This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Phoenix/Tools"

From OWASP

Jump to: navigation, search

Latest revision as of 15:27, 18 October 2017

Please send comments or questions to the Phoenix-OWASP mailing-list.

1 Testing grounds
- 1.1 LiveCDs
- 1.2 Test sites
2 External Assessment
3 Server side stuff
4 Code
5 Database security assessment
6 Threat modeling
7 Misc
8 Browser Privacy/ Defenses
- 8.1 Browser Defenses
- 8.2 Browser Privacy

Testing grounds

LiveCDs

OWASP Live CD - http://www.owasp.org/index.php/Category:OWASP_Live_CD_Project
Web Security Dojo - http://dojo.mavensecurity.com/
Samurai WTF - http://samurai.inguardians.com
DVL (Damn Vulnerable Linux) - http://www.damnvulnerablelinux.org/
moth - http://www.bonsai-sec.com/en/research/moth.php
OWASP Broken Web Applications - http://code.google.com/p/owaspbwa/
Hacking-Lab Live CD - https://www.hacking-lab.com/Remote_Sec_Lab/livecd.html

Test sites

SPI Dynamics (live) - http://zero.webappsecurity.com/
Trustwave (live) - http://crackme.trustwave.com/
Watchfire (live) - http://demo.testfire.net/
Acunetix (live) - http://testphp.vulnweb.com/ http://testasp.vulnweb.com http://testaspnet.vulnweb.com
WebMaven / Buggy Bank - http://www.mavensecurity.com/webmaven
Foundstone SASS tools - http://www.foundstone.com/us/resources-free-tools.asp
Updated HackmeBank - http://www.o2-ounceopen.com/technical-info/2008/12/8/updated-version-of-hacmebank.html
OWASP WebGoat - http://www.owasp.org/index.php/OWASP_WebGoat_Project
OWASP SiteGenerator - http://www.owasp.org/index.php/Owasp_SiteGenerator
Stanford SecuriBench - http://suif.stanford.edu/~livshits/securibench/
SecuriBench Micro - http://suif.stanford.edu/~livshits/work/securibench-micro/
Google’s web application training - http://jarlsberg.appspot.com/part1/
OWASP TOP 10 LAB (Online) - https://www.hacking-lab.com/Remote_Sec_Lab/free-owasp-top10-lab.html

Java ORM Testing Playground - https://github.com/0ang3el/HQLi-playground

External Assessment

Browser

Add-ons for Firefox that help with general web application security

Browser-based HTTP tampering / editing / replaying

TamperIE - http://www.bayden.com/Other/
isr-form - http://www.infobyte.com.ar/developments.html
Modify Headers (Firefox Add-on) - http://modifyheaders.mozdev.org/
Tamper Data (Firefox Add-on) - http://tamperdata.mozdev.org/
UrlParams (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1290/
TestGen4Web (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1385/
DOM Inspector / Inspect This (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1806/ https://addons.mozilla.org/en-US/firefox/addon/1913/
LiveHTTPHeaders / Header Monitor (Firefox Add-on) - http://livehttpheaders.mozdev.org/ https://addons.mozilla.org/en-US/firefox/addon/575/

Add-ons for Firefox that help with Javascript and Ajax web application security

Selenium IDE - http://www.openqa.org/selenium-ide/
Firebug - http://www.joehewitt.com/software/firebug/
Venkman - http://www.mozilla.org/projects/venkman/
Chickenfoot - http://groups.csail.mit.edu/uid/chickenfoot/
Greasemonkey - http://www.greasespot.net/
Greasemonkey compiler - http://www.letitblog.com/greasemonkey-compiler/
User script compiler - http://arantius.com/misc/greasemonkey/script-compiler
Extension Developer's Extension (Firefox Add-on) - http://ted.mielczarek.org/code/mozilla/extensiondev/
Smart Middle Click (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/3885/

Bookmarklets that aid in web application security

RSnake's security bookmarklets - http://ha.ckers.org/bookmarklets.html
BMlets - http://optools.awardspace.com/bmlet.html
Huge list of bookmarklets - http://www.squarefree.com/bookmarklets/
Blummy: consists of small widgets, called blummlets, which make use of Javascript to provide rich functionality - http://www.blummy.com/
Bookmarklets every blogger should have - http://www.micropersuasion.com/2005/10/bookmarklets_ev.html
Flat Bookmark Editing (Firefox Add-on) - http://n01se.net/chouser/proj/mozhack/
OpenBook and Update Bookmark (Firefox Add-ons) - http://www.chuonthis.com/extensions/

