw/boon/ http://boon.sourceforge.net<br/ >
-Valgrind - http://www.valgrind.org/<br/ >
+===Application and protocol fuzzing (random instead of targeted)===
-<br/ >
+Sulley - http://fuzzing.org/<br />
-<b>Java static analysis, security frameworks, and web application security tools</b><br/ >
+taof: The Art of Fuzzing - http://sourceforge.net/projects/taof/<br />
-HDIV Struts - http://hdiv.org/<br/ >
+zzuf: multipurpose fuzzer - http://sam.zoy.org/zzuf/<br />
-Orizon - http://sourceforge.net/projects/orizon/<br/ >
+autodafé: an act of software torture - http://autodafe.sourceforge.net/<br />
-FindBugs: Find bugs in Java programs - http://findbugs.sourceforge.net/<br/ >
-PMD - http://pmd.sourceforge.net/<br/ >
+===== dead, vanished links (March/2012) =====
-CUTE: A Concolic Unit Testing Engine for C and Java - http://osl.cs.uiuc.edu/~ksen/cute/<br/ >
+EFS and GPF: Evolutionary Fuzzing System - http://www.appliedsec.com/resources.html<br />
-EMMA - http://emma.sourceforge.net/<br/ >
-JLint - http://jlint.sourceforge.net/<br/ >
+==Ajax and XHR scanning==
-Java PathFinder - http://javapathfinder.sourceforge.net/<br/ >
+Sahi - http://sahi.co.in/<br />
-Fujaba: Move between UML and Java source code - http://wwwcs.uni-paderborn.de/cs/fujaba/<br/ >
+scRUBYt - http://scrubyt.org/<br />
-Checkstyle - http://checkstyle.sourceforge.net/<br/ >
+jQuery - http://jquery.com/<br />
-Cookie Revolver Security Framework - http://sourceforge.net/projects/cookie-revolver<br/ >
+jquery-include - http://www.gnucitizen.org/projects/jquery-include<br />
-tinapoc - http://sourceforge.net/projects/tinapoc<br/ >
+Sprajax - http://www.denimgroup.com/sprajax.html<br />
-jarsigner - http://java.sun.com/j2se/1.5.0/docs/tooldocs/solaris/jarsigner.html<br/ >
+Watir - http://wtr.rubyforge.org/<br />
-Solex - http://solex.sourceforge.net/<br/ >
+Watij - http://watij.com/<br />
-Java Explorer - http://metal.hurlant.com/jexplore/<br/ >
+Watin - http://watin.sourceforge.net/<br />
-HTTPClient - http://www.innovation.ch/java/HTTPClient/<br/ >
+RBNarcissus - http://idontsmoke.co.uk/2005/rbnarcissus/<br />
-another HttpClient - http://jakarta.apache.org/commons/httpclient/<br/ >
+SpiderTest (Spider Fuzz plugin) - http://blog.caboo.se/articles/2007/2/21/the-fabulous-spider-fuzz-plugin<br />
-a list of code coverage and analysis tools for Java - http://mythinkpond.blogspot.com/2007/06/java-foss-freeopen-source-software.html<br/ >
+Javascript Inline Debugger (jasildbg) - http://jasildbg.googlepages.com/<br />
-<br/ >
+Firebug Lite - http://www.getfirebug.com/lite.html<br />
-<b>Microsoft .NET static analysis and security framework tools, mostly for ASP.NET and ASP.NET AJAX, but also C# and VB.NET</b><br/ >
+firewaitr - http://code.google.com/p/firewatir/<br />
-Orcas - http://msdn.microsoft.com/vstudio/express/future/downloads/default.aspx<br/ >
-Web Development Helper - http://www.nikhilk.net/Project.WebDevHelper.aspx<br/ >
+==SQL injection scanning==
-FxCop - http://blogs.msdn.com/fxcop/ http://www.gotdotnet.com/team/fxcop/<br/ >
+x90.org: home of Absinthe, Mezcal, etc - http://0x90.org/releases.php<br />
-Microsoft Application Verifier - http://www.microsoft.com/technet/prodtechnol/windows/appcompatibility/appverifier.mspx<br/ >
+SQLiX - http://www.owasp.org/index.php/Category:OWASP_SQLiX_Project<br />
-Microsoft internal tools you can't have yet - http://www.microsoft.com/windows/cse/pa_projects.mspx http://research.microsoft.com/Pex/ http://www.owasp.org/images/5/5b/OWASP_IL_7_FuzzGuru.pdf<br/ >
+sqlninja: a SQL Server injection and takover tool - http://sqlninja.sourceforge.net/<br />
-<br/ >
