Difference between revisions of "Category:OWASP CAL9000 Project"

Revision as of 17:19, 19 September 2006

Welcome to the OWASP CAL9000 project...

CAL9000 in action

Overview

CAL9000 brings together a host of web application security testing tools into one convenient package. It is designed to be used in the Firefox browser. CAL9000 functionality may be limited when used with other browsers.

CAL9000 is written in Javascript, so you have full access to the source code. Feel free to modify it to best suit your particular needs. CAL9000 has some powerful features(like executing cross-domain XMLHttpRequests and writing to disk). It is purposefully designed to do some horribly insecure things. Therefore, I would strongly encourage that you only run it locally and NOT off of a web server.

While using CAL9000, the Firefox browser may pop up windows asking you to grant exceptions to its security policy. These are normal and may be safely accepted. If you are reluctant to approve these requests, you can review the source code until you are comfortable with CAL9000's functionality. I can say with reasonable certainty that CAL9000 will not go crazy and try to kill you.

Please only use this tool for testing your own applications or those that you have been authorized to test.

Features

• XSS Attacks - This is a library of the XSS Attack Info from RSnake. You can also try testing the various attacks or using RegEx filters against them.
• Character Encoder/Decoder - Encodes and decodes the following types: URL, Standard Hex, Unicode, Html(Named), Html(Decimal), Html(Hex), Html(Hex Long), Javascript Escaped, XML Escaped, Straight Decimal, Straight Hex, IE Hex, IE Unicode, Base64 and MD5. Specify Upper/Lowercase, Delimiters and Trailing Characters. You can add/remove wrappers around your results and encode/decode selected text instead of the entire contents of the window.
• Simple Http Requests - Send GET, POST, HEAD, TRACE, OPTIONS, PUT and DELETE requests and see the results.
• Scratchpad - A place to save code snippets, notes, results, etc.
• Cheatsheets - Collection of references for various web-related platforms and languages.
• Page Info - Splits out the Forms in a target page, as well as the source for internal and external Scripts.
• IP Encoder/Decoder - Go to/from IP, Dword, Hex and Octal addresses.
• String Generator - Create alpha(i), numeric(1) or special(!) strings of almost any length.
• Scroogle Search - A privacy-friendly scrape of Google results w/Advanced Operators.
• Testing Checklist - Collection of testing ideas for assessments.
• Save State/Load State - Allows you to save CAL9000 textarea and text field contents and reload them when you are ready to resume testing.
• Selected Text Processing - Allows you to process selected text inside of a textarea instead of the entire contents of a textarea.

Downloads

LATEST RELEASE - Version 1.1 released July 30, 2006. See the OWASP CAL9000 Project Roadmap for details.

• RightClick here to download the CAL9000 tool.
• RightClick here to download the latest XSS Attack List XML file from RSnake's site. Replace the file of the same name in your "CAL9000/files/xml/" folder.

The online help for CAL9000 can be found here.

Project Contributors

Chris Loomis wrote the CAL9000 tool and currently leads the project. Any and all questions, comments or suggestions are welcome and may be directed here or submitted via the Discussion Tab above.

Thanks to everyone who has emailed me their comments and great suggestions for enhancing CAL9000. Keep the ideas coming! Special thanks to Achim Hoffmann for his significant contributions of code and time to the project.

Feedback and Participation:

We hope you find the OWASP CAL9000 Project useful. Please contribute to the Project by volunteering for one of the Tasks, sending your comments, questions, and suggestions to [email protected]. To join the OWASP CAL9000 Project mailing list or view the archives, please visit the subscription page.

Roadmap

Please refer to the OWASP CAL9000 Project Roadmap for current tasks.