Footprinting for web application security

Evolution - http://www.paterva.com/evolution-e.html
GooSweep - http://www.mcgrewsecurity.com/projects/goosweep/
Aura: Google API Utility Tools - http://www.sensepost.com/research/aura/
Edge-Security tools - http://www.edge-security.com/soft.php
Fierce Domain Scanner - http://ha.ckers.org/fierce/
Googlegath - http://www.nothink.org/perl/googlegath/
Advanced Dork (Firefox Add-on) - https://addons.mozilla.org/firefox/2144/
Passive Cache (Firefox Add-on) - https://addons.mozilla.org/firefox/977/
CacheOut! (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1453/
BugMeNot Extension (Firefox Add-on) - http://roachfiend.com/archives/2005/02/07/bugmenot/
TrashMail.net Extension (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1813/
DiggiDig (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/2819/
Digger (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1467/

Tools

SSL certificate checking / scanning

SSL Labs - https://www.ssllabs.com/ssldb/
[ZIP] THCSSLCheck - http://thc.org/root/tools/THCSSLCheck.zip
[ZIP] Foundstone SSLDigger - http://www.foundstone.com/us/resources/termsofuse.asp?file=ssldigger.zip
Cert Viewer Plus (Firefox Add-on) - https://addons.mozilla.org/firefox/1964/
testssl.sh - http://drwetter.eu/software/ssl/
O-Saft - OWASP SSL audit for testers: list information about and test remote SSL certificate and connection Download

HTTP proxying / editing

WebScarab - http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project
Burp Suite - http://www.portswigger.net/
Paros - http://www.parosproxy.org/
Paros fork #1: Zed Attack Proxy (ZAP) - http://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
Paros fork #2: Andiparos - http://code.google.com/p/andiparos/
Fiddler - http://www.fiddlertool.com/
Web Proxy Editor - http://www.microsoft.com/mspress/companion/0-7356-2187-X/
Pantera - http://www.owasp.org/index.php/Category:OWASP_Pantera_Web_Assessment_Studio_Project
Suru - http://www.sensepost.com/research/suru/
httpedit (curses-based) - http://www.neutralbit.com/en/rd/httpedit/
Charles - http://www.xk72.com/charles/
Odysseus - http://www.bindshell.net/tools/odysseus
Burp, Paros, and WebScarab for Mac OS X - http://www.corsaire.com/downloads/
Web-application scanning tool from `Network Security Tools'/O'Reilly - http://examples.oreilly.com/networkst/
JS Commander - http://jscmd.rubyforge.org/
Ratproxy - http://code.google.com/p/ratproxy/
Arachni - https://github.com/Zapotek/arachni/
WATOBO - http://watobo.sourceforge.net/

RSnake's XSS cheat sheet based-tools, webapp fuzzing, and encoding tools

Wfuzz - http://www.edge-security.com/wfuzz.php
ProxMon - http://www.isecpartners.com/proxmon.html
Wapiti - http://wapiti.sourceforge.net/
Grabber - http://rgaucher.info/beta/grabber/
XSSScan - http://darkcode.ath.cx/scanners/XSSscan.py
CAL9000 - http://www.owasp.org/index.php/Category:OWASP_CAL9000_Project
EnDe - http://www.owasp.org/index.php/Category:OWASP_EnDe
HTMangLe - http://www.fishnetsecurity.com/Tools/HTMangLe/publish.htm
JBroFuzz - http://www.owasp.org/index.php/JBroFuzz
J-Baah - http://www.sensepost.com/labs/tools/pentest/j-baah
XSSFuzz - http://ha.ckers.org/blog/20060921/xssfuzz-released/
WhiteAcid's XSS Assistant - http://www.whiteacid.org/greasemonkey/
Overlong UTF - http://www.microsoft.com/mspress/companion/0-7356-2187-X/
[TGZ] MielieTool (SensePost Research) - http://packetstormsecurity.org/UNIX/utilities/mielietools-v1.0.tgz
RegFuzzer: test your regular expression filter - http://rgaucher.info/b/index.php/post/2007/05/26/RegFuzzer%3A-Test-your-regular-expression-filter
screamingCobra - http://www.dachb0den.com/projects/screamingcobra.html
SPIKE and SPIKE Proxy - http://immunitysec.com/resources-freesoftware.shtml
RFuzz - http://rfuzz.rubyforge.org/
WebFuzz - http://www.codebreakers-journal.com/index.php?option=com_content&task=view&id=112&Itemid=99999999
TestMaker - http://www.pushtotest.com/Docs/downloads/features.html
ASP Auditor - http://michaeldaw.org/projects/asp-auditor-v2/
WSTool - http://wstool.sourceforge.net/
Web Hack Control Center (WHCC) - http://ussysadmin.com/whcc/
Web Text Converter - http://www.microsoft.com/mspress/companion/0-7356-2187-X/
HackBar (Firefox Add-on) - https://addons.mozilla.org/firefox/3899/
Net-Force Tools (NF-Tools, Firefox Add-on) - http://www.net-force.nl/library/downloads/
PostIntercepter (Greasemonkey script) - http://userscripts.org/scripts/show/743
fuzzdb - https://code.google.com/p/fuzzdb/