+JustinClarke's SQL Brute - http://www.justinclarke.com/archives/2006/03/sqlbrute.html<br />
-<b>Threat modeling</b><br/ >
+BobCat - http://www.northern-monkee.co.uk/projects/bobcat/bobcat.html<br />
-Microsoft Threat Analysis and Modeling Tool v2.1 (TAM) - http://www.microsoft.com/downloads/details.aspx?FamilyID=59888078-9daf-4e96-b7d1-944703479451&displaylang=en<br/ >
+sqlmap - http://sqlmap.sourceforge.net/<br />
-Amenaza: Attack Tree Modeling (SecurITree) - http://www.amenaza.com/software.php<br/ >
+Scully: SQL Server DB Front-End and Brute-Forcer - http://www.sensepost.com/research/scully/<br />
-Octotrike - http://www.octotrike.org/<br/ >
+FG-Injector - http://www.flowgate.net/?lang=en&seccion=herramientas<br />
-<br/ >
+PRIAMOS - http://www.priamos-project.com/<br />
-<b>Add-ons for Firefox that help with general web application security</b><br/ >
-Web Developer Toolbar - https://addons.mozilla.org/firefox/60/<br/ >
+==Web services enumeration / scanning / fuzzing==
-Plain Old Webserver (POW) - https://addons.mozilla.org/firefox/3002/<br/ >
+WebServiceStudio2.0 - http://www.codeplex.com/WebserviceStudio<br />
-XML Developer Toolbar - https://addons.mozilla.org/firefox/2897/<br/ >
+Net-square: wsChess - http://net-square.com/wschess/index.shtml<br />
-Public Fox - https://addons.mozilla.org/firefox/3911/<br/ >
+WSFuzzer - http://www.owasp.org/index.php/Category:OWASP_WSFuzzer_Project<br />
-XForms Buddy - http://beaufour.dk/index.php?sec=misc&pagename=xforms<br/ >
+SIFT: web method search tool - http://www.sift.com.au/73/171/sift-web-method-search-tool.htm<br />
-MR Tech Local Install - http://www.mrtech.com/extensions/local_install/<br/ >
+iSecPartners: WSMap, WSBang, etc - http://www.isecpartners.com/tools.html<br />
-Nightly Tester Tools - http://users.blueprintit.co.uk/~dave/web/firefox/buildid/index.html<br/ >
-IE Tab - https://addons.mozilla.org/firefox/1419/<br/ >
+==3rd party services that aid in web application security assessment==
-User-Agent Switcher - https://addons.mozilla.org/firefox/59/<br/ >
+Netcraft - http://www.netcraft.net<br />
-ServerSwitcher - https://addons.mozilla.org/firefox/2409/<br/ >
+AboutURL - http://www.abouturl.com/<br />
-HeaderMonitor - https://addons.mozilla.org/firefox/575/<br/ >
+The Scrutinizer - http://www.scrutinizethis.com/<br />
-RefControl - https://addons.mozilla.org/firefox/953/<br/ >
+net.toolkit - http://clez.net/<br />
-refspoof - https://addons.mozilla.org/firefox/667/<br/ >
+ServerSniff - http://www.serversniff.net/<br />
-No-Referrer - https://addons.mozilla.org/firefox/1999/<br/ >
+Online Microsoft script decoder - http://www.greymagic.com/security/tools/decoder/<br />
-LocationBar^2 - https://addons.mozilla.org/firefox/4014/<br/ >
+Webmaster-Toolkit - http://www.webmaster-toolkit.com/<br />
-SpiderZilla - http://spiderzilla.mozdev.org/<br/ >
+myIPNeighbbors, et al - http://digg.com/security/MyIPNeighbors_Find_Out_Who_Else_is_Hosted_on_Your_Site_s_IP_Address<br />
-Slogger - https://addons.mozilla.org/en-US/firefox/addon/143<br/ >
+PHP charset encoding - http://h4k.in/encoding<br />
-Fire Encrypter - https://addons.mozilla.org/firefox/3208/<br/ >
+data: URL testcases - http://h4k.in/dataurl<br />
-<br/ >
-<b>Add-ons for Firefox that help with Javascript and Ajax web application security</b><br/ >
-Selenium IDE - http://www.openqa.org/selenium-ide/<br/ >
+=Server side stuff=
-Firebug - http://www.joehewitt.com/software/firebug/<br/ >
+==PHP static analysis and file inclusion scanning==
-Venkman - http://www.mozilla.org/projects/venkman/<br/ >
+Pixy: Open source flow based discovery of XSS and SQLi - http://pixybox.seclab.tuwien.ac.at/pixy/<br />
