Category:OWASP Pantera Web Assessment Studio Project

Main

Welcome to the OWASP Pantera Web Assessment Studio Project

Pantera Console

Overview

Pantera uses an improved version of SpikeProxy to provide a powerful web application analysis engine.

Goals

The primary goal of Pantera is to combine automated capabilities with complete manual testing to get the best penetration testing results.

Download

Enjoy :)

https://sourceforge.net/project/showfiles.php?group_id=64424&package_id=208668&release_id=483035

• Current Version: 0.1.3

Pantera Installer

https://sourceforge.net/project/showfiles.php?group_id=64424&package_id=208668&release_id=614157

Installation Tips

Pantera needs:

• Python 2.4
• MySQL 5 (Due to the use of triggers)
• pyOpenSSL
• FormBuild (install script inside Pantera zip)

In case you run into troubles installing Pantera on Windows due to OpenSSL, you can find a pyOpenSSL binary for python 2.4 here: http://webcleaner.sourceforge.net/pyOpenSSL-0.6.win32-py2.4.exe

This site have a lot of python 2.4 binaries that can help you: http://webcleaner.sourceforge.net/install.html

If you need more help, subscribe to Pantera Mailing list :)

Features

The following are some notable Pantera Features:

• User-friendly custom web GUI. (CSS): Pantera itself is a web application that runs inside the browser and can be customized using CSS by the user. Some of the customizations are visual style, colors, fonts, views for easy information access, etc.
• 100% python: Python is cross-platform, easy to install and use. Making it the perfect language of choice to use.
• Multi-platform (Windows, Linux, etc.) and multi-browser (IE, Firefox, etc.): By using Python, Pantera is cross-platform. And we have made sure Pantera works fine with the most common browsers.
• Supports SSL, NTLM, HTTP Basic: All this is supported by Pantera, still most open source tools have problems with things like NTLM.
• Powerful analysis engine: Pantera has a powerful analysis engine, meaning that each web page that Pantera sees is analyzed for several things like comments, scripts, vulnerabilities, hidden tags and more. All this is done in background and transparent for the user while testing the website manual and of course all this info is stored in the database.
• XML data files for configuration and attacks: Pantera uses XML files for configuration but also all the attacks and tests are stored in XML files, so it's easy to add content to these files.
• MySQL support: Most tools do not allow you to save the assessment. While performing an assessment with Pantera you can create a session, so all the info generated while the assessment is stored in the database. You can edit, delete and modify the content of the assessment at your will. You can continue the next day on the same point you stopped. Currently only MySQL is supported, more databases will be supported in the future.
• Project Management: Each assessment is a session. Pantera offers project management to create new, open and delete projects.
• Plug-in support: Pantera offers plug-in support so advanced users can add and extent its features.
• Report generation: As Pantera can save assessments it can generate reports with all the gather data and vulnerabilities found. Some reports formats are HTML, XML, PDF, etc. Reports can also be customized!!
• Pantera Inline Feature: This interesting feature allows the user to use the browser visiting the target website and send Pantera commands using a special syntax without switching to Pantera UI. You can do most of the assessment by using just the browser and having Pantera in the background by catching and analyzing all the pages you view.
• Many utilities. (anti-IDS, fuzzing, web spider, brute force, cgi scanning, etc.): Pantera comes with many features, some are common, others aren't.
• Combines automated capabilities with complete manual testing to get the best results: That's the main goal of Pantera.
• Open source and freeware: Free of charge :-D

Pantera in action

Future Development

Please read Pantera AOC progress page.

News

Yes, we are alive and working on Pantera. Now you can find a really cool Pantera Installer (Windows only) :) - 22:23, 17 July 2008 (EDT)

Pantera 0.1.3 is out. We are happy we have completed our AOC sponsorship and we will like to thanks OWASP for their support!! However there is a long road ahead of us and we need to keep the hard work with your help :) - 20:44, 31 January 2007 (EDT)

We are releasing Pantera 0.1.2 with many improvements and fixes!! Upgrade today :) - 15:25, 30 November 2006 (EDT)

 Finally the first public release of OWASP Pantera. Keep in mind that Pantera is beta software and we need your help to create a top-notch project!! :) - 13:14, 23 October 2006 (EDT) 

OWASP Pantera Web Assessment Studio Project Created! - 10:42, 16 August 2006 (EDT)

While the Pantera Web Assessment Studio Project has been under development for some time now, it has only recently been donated to OWASP.

The OWASP community would like to thank Simon Roses Femerling for the generous donation.

Feedback and Participation:

We hope you find the OWASP Pantera Web Assessment Studio Project useful. Please contribute to the Project by volunteering for one of the Tasks, sending your comments, questions, and suggestions to [email protected]. To join the OWASP Pantera Web Assessment Studio Project mailing list or view the archives, please visit the subscription page.

Project Contributor

The project is lead by Simon Roses Femerling (pantera DOT proxy AT gmail.com)

Project Sponsor

The OWASP Pantera Web Assessment Studio Project is sponsored by TBD

Project Identification