Fuzzer

Browser-based security fuzzing / checking

Zalewski's MangleMe - http://freecode.com/projects/mangleme tool see here http://lcamtuf.coredump.cx/soft/mangleme.tgz (mangle.cgi dead link)
hdm's tools: Hamachi, CSSDIE, DOM-Hanoi, AxMan - http://metasploit.com/users/hdm/tools/
Peach Fuzzer Framework - http://peachfuzzer.com/ (old link)/
TagBruteForcer - http://research.eeye.com/html/tools/RT20060801-3.html
PROTOS Test-Suite: c05-http-reply - http://www.ee.oulu.fi/research/ouspg/protos/testing/c05/http-reply/index.html
COMRaider - https://github.com/dzzie/COMRaider (dead link)
BrowserCheck - http://www.heise-security.co.uk/services/browsercheck/
Stealing information using DNS pinning demo - http://www.jumperz.net/index.php?i=2&a=1&b=7
Javascript Website Login Checker - http://ha.ckers.org/weird/javascript-website-login-checker.html
Mozilla Activex - http://www.adamlock.com/mozilla/ (old link)
Mr. T (Master Recon Tool, includes Read Firefox Settings PoC) - http://ha.ckers.org/mr-t/
Test your installation of Java software - http://java.com/en/download/installed.jsp?detect=jre&try=1
WebPageFingerprint - Light-weight Greasemonkey Fuzzer - http://userscripts.org/scripts/show/30285

dead, vanished links (March/2012)

bcheck - http://bcheck.scanit.be/bcheck/
Cross-browser Exploit Tests - http://www.jungsonnstudios.com/cool.php
Jungsonn's Black Dragon Project - http://blackdragon.jungsonnstudios.com/
Vulnerable Adobe Plugin Detection For UXSS PoC - http://www.0x000000.com/?i=324
About Flash: is your flash up-to-date? - http://www.macromedia.com/software/flash/about/
Stop-Phishing: Projects page - http://www.indiana.edu/~phishing/?projects
LinkScanner - http://linkscanner.explabs.com/linkscanner/default.asp (seems to be a vendor link now)

Application and protocol fuzzing (random instead of targeted)

Sulley - http://fuzzing.org/
taof: The Art of Fuzzing - http://sourceforge.net/projects/taof/
zzuf: multipurpose fuzzer - http://sam.zoy.org/zzuf/
autodafé: an act of software torture - http://autodafe.sourceforge.net/

dead, vanished links (March/2012)

EFS and GPF: Evolutionary Fuzzing System - http://www.appliedsec.com/resources.html

Ajax and XHR scanning

Sahi - http://sahi.co.in/
scRUBYt - http://scrubyt.org/
jQuery - http://jquery.com/
jquery-include - http://www.gnucitizen.org/projects/jquery-include
Sprajax - http://www.denimgroup.com/sprajax.html
Watir - http://wtr.rubyforge.org/
Watij - http://watij.com/
Watin - http://watin.sourceforge.net/
RBNarcissus - http://idontsmoke.co.uk/2005/rbnarcissus/
SpiderTest (Spider Fuzz plugin) - http://blog.caboo.se/articles/2007/2/21/the-fabulous-spider-fuzz-plugin
Javascript Inline Debugger (jasildbg) - http://jasildbg.googlepages.com/
Firebug Lite - http://www.getfirebug.com/lite.html
firewaitr - http://code.google.com/p/firewatir/

SQL injection scanning

0x90.org: home of Absinthe, Mezcal, etc - http://0x90.org/releases.php
SQLiX - http://www.owasp.org/index.php/Category:OWASP_SQLiX_Project
sqlninja: a SQL Server injection and takover tool - http://sqlninja.sourceforge.net/
JustinClarke's SQL Brute - http://www.justinclarke.com/archives/2006/03/sqlbrute.html
BobCat - http://www.northern-monkee.co.uk/projects/bobcat/bobcat.html
sqlmap - http://sqlmap.sourceforge.net/
Scully: SQL Server DB Front-End and Brute-Forcer - http://www.sensepost.com/research/scully/
FG-Injector - http://www.flowgate.net/?lang=en&seccion=herramientas
PRIAMOS - http://www.priamos-project.com/

Web services enumeration / scanning / fuzzing

WebServiceStudio2.0 - http://www.codeplex.com/WebserviceStudio
Net-square: wsChess - http://net-square.com/wschess/index.shtml
WSFuzzer - http://www.owasp.org/index.php/Category:OWASP_WSFuzzer_Project
SIFT: web method search tool - http://www.sift.com.au/73/171/sift-web-method-search-tool.htm
iSecPartners: WSMap, WSBang, etc - http://www.isecpartners.com/tools.html