-Chickenfoot - http://groups.csail.mit.edu/uid/chickenfoot/<br/ >
+PHP-SAT.org: Static analysis for PHP - http://www.program-transformation.org/PHP/<br />
-Greasemonkey - http://www.greasespot.net/<br/ >
+Unl0ck Research Team: tool for searching in google for include bugs - http://unl0ck.net/tools.php<br />
-Greasemonkey compiler - http://www.letitblog.com/greasemonkey-compiler/<br/ >
+FIS: File Inclusion Scanner - http://www.segfault.gr/index.php?cat_id=3&cont_id=25<br />
-User script compiler - http://arantius.com/misc/greasemonkey/script-compiler<br/ >
+PHPSecAudit - http://developer.spikesource.com/projects/phpsecaudit<br />
-RSnake's security bookmarklets - http://ha.ckers.org/bookmarklets.html<br/ >
-BMlets - http://optools.awardspace.com/bmlet.html<br/ >
+==PHP Defensive Tools==
-Huge list of bookmarklets - http://www.squarefree.com/bookmarklets/<br/ >
+PHPInfoSec - Check phpinfo configuration for security - http://phpsec.org/projects/phpsecinfo/ <br />
-<br/ >
+Greasemonkey Replacement can be found at http://yehg.net/lab/#tools.greasemonkey <br />
-<b>SSL certificate checking / scanning</b><br/ >
+Php-Brute-Force-Attack Detector - Detect your web servers being scanned by brute force tools - http://yehg.net/lab/pr0js/files.php/php_brute_force_detect.zip <br />
-[ZIP] THCSSLCheck - http://thc.org/root/tools/THCSSLCheck.zip<br/ >
+PHP-Login-Info-Checker (Strictly enforce admins/users to select stronger passwords via url loginfo_checker.php?testlic) - http://yehg.net/lab/pr0js/files.php/loginfo_checkerv0.1.zip, http://yehg.net/lab/pr0js/files.php/phploginfo_checker_demo.zip <br />
-[ZIP] Foundstone SSLDigger - http://foundstone.com/resources/freetooldownload.htm?file=ssldigger.zip<br/ >
+php-DDOS-Shield (prevent idiot distributed bots which discontinue their flooding attacks by identifying HTTP 503 header code) - http://code.google.com/p/ddos-shield/ <br />
-Cert Viewer Plus (Firefox Add-on) - https://addons.mozilla.org/firefox/1964/<br/ >
+PHPMySpamFIGHTER - http://yehg.net/lab/pr0js/files.php/phpmyspamfighter.zip, http://yehg.net/lab/pr0js/files.php/phpMySpamFighter_demo.rar <br />
-<br/ >
-<b>Honeyclients, Web Application, and Web Proxy honeypots</b><br/ >
+==Web Application Firewall (WAF) and Intrusion Detection (APIDS) rules and resources==
-HoneyC: the low-interaction honeyclient - http://honeyc.sourceforge.net/<br/ >
+APIDS on Wikipedia - http://en.wikipedia.org/wiki/APIDS<br />
-Capture: a high-interaction honeyclient - http://capture-hpc.sourceforge.net/<br/ >
+PHP Intrusion Detection System (PHP-IDS) - http://php-ids.org/ http://code.google.com/p/phpids/<br />
-Google Hack Honeypot - http://ghh.sourceforge.net/<br/ >
+dotnetids - http://code.google.com/p/dotnetids/<br />
-PHP.Hop - PHP Honeynet Project - http://www.rstack.org/phphop/<br/ >
+Secure Science InterScout - http://www.securescience.com/home/newsandevents/news/interscout1.0.html<br />
-SpyBye - http://www.monkey.org/~provos/spybye/<br/ >
+Remo: whitelist rule editor for mod_security - http://remo.netnea.com/<br />
-Honeytokens - http://www.securityfocus.com/infocus/1713<br/ >
+GotRoot: ModSecuirty rules - http://www.gotroot.com/tiki-index.php?page=mod_security+rules<br />
-<br/ >
+The Web Security Gateway (WSGW) - http://wsgw.sourceforge.net/<br />
-<b>Blackhat SEO and maybe some whitehat SEO</b><br/ >
+mod_security rules generator - http://noeljackson.com/tools/modsecurity/<br />
-SearchStatus (Firefox Add-on) - http://www.quirk.biz/searchstatus/<br/ >
+Mod_Anti_Tamper - http://www.wisec.it/projects.php?id=3<br />
