This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "OWASP Pyttacker Project"
(Created page with "=Main= <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">link=</div> {| style="padding: 0;margin:0;margin-top:10px;t...") |
Mario Robles (talk | contribs) |
||
| Line 12: | Line 12: | ||
==Introduction== | ==Introduction== | ||
| − | + | Most of the time is spent on finding the bad stuff during a Web PenTest, reports are time consuming and you need to deliver your results as soon as possible, however in the end the one that will need to fix the issue (or push others to do it) will need to really understand the impact of the findings included in a report. When you show raw Database data from a SQLi it's very visible for your costumer that the impact is High, however when the finding need some other factors the impact become more complicated to be demonstrated to non technical people, just a request and response is not enough and how long are you willing to take in order to create a nice screenshot for being included in your report. | |
| + | What about using "something" that is the server you mention as 'evil.com' that can be used by the bad guys against your costumer's company, even better if you know that the evil server is not that "evil" and you can validate, modify or disable it's contents, would be nice to have "something" for creating nice screen-shots, what about reproducing the finding during that meeting when your are trying to show the impact of your findings, not just a pop-up alert for XSS, what if you show an inoffensive but scaring partial defacement or a javascript keylogger in action. | ||
| − | + | If you agree then Pyttacker will be an interesting tool for you | |
| − | |||
| − | |||
| − | |||
==Licensing== | ==Licensing== | ||
| − | OWASP | + | OWASP Pyttacker is free to use. It is licensed under [http://www.gnu.org/licenses/agpl-3.0.html] AGPL 3.0, so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one. |
| Line 29: | Line 27: | ||
== What is the OWASP Pyttacker Project? == | == What is the OWASP Pyttacker Project? == | ||
| − | + | Key characteristics: | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| + | * Minimal requirements (Just Python and a Web Browser) | ||
| + | * Cross-platform | ||
| + | * Portable | ||
| + | * Easy Plug-ins Implementation | ||
| + | * Easy to use | ||
== Project Leader == | == Project Leader == | ||
| − | Mario Robles | + | [mailto:[email protected] Mario Robles] |
| Line 57: | Line 51: | ||
== Quick Download == | == Quick Download == | ||
| − | * | + | * [https://github.com/RoblesT/pyttacker/archive/master.zip Download] |
| − | + | * GitHub: | |
| − | + | <pre> | |
| + | git clone https://github.com/RoblesT/pyttacker.git | ||
| + | </pre> | ||
| + | [https://github.com/RoblesT/pyttacker/wiki Manual and How-to] | ||
== News and Events == | == News and Events == | ||
| − | * [ | + | * [25 March 2014] Project created |
| − | * [ | + | * [26 April 2014] New Alpha made public |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
==Classifications== | ==Classifications== | ||
| Line 96: | Line 88: | ||
= Acknowledgements = | = Acknowledgements = | ||
==Volunteers== | ==Volunteers== | ||
| − | + | Pyttacker is developed by a worldwide team of volunteers. The primary contributors to date have been: | |
| − | |||
| − | |||
| − | |||
| − | + | * Mario Robles | |
| − | * | + | [mailto:[email protected] Join us !] or [ https://lists.owasp.org/mailman/listinfo/owasp_pyttacker_project Subscribe] |
| − | |||
= Road Map and Getting Involved = | = Road Map and Getting Involved = | ||
| Line 115: | Line 103: | ||
#Add integration with tools like OWASP ZAP and Burp Suite" | #Add integration with tools like OWASP ZAP and Burp Suite" | ||
| − | Involvement in the development and promotion of | + | Involvement in the development and promotion of Pyttacker is actively encouraged! |
You do not have to be a security expert in order to contribute. | You do not have to be a security expert in order to contribute. | ||
Some of the ways you can help: | Some of the ways you can help: | ||
| − | * | + | * QA Testing | Bug reporting |
| − | * | + | * Content Translation |
| + | * Plugin Development | ||
| + | * Core code improvements | ||
Revision as of 18:17, 26 April 2014
OWASP Pyttacker ProjectThe OWASP Pyttacker Project is a portable Web Server that include the features needed for every Pentester when creating reports, helping to create PoCs that show a more descriptive way to create awareness to the businesses by demonstrating realistic but inoffensive "attacks" included as part of the tool. IntroductionMost of the time is spent on finding the bad stuff during a Web PenTest, reports are time consuming and you need to deliver your results as soon as possible, however in the end the one that will need to fix the issue (or push others to do it) will need to really understand the impact of the findings included in a report. When you show raw Database data from a SQLi it's very visible for your costumer that the impact is High, however when the finding need some other factors the impact become more complicated to be demonstrated to non technical people, just a request and response is not enough and how long are you willing to take in order to create a nice screenshot for being included in your report. What about using "something" that is the server you mention as 'evil.com' that can be used by the bad guys against your costumer's company, even better if you know that the evil server is not that "evil" and you can validate, modify or disable it's contents, would be nice to have "something" for creating nice screen-shots, what about reproducing the finding during that meeting when your are trying to show the impact of your findings, not just a pop-up alert for XSS, what if you show an inoffensive but scaring partial defacement or a javascript keylogger in action. If you agree then Pyttacker will be an interesting tool for you
LicensingOWASP Pyttacker is free to use. It is licensed under [1] AGPL 3.0, so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.
|
What is the OWASP Pyttacker Project?Key characteristics:
Project Leader
Related Projects
|
Quick Download
git clone https://github.com/RoblesT/pyttacker.git News and Events
Classifications
| |||||||
- Q1
- A1
- Q2
- A2
Volunteers
Pyttacker is developed by a worldwide team of volunteers. The primary contributors to date have been:
- Mario Robles
Join us ! or [ https://lists.owasp.org/mailman/listinfo/owasp_pyttacker_project Subscribe]
As of March 2014, the priorities are:
"First Alpha version is ready but need more development time for including features that can be delegated to newcomers since the project is module based. The First Beta release is intended to be published on June 2014 including the PoC modules for CSRF, XSS, Open Redirect, XFS Next Steps:
- Add more PoC modules for more Vulnerabilities
- Add integration with tools like OWASP ZAP and Burp Suite"
Involvement in the development and promotion of Pyttacker is actively encouraged! You do not have to be a security expert in order to contribute. Some of the ways you can help:
- QA Testing | Bug reporting
- Content Translation
- Plugin Development
- Core code improvements
| PROJECT INFO What does this OWASP project offer you? |
RELEASE(S) INFO What releases are available for this project? | |||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
| |||||||||||||||||||||||||||||||||||