3rd party services that aid in web application security assessment

Netcraft - http://www.netcraft.net
AboutURL - http://www.abouturl.com/
The Scrutinizer - http://www.scrutinizethis.com/
net.toolkit - http://clez.net/
ServerSniff - http://www.serversniff.net/
Online Microsoft script decoder - http://www.greymagic.com/security/tools/decoder/
Webmaster-Toolkit - http://www.webmaster-toolkit.com/
myIPNeighbbors, et al - http://digg.com/security/MyIPNeighbors_Find_Out_Who_Else_is_Hosted_on_Your_Site_s_IP_Address
PHP charset encoding - http://h4k.in/encoding
data: URL testcases - http://h4k.in/dataurl

Server side stuff

PHP static analysis and file inclusion scanning

Pixy: Open source flow based discovery of XSS and SQLi - http://pixybox.seclab.tuwien.ac.at/pixy/
PHP-SAT.org: Static analysis for PHP - http://www.program-transformation.org/PHP/
Unl0ck Research Team: tool for searching in google for include bugs - http://unl0ck.net/tools.php
FIS: File Inclusion Scanner - http://www.segfault.gr/index.php?cat_id=3&cont_id=25
PHPSecAudit - http://developer.spikesource.com/projects/phpsecaudit

PHP Defensive Tools

PHPInfoSec - Check phpinfo configuration for security - http://phpsec.org/projects/phpsecinfo/
Greasemonkey Replacement can be found at http://yehg.net/lab/#tools.greasemonkey
Php-Brute-Force-Attack Detector - Detect your web servers being scanned by brute force tools - http://yehg.net/lab/pr0js/files.php/php_brute_force_detect.zip
PHP-Login-Info-Checker (Strictly enforce admins/users to select stronger passwords via url loginfo_checker.php?testlic) - http://yehg.net/lab/pr0js/files.php/loginfo_checkerv0.1.zip, http://yehg.net/lab/pr0js/files.php/phploginfo_checker_demo.zip
php-DDOS-Shield (prevent idiot distributed bots which discontinue their flooding attacks by identifying HTTP 503 header code) - http://code.google.com/p/ddos-shield/
PHPMySpamFIGHTER - http://yehg.net/lab/pr0js/files.php/phpmyspamfighter.zip, http://yehg.net/lab/pr0js/files.php/phpMySpamFighter_demo.rar

Web Application Firewall (WAF) and Intrusion Detection (APIDS) rules and resources

APIDS on Wikipedia - http://en.wikipedia.org/wiki/APIDS
PHP Intrusion Detection System (PHP-IDS) - http://php-ids.org/ http://code.google.com/p/phpids/
dotnetids - http://code.google.com/p/dotnetids/
Secure Science InterScout - http://www.securescience.com/home/newsandevents/news/interscout1.0.html
Remo: whitelist rule editor for mod_security - http://remo.netnea.com/
GotRoot: ModSecuirty rules - http://www.gotroot.com/tiki-index.php?page=mod_security+rules
The Web Security Gateway (WSGW) - http://wsgw.sourceforge.net/
mod_security rules generator - http://noeljackson.com/tools/modsecurity/
Mod_Anti_Tamper - http://www.wisec.it/projects.php?id=3
[TGZ] Automatic Rules Generation for Mod_Security - http://www.wisec.it/rdr.php?fn=/Projects/Rule-o-matic.tgz
AQTRONIX WebKnight - http://www.aqtronix.com/?PageID=99
Akismet: blog spam defense - http://akismet.com/
Samoa: Formal tools for securing web services - http://research.microsoft.com/projects/samoa/

Code

Web application non-specific static source-code analysis

Pixy: a static analysis tool for detecting XSS vulnerabilities - http://www.seclab.tuwien.ac.at/projects/pixy/
Brixoft.Net: Source Edit - http://www.brixoft.net/prodinfo.asp?id=1
Security compass web application auditing tools (SWAAT) - http://www.owasp.org/index.php/Category:OWASP_SWAAT_Project
An even more complete list here - http://www.cs.cmu.edu/~aldrich/courses/654/tools/
A nice list that claims some demos available - http://www.cs.cmu.edu/~aldrich/courses/413/tools.html
A smaller, but also good list - http://spinroot.com/static/
Yasca: A highly extensible source code analysis framework; incorporates several analysis tools into one package. http://www.yasca.org/

Static analysis for C/C++ (CGI, ISAPI, etc) in web applications

RATS - http://www.securesoftware.com/resources/download_rats.html
ITS4 - http://www.cigital.com/its4/
FlawFinder - http://www.dwheeler.com/flawfinder/
Splint - http://www.splint.org/
Uno - http://spinroot.com/uno/
BOON (Buffer Overrun detectiON) - http://www.cs.berkeley.edu/~daw/boon/ http://boon.sourceforge.net
Valgrind - http://www.valgrind.org/