-SEO for Firefox (Firefox Add-on) - http://tools.seobook.com/firefox/seo-for-firefox.html<br/ >
+[TGZ] Automatic Rules Generation for Mod_Security - http://www.wisec.it/rdr.php?fn=/Projects/Rule-o-matic.tgz<br />
-<br/ >
+AQTRONIX WebKnight - http://www.aqtronix.com/?PageID=99<br />
-<b>Footprinting for web application security</b><br/ >
+Akismet: blog spam defense - http://akismet.com/<br />
-Evolution - http://www.paterva.com/evolution-e.html<br/ >
+Samoa: Formal tools for securing web services - http://research.microsoft.com/projects/samoa/<br />
-GooSweep - http://www.mcgrewsecurity.com/projects/goosweep/<br/ >
-Aura: Google API Utility Tools - http://www.sensepost.com/research/aura/<br/ >
-Edge-Security tools - http://www.edge-security.com/soft.php<br/ >
+=Code=
-Fierce Domain Scanner - http://ha.ckers.org/fierce/<br/ >
+==Web application non-specific static source-code analysis==
-Googlegath - http://www.nothink.org/perl/googlegath/<br/ >
+Pixy: a static analysis tool for detecting XSS vulnerabilities - http://www.seclab.tuwien.ac.at/projects/pixy/<br />
-Advanced Dork (Firefox Add-on) - https://addons.mozilla.org/firefox/2144/<br/ >
+Brixoft.Net: Source Edit - http://www.brixoft.net/prodinfo.asp?id=1<br />
-Passive Cache (Firefox Add-on) - https://addons.mozilla.org/firefox/977/<br/ >
+Security compass web application auditing tools (SWAAT) - http://www.owasp.org/index.php/Category:OWASP_SWAAT_Project<br />
-CacheOut! (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1453/<br/ >
+An even more complete list here - http://www.cs.cmu.edu/~aldrich/courses/654/tools/<br />
-BugMeNot Extension (Firefox Add-on) - http://roachfiend.com/archives/2005/02/07/bugmenot/<br/ >
+A nice list that claims some demos available - http://www.cs.cmu.edu/~aldrich/courses/413/tools.html<br />
-TrashMail.net Extension (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1813/<br/ >
+A smaller, but also good list - http://spinroot.com/static/<br />
-DiggiDig (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/2819<br/ >
+Yasca: A highly extensible source code analysis framework; incorporates several analysis tools into one package. http://www.yasca.org/<br />
-<br/ >
-<b>Database security assessment</b><br/ >
+==Static analysis for C/C++ (CGI, ISAPI, etc) in web applications==
-Scuba by Imperva Database Vulnerability Scanner - http://www.imperva.com/scuba/<br/ >
+RATS - http://www.securesoftware.com/resources/download_rats.html<br />
-<br/ >
+ITS4 - http://www.cigital.com/its4/<br />
-<b>Browser Defenses</b><br/ >
+FlawFinder - http://www.dwheeler.com/flawfinder/<br />
-DieHard - http://www.diehard-software.org/<br/ >
+Splint - http://www.splint.org/<br />
-LocalRodeo (Firefox Add-on) - http://databasement.net/labs/localrodeo/<br/ >
+Uno - http://spinroot.com/uno/<br />
-NoMoXSS - http://www.seclab.tuwien.ac.at/projects/jstaint/<br/ >
+BOON (Buffer Overrun detectiON) - http://www.cs.berkeley.edu/~daw/boon/ http://boon.sourceforge.net<br />
-Request Rodeo - http://savannah.nongnu.org/projects/requestrodeo<br/ >
+Valgrind - http://www.valgrind.org/<br />
-FlashBlock (Firefox Add-on) - http://flashblock.mozdev.org/<br/ >
-CookieSafe (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/2497<br/ >
+==Java static analysis, security frameworks, and web application security tools==
-NoScript (Firefox Add-on) - http://www.noscript.net/<br/ >
+LAPSE - http://suif.stanford.edu/~livshits/work/lapse/ <br />
-FormFox (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1579/<br/ >
+CodePro Analytix - http://code.google.com/webtoolkit/tools/codepro/doc/index.html<br />
-Adblock (Firefox Add-on) - http://adblock.mozdev.org/<br/ >