Java static analysis, security frameworks, and web application security tools

LAPSE - http://suif.stanford.edu/~livshits/work/lapse/
CodePro Analytix - http://code.google.com/webtoolkit/tools/codepro/doc/index.html
HDIV Struts - http://hdiv.org/
Orizon - http://sourceforge.net/projects/orizon/
FindBugs: Find bugs in Java programs - http://findbugs.sourceforge.net/
PMD - http://pmd.sourceforge.net/
CUTE: A Concolic Unit Testing Engine for C and Java - http://osl.cs.uiuc.edu/~ksen/cute/
EMMA - http://emma.sourceforge.net/
JLint - http://jlint.sourceforge.net/
Java PathFinder - http://javapathfinder.sourceforge.net/
Fujaba: Move between UML and Java source code - http://wwwcs.uni-paderborn.de/cs/fujaba/
Checkstyle - http://checkstyle.sourceforge.net/
Cookie Revolver Security Framework - http://sourceforge.net/projects/cookie-revolver
tinapoc - http://sourceforge.net/projects/tinapoc
jarsigner - http://java.sun.com/j2se/1.5.0/docs/tooldocs/solaris/jarsigner.html
Solex - http://solex.sourceforge.net/
Java Explorer - http://metal.hurlant.com/jexplore/
HTTPClient - http://www.innovation.ch/java/HTTPClient/
another HttpClient - http://jakarta.apache.org/commons/httpclient/
a list of code coverage and analysis tools for Java - http://mythinkpond.blogspot.com/2007/06/java-foss-freeopen-source-software.html

Microsoft .NET static analysis and security framework tools, mostly for ASP.NET and ASP.NET AJAX, but also C# and VB.NET

Visual Studio 2008 Code Analysis, available in:
- VSTS 2008 Development Edition (http://msdn.microsoft.com/vsts2008/products/bb933752.aspx) and
- VSTS 2008 Team Suite (http://msdn.microsoft.com/vsts2008/products/bb933735.aspx)
Visual Studio 2005 Code Analyzer, available in:
- Visual Studio 2005 Team Edition for Software Developers (http://msdn.microsoft.com/en-us/vstudio/aa718806.aspx)
- Visual Studio 2005 Team Suite (http://msdn.microsoft.com/en-us/vstudio/aa718806.aspx)
Web Development Helper - http://www.nikhilk.net/Project.WebDevHelper.aspx
FxCop:
- (blog) http://blogs.msdn.com/fxcop/
- (download) http://code.msdn.microsoft.com/codeanalysis
Microsoft internal tools you can't have yet:

Database security assessment

Scuba by Imperva Database Vulnerability Scanner - http://www.imperva.com/scuba/

Threat modeling

Microsoft Threat Analysis and Modeling Tool v2.1 (TAM) - http://www.microsoft.com/downloads/details.aspx?FamilyID=59888078-9daf-4e96-b7d1-944703479451&displaylang=en
Amenaza: Attack Tree Modeling (SecurITree) - http://www.amenaza.com/software.php
Octotrike - http://www.octotrike.org/

Misc

RSS extensions and caching

rss-cache - http://www.dubfire.net/chris/projects/rss-cache/

Blackhat SEO and maybe some whitehat SEO

SearchStatus (Firefox Add-on) - http://www.quirk.biz/searchstatus/
SEO for Firefox (Firefox Add-on) - http://tools.seobook.com/firefox/seo-for-firefox.html
SEOQuake (Firefox Add-on) - http://www.seoquake.com/
Analytics seo - http://www.analyticsseo.com/

Web application security malware, backdoors, and evil code

Jikto - http://busin3ss.name/jikto-in-the-wild/
XSS Shell - http://ferruh.mavituna.com/article/?1338
XSS-Proxy - http://xss-proxy.sourceforge.net
AttackAPI - http://www.gnucitizen.org/projects/attackapi/
FFsniFF - http://azurit.elbiahosting.sk/ffsniff/
HoneyBlog's web-based junkyard - http://honeyblog.org/junkyard/web-based/
BeEF - http://www.beefproject.com
Firefox Extension Scanner (FEX) - http://www.gnucitizen.org/projects/fex/
What is my IP address? - http://reglos.de/myaddress/
xRumer: blogspam automation tool - http://www.botmaster.net/movies/XFull.htm
SpyJax - http://www.merchantos.com/makebeta/tools/spyjax/
Greasecarnaval - http://www.gnucitizen.org/projects/greasecarnaval
Technika - http://www.gnucitizen.org/projects/technika/
Load-AttackAPI bookmarklet - http://www.gnucitizen.org/projects/load-attackapi-bookmarklet
MD's Projects: JS port scanner, pinger, backdoors, etc - http://michaeldaw.org/my-projects/

Honeyclients, Web Application, and Web Proxy honeypots

Honeyclient Project: an open-source honeyclient - http://www.honeyclient.org/trac/
HoneyC: the low-interaction honeyclient - http://honeyc.sourceforge.net/
Capture: a high-interaction honeyclient - http://capture-hpc.sourceforge.net/
Google Hack Honeypot - http://ghh.sourceforge.net/
PHP.Hop - PHP Honeynet Project - http://www.rstack.org/phphop/
SpyBye - http://www.monkey.org/~provos/spybye/
Honeytokens - http://www.securityfocus.com/infocus/1713

Browser Privacy/ Defenses

Browser Defenses

Browser Privacy

BetterPrivacy (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/betterprivacy/
TrackMeNot (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/trackmenot/
Privacy Bird - http://www.privacybird.com/
HTTPS Everywhere - https://www.eff.org/https-everywhere

Retrieved from "https://wiki.owasp.org/index.php?title=Phoenix/Tools&oldid=234481"

@@ Line 1: / Line 1: @@
-[WIP]
+Please send comments or questions to the [https://lists.owasp.org/mailman/listinfo/owasp-phoenix Phoenix-OWASP mailing-list].
-<b>LiveCD</b><br/ >
+=Testing grounds=
-Sunday, January 14, 2007  6:54 AM    817811456 AOC_Labrat-ALPHA-0008.iso - http://www.packetfocus.com/hackos/<br/ >
+==LiveCDs==
-<br/ >
+OWASP Live CD - http://www.owasp.org/index.php/Category:OWASP_Live_CD_Project <br />
-<b>Web application scanning</b><br/ >
+Web Security Dojo - http://dojo.mavensecurity.com/<br />
-<br/ >
+Samurai WTF - http://samurai.inguardians.com<br />
-Wapiti - http://wapiti.sourceforge.net/<br/ >
+DVL (Damn Vulnerable Linux) - http://www.damnvulnerablelinux.org/<br />
-Web-application scanning tool from `Network Security Tools'/O'Reilly - http://examples.oreilly.com/networkst/<br/ >
+moth - http://www.bonsai-sec.com/en/research/moth.php<br />
-<br/ >
+OWASP Broken Web Applications - http://code.google.com/p/owaspbwa/<br />
-<b>HTTP proxying / editing</b><br/ >
+Hacking-Lab Live CD - https://www.hacking-lab.com/Remote_Sec_Lab/livecd.html<br />
-<br/ >
-Burp - http://www.portswigger.net/<br/ >
+==Test sites==
-Paros - http://www.parosproxy.org/<br/ >
+SPI Dynamics (live) - http://zero.webappsecurity.com/<br />
-Fiddler - http://www.fiddlertool.com/<br/ >
+Trustwave (live) - http://crackme.trustwave.com/<br />
-Web Proxy Editor - http://www.microsoft.com/mspress/companion/0-7356-2187-X/<br/ >
+Watchfire (live) - http://demo.testfire.net/<br />
-Pantera - http://www.owasp.org/index.php/Category:OWASP_Pantera_Web_Assessment_Studio_Project<br/ >
+Acunetix (live) - http://testphp.vulnweb.com/ http://testasp.vulnweb.com http://testaspnet.vulnweb.com<br />
-Suru - http://www.sensepost.com/research/suru/<br/ >
+WebMaven / Buggy Bank - http://www.mavensecurity.com/webmaven<br />
-httpedit (curses-based) - http://www.neutralbit.com/en/rd/httpedit/<br/ >
+Foundstone SASS tools - http://www.foundstone.com/us/resources-free-tools.asp<br />
-Charles - http://www.xk72.com/charles/<br/ >
+Updated HackmeBank - http://www.o2-ounceopen.com/technical-info/2008/12/8/updated-version-of-hacmebank.html<br />
-Odysseus - http://www.bindshell.net/tools/odysseus<br/ >
+OWASP WebGoat - http://www.owasp.org/index.php/OWASP_WebGoat_Project<br />
-Burp, Paros, and WebScarab for Mac OS X - http://www.corsaire.com/downloads/<br/ >
+OWASP SiteGenerator - http://www.owasp.org/index.php/Owasp_SiteGenerator<br />
-<br/ >
+Stanford SecuriBench - http://suif.stanford.edu/~livshits/securibench/<br />
-<b>RSnake's XSS cheat sheet based-tools, fuzzing, and encoding tools</b><br/ >
+SecuriBench Micro - http://suif.stanford.edu/~livshits/work/securibench-micro/<br />
-<br/ >
+Google’s web application training - http://jarlsberg.appspot.com/part1/ <br />
-HTMangLe - http://www.fishnetsecurity.com/Tools/HTMangLe/publish.htm<br/ >
+OWASP TOP 10 LAB (Online) - https://www.hacking-lab.com/Remote_Sec_Lab/free-owasp-top10-lab.html