+HDIV Struts - http://hdiv.org/<br />
-httpOnly in Firefox (Firefox Add-on) - http://blog.php-security.org/archives/40-httpOnly-Cookies-in-Firefox-2.0.html<br/ >
+Orizon - http://sourceforge.net/projects/orizon/<br />
-SafeCache (Firefox Add-on) - http://www.safecache.com/<br/ >
+FindBugs: Find bugs in Java programs - http://findbugs.sourceforge.net/<br />
-SafeHistory (Firefox Add-on) - http://www.safehistory.com/<br/ >
+PMD - http://pmd.sourceforge.net/<br />
-PrefBar (Firefox Add-on) - http://prefbar.mozdev.org/<br/ >
+CUTE: A Concolic Unit Testing Engine for C and Java - http://osl.cs.uiuc.edu/~ksen/cute/<br />
-QArchive.org web file checker (Firefox Add-on) - https://addons.mozilla.org/firefox/4115/<br/ >
+EMMA - http://emma.sourceforge.net/<br />
-Update Notified (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/2098/<br/ >
+JLint - http://jlint.sourceforge.net/<br />
-FireKeeper - http://firekeeper.mozdev.org/<br/ >
+Java PathFinder - http://javapathfinder.sourceforge.net/<br />
-<br/ >
+Fujaba: Move between UML and Java source code - http://wwwcs.uni-paderborn.de/cs/fujaba/<br />
-<b>Browser Privacy</b><br/ >
+Checkstyle - http://checkstyle.sourceforge.net/<br />
-TrackMeNot (Firefox Add-on) - https://addons.mozilla.org/firefox/3173/<br/ >
+Cookie Revolver Security Framework - http://sourceforge.net/projects/cookie-revolver<br />
-Privacy Bird - http://www.privacybird.com/<br/ >
+tinapoc - http://sourceforge.net/projects/tinapoc<br />
-<br/ >
+jarsigner - http://java.sun.com/j2se/1.5.0/docs/tooldocs/solaris/jarsigner.html<br />
-<b>Application and protocol fuzzing (random instead of targeted)</b><br/ >
+Solex - http://solex.sourceforge.net/<br />
-Sulley - http://fuzzing.org/<br/ >
+Java Explorer - http://metal.hurlant.com/jexplore/<br />
-taof: The Art of Fuzzing - http://sourceforge.net/projects/taof/<br/ >
+HTTPClient - http://www.innovation.ch/java/HTTPClient/<br />
-zzuf: multipurpose fuzzer - http://sam.zoy.org/zzuf/<br/ >
+another HttpClient - http://jakarta.apache.org/commons/httpclient/<br />
-autodafé: an act of software torture - http://autodafe.sourceforge.net/<br/ >
+a list of code coverage and analysis tools for Java - http://mythinkpond.blogspot.com/2007/06/java-foss-freeopen-source-software.html<br />
-EFS and GPF: Evolutionary Fuzzing System - http://www.appliedsec.com/resources.html<br/ >
+==Microsoft .NET static analysis and security framework tools, mostly for ASP.NET and ASP.NET AJAX, but also C# and VB.NET==
+* Visual Studio 2008 Code Analysis, available in:
+** VSTS 2008 Development Edition (http://msdn.microsoft.com/vsts2008/products/bb933752.aspx) and
+** VSTS 2008 Team Suite (http://msdn.microsoft.com/vsts2008/products/bb933735.aspx)
+* Visual Studio 2005 Code Analyzer, available in:
+** Visual Studio 2005 Team Edition for Software Developers  (http://msdn.microsoft.com/en-us/vstudio/aa718806.aspx)
+** Visual Studio 2005 Team Suite (http://msdn.microsoft.com/en-us/vstudio/aa718806.aspx)
+* Web Development Helper - http://www.nikhilk.net/Project.WebDevHelper.aspx
+* FxCop:
+** (blog) http://blogs.msdn.com/fxcop/
+** (download) http://code.msdn.microsoft.com/codeanalysis
+* Microsoft internal tools you can't have yet:
+** http://www.microsoft.com/windows/cse/pa_projects.mspx
+** http://research.microsoft.com/Pex/
+** http://www.owasp.org/images/5/5b/OWASP_IL_7_FuzzGuru.pdf<br />
+=Database security assessment=
+Scuba by Imperva Database Vulnerability Scanner - http://www.imperva.com/scuba/<br />
+=Threat modeling=
+Microsoft Threat Analysis and Modeling Tool v2.1 (TAM) - http://www.microsoft.com/downloads/details.aspx?FamilyID=59888078-9daf-4e96-b7d1-944703479451&displaylang=en<br />