-JBroFuzz - http://sourceforge.net/projects/jbrofuzz<br/ >
-CAL9000 - http://www.owasp.org/index.php/Category:OWASP_CAL9000_Project<br/ >
+Java ORM Testing Playground - https://github.com/0ang3el/HQLi-playground
-XSSFuzz - http://ha.ckers.org/blog/20060921/xssfuzz-released/<br/ >
-WhiteAcid's XSS Assistant - http://www.whiteacid.org/greasemonkey/<br/ >
+<br />
-Grabber - http://rgaucher.info/beta/grabber/<br/ >
-Overlong UTF - http://www.microsoft.com/mspress/companion/0-7356-2187-X/<br/ >
+=External Assessment=
-MielieTool - http://www.sensepostresearch.com<br/ >
+==Browser==
-RFuzz - http://rfuzz.rubyforge.org/<br/ >
+===Add-ons for Firefox that help with general web application security===
-[ZIP] WebFuzz - http://www.codebreakers-journal.com/index.php/CodeBreakersJournal/article/download/43/69<br/ >
+Web Developer Toolbar - https://addons.mozilla.org/firefox/60/<br />
-Net-Force Tools (NF-Tools, Firefox Add-on) - http://www.net-force.nl/library/downloads/<br/ >
+Plain Old Webserver (POW) - https://addons.mozilla.org/firefox/3002/<br />
-<br/ >
+XML Developer Toolbar - https://addons.mozilla.org/firefox/2897/<br />
-<b>HTTP general testing / fingerprinting</b><br/ >
+Public Fox - https://addons.mozilla.org/firefox/3911/<br />
-Torture.pl Home Page - http://stein.cshl.org/~lstein/torture/<br/ >
+XForms Buddy - http://beaufour.dk/index.php?sec=misc&pagename=xforms<br />
-JoeDog's Seige - http://www.joedog.org/JoeDog/Siege/<br/ >
+MR Tech Local Install - http://www.mrtech.com/extensions/local_install/<br />
-OPEN-LABS: metoscan (http method testing) - http://www.open-labs.org/<br/ >
+Nightly Tester Tools - http://users.blueprintit.co.uk/~dave/web/firefox/buildid/index.html<br />
-Load-balancing detector - http://ge.mine.nu/lbd.html<br/ >
+IE Tab - https://addons.mozilla.org/firefox/1419/<br />
-HMAP - http://ujeni.murkyroc.com/hmap/<br/ >
+User-Agent Switcher - https://addons.mozilla.org/firefox/59/<br />
-Net-Square: httprint - http://net-square.com/httprint/<br/ >
+ServerSwitcher - https://addons.mozilla.org/firefox/2409/<br />
-Wpoison: http stress testing - http://wpoison.sourceforge.net/<br/ >
+HeaderMonitor - https://addons.mozilla.org/firefox/575/<br />
-Net-square: MSNPawn - http://net-square.com/msnpawn/index.shtml<br/ >
+RefControl - https://addons.mozilla.org/firefox/953/<br />
-hcraft: HTTP Vuln Request Crafter - http://druid.caughq.org/projects/hcraft/<br/ >
+refspoof - https://addons.mozilla.org/firefox/667/<br />
-<br/ >
+No-Referrer - https://addons.mozilla.org/firefox/1999/<br />
-<b>Browser-based HTTP tampering / editing</b><br/ >
+LocationBar^2 - https://addons.mozilla.org/firefox/4014/<br />
-TamperIE - http://www.bayden.com/Other/<br/ >
+SpiderZilla - http://spiderzilla.mozdev.org/<br />
-isr-form - http://www.infobyte.com.ar/development.html<br/ >
+Slogger - https://addons.mozilla.org/en-US/firefox/addon/143<br />
-Tamper Data (Firefox Add-on) - http://tamperdata.mozdev.org/<br/ >
+Fire Encrypter - https://addons.mozilla.org/firefox/3208/<br />
-Modify Headers (Firefox Add-on) - http://modifyheaders.mozdev.org/<br/ >
-<br/ >
+===Browser-based HTTP tampering / editing / replaying===
-<b>Cookie editing / poisoning</b><br/ >
+TamperIE - http://www.bayden.com/Other/<br />
-Add'N Edit Cookies (AnEC, Firefox Add-on) - http://addneditcookies.mozdev.org/<br/ >
+isr-form - http://www.infobyte.com.ar/developments.html<br />
-CookieCuller (Firefox Add-on) - http://cookieculler.mozdev.org/<br/ >
+Modify Headers (Firefox Add-on) - http://modifyheaders.mozdev.org/<br />
-CookieSpy - http://www.codeproject.com/shell/cookiespy.asp<br/ >
+Tamper Data (Firefox Add-on) - http://tamperdata.mozdev.org/<br />
-Cookies Explorer - http://www.dutchduck.com/Features/Cookies.aspx<br/ >
+UrlParams (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1290/<br />
-<br/ >
+TestGen4Web (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1385/<br />
-<b>Ajax and XHR scanning</b><br/ >
+DOM Inspector / Inspect This (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1806/ https://addons.mozilla.org/en-US/firefox/addon/1913/<br />
-Sprajax - http://www.denimgroup.com/sprajax.html<br/ >
+LiveHTTPHeaders / Header Monitor (Firefox Add-on) - http://livehttpheaders.mozdev.org/ https://addons.mozilla.org/en-US/firefox/addon/575/<br />
-Watir - http://wtr.rubyforge.org/<br/ >
-RBNarcissus - http://idontsmoke.co.uk/2005/rbnarcissus/<br/ >
+===Add-ons for Firefox that help with Javascript and Ajax web application security===
-<br/ >
+Selenium IDE - http://www.openqa.org/selenium-ide/<br />
-<b>SQL injection scanning</b><br/ >
+Firebug - http://www.joehewitt.com/software/firebug/<br />
-x90.org: home of Absinthe, Mezcal, etc - http://0x90.org/releases.php<br/ >
+Venkman - http://www.mozilla.org/projects/venkman/<br />
-SQLiX - http://www.owasp.org/index.php/Category:OWASP_SQLiX_Project<br/ >
+Chickenfoot - http://groups.csail.mit.edu/uid/chickenfoot/<br />
-sqlninja: a SQL Server injection and takover tool - http://sqlninja.sourceforge.net/<br/ >
+Greasemonkey - http://www.greasespot.net/<br />
-JustinClarke's SQL Brute - http://www.justinclarke.com/archives/2006/03/sqlbrute.html<br/ >
+Greasemonkey compiler - http://www.letitblog.com/greasemonkey-compiler/<br />
-BobCat - http://www.northern-monkee.co.uk/projects/bobcat/bobcat.html<br/ >
+User script compiler - http://arantius.com/misc/greasemonkey/script-compiler<br />
-sqlmap - http://sqlmap.sourceforge.net/<br/ >
+Extension Developer's Extension (Firefox Add-on) - http://ted.mielczarek.org/code/mozilla/extensiondev/<br />
-Scully: SQL Server DB Front-End and Brute-Forcer - http://www.sensepost.com/research/scully/<br/ >
+Smart Middle Click (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/3885/<br />
-<br/ >
-<b>Web application security malware, backdoors, and evil code</b><br/ >
+===Bookmarklets that aid in web application security===
-XSS Shell - http://ferruh.mavituna.com/article/?1338<br/ >
+RSnake's security bookmarklets - http://ha.ckers.org/bookmarklets.html<br />
-XSS-Proxy - http://xss-proxy.sourceforge.net<br/ >
+BMlets - http://optools.awardspace.com/bmlet.html<br />
-AttackAPI - http://www.gnucitizen.org/projects/attackapi/<br/ >
+Huge list of bookmarklets - http://www.squarefree.com/bookmarklets/<br />
-FFsniFF - http://azurit.gigahosting.cz/ffsniff/<br/ >
+Blummy: consists of small widgets, called blummlets, which make use of Javascript to provide
-HoneyBlog's web-based junkyard - http://honeyblog.org/junkyard/web-based/<br/ >
+rich functionality - http://www.blummy.com/<br />
-BeEF - http://www.bindshell.net/tools/beef/<br/ >
+Bookmarklets every blogger should have - http://www.micropersuasion.com/2005/10/bookmarklets_ev.html<br />
-Firefox Extension Scanner (FEX) - http://www.gnucitizen.org/projects/fex/<br/ >
+Flat Bookmark Editing (Firefox Add-on) - http://n01se.net/chouser/proj/mozhack/<br />
-What is my IP address? - http://reglos.de/myaddress/<br/ >
+OpenBook and Update Bookmark (Firefox Add-ons) - http://www.chuonthis.com/extensions/<br />
-xRumer: blogspam automation tool - http://www.botmaster.net/movies/XFull.htm<br/ >
-Greasecarnaval - http://www.gnucitizen.org/projects/greasecarnaval<br/ >
+===Footprinting for web application security===
-MD's Projects: JS port scanner, pinger, backdoors, etc - http://michaeldaw.org/my-projects/<br/ >
+Evolution - http://www.paterva.com/evolution-e.html<br />
-<br/ >
+GooSweep - http://www.mcgrewsecurity.com/projects/goosweep/<br />
-<b>Web application services that aid in web application security assessment</b><br/ >
+Aura: Google API Utility Tools - http://www.sensepost.com/research/aura/<br />
-Netcraft - http://www.netcraft.net<br/ >
+Edge-Security tools - http://www.edge-security.com/soft.php<br />
-AboutURL - http://www.abouturl.com