+Amenaza: Attack Tree Modeling (SecurITree) - http://www.amenaza.com/software.php<br />
+Octotrike - http://www.octotrike.org/<br />
+=Misc=
+==RSS extensions and caching==
+rss-cache - http://www.dubfire.net/chris/projects/rss-cache/<br />
+==Blackhat SEO and maybe some whitehat SEO==
+SearchStatus (Firefox Add-on) - http://www.quirk.biz/searchstatus/<br />
+SEO for Firefox (Firefox Add-on) - http://tools.seobook.com/firefox/seo-for-firefox.html<br />
+SEOQuake (Firefox Add-on) - http://www.seoquake.com/<br />
+Analytics seo - http://www.analyticsseo.com/<br />
+==Web application security malware, backdoors, and evil code==
+Jikto - http://busin3ss.name/jikto-in-the-wild/<br />
+XSS Shell - http://ferruh.mavituna.com/article/?1338<br />
+XSS-Proxy - http://xss-proxy.sourceforge.net<br />
+AttackAPI - http://www.gnucitizen.org/projects/attackapi/<br />
+FFsniFF - http://azurit.elbiahosting.sk/ffsniff/<br />
+HoneyBlog's web-based junkyard - http://honeyblog.org/junkyard/web-based/<br />
+BeEF - http://www.beefproject.com<br />
+Firefox Extension Scanner (FEX) - http://www.gnucitizen.org/projects/fex/<br />
+What is my IP address? - http://reglos.de/myaddress/<br />
+xRumer: blogspam automation tool - http://www.botmaster.net/movies/XFull.htm<br />
+SpyJax - http://www.merchantos.com/makebeta/tools/spyjax/<br />
+Greasecarnaval - http://www.gnucitizen.org/projects/greasecarnaval<br />
+Technika - http://www.gnucitizen.org/projects/technika/<br />
+Load-AttackAPI bookmarklet - http://www.gnucitizen.org/projects/load-attackapi-bookmarklet<br />
+MD's Projects: JS port scanner, pinger, backdoors, etc - http://michaeldaw.org/my-projects/<br />
+==Honeyclients, Web Application, and Web Proxy honeypots==
+Honeyclient Project: an open-source honeyclient - http://www.honeyclient.org/trac/ <br />
+HoneyC: the low-interaction honeyclient - http://honeyc.sourceforge.net/<br />
+Capture: a high-interaction honeyclient - http://capture-hpc.sourceforge.net/<br />
+Google Hack Honeypot - http://ghh.sourceforge.net/<br />
+PHP.Hop - PHP Honeynet Project - http://www.rstack.org/phphop/<br />
+SpyBye - http://www.monkey.org/~provos/spybye/<br />
+Honeytokens - http://www.securityfocus.com/infocus/1713<br />
+=Browser Privacy/ Defenses=
+==Browser Defenses==
+Adblock Plus (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/adblock-plus/<br />
+NoScript (Firefox Add-on) - http://www.noscript.net/<br />
+DieHard - http://www.diehard-software.org/<br />
+LocalRodeo (Firefox Add-on) - http://databasement.net/labs/localrodeo/<br />
+NoMoXSS - http://www.seclab.tuwien.ac.at/projects/jstaint/<br />
+FlashBlock (Firefox Add-on) - http://flashblock.mozdev.org/<br />
+FormFox (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1579/<br />
+SafeCache (Firefox Add-on) - http://www.safecache.com/<br />
+SafeHistory (Firefox Add-on) - http://www.safehistory.com/<br />
+PrefBar (Firefox Add-on) - http://prefbar.mozdev.org/<br />
+All-in-One Sidebar (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1027/<br />
+Update Notified (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/2098/<br />
+FireKeeper - http://firekeeper.mozdev.org/<br />
+Greasemonkey: XSS Malware Script Detector - http://yehg.net/lab/#tools.greasemonkey<br />
+==Browser Privacy==
+BetterPrivacy (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/betterprivacy/<br />
+TrackMeNot (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/trackmenot/<br />
+Privacy Bird - http://www.privacybird.com/<br />
+HTTPS Everywhere - https://www.eff.org/https-everywhere<br />

Difference between revisions of "Phoenix/Tools"

Latest revision as of 15:27, 18 October 2017

Testing grounds

LiveCDs

Test sites

External Assessment

Browser

Add-ons for Firefox that help with general web application security

Browser-based HTTP tampering / editing / replaying

Add-ons for Firefox that help with Javascript and Ajax web application security

Bookmarklets that aid in web application security

Footprinting for web application security

Tools

SSL certificate checking / scanning

HTTP proxying / editing

RSnake's XSS cheat sheet based-tools, webapp fuzzing, and encoding tools

HTTP general testing / fingerprinting

dead, vanished links (March/2012)

Cookie editing / poisoning

Fuzzer

Browser-based security fuzzing / checking

dead, vanished links (March/2012)

Application and protocol fuzzing (random instead of targeted)

dead, vanished links (March/2012)

Ajax and XHR scanning

SQL injection scanning

Web services enumeration / scanning / fuzzing

3rd party services that aid in web application security assessment

Server side stuff

PHP static analysis and file inclusion scanning

PHP Defensive Tools

Web Application Firewall (WAF) and Intrusion Detection (APIDS) rules and resources

Code

Web application non-specific static source-code analysis

Static analysis for C/C++ (CGI, ISAPI, etc) in web applications

Java static analysis, security frameworks, and web application security tools

Microsoft .NET static analysis and security framework tools, mostly for ASP.NET and ASP.NET AJAX, but also C# and VB.NET

Database security assessment

Threat modeling

Misc

RSS extensions and caching

Blackhat SEO and maybe some whitehat SEO

Web application security malware, backdoors, and evil code

Honeyclients, Web Application, and Web Proxy honeypots

Browser Privacy/ Defenses

Browser Defenses

Browser Privacy

Navigation menu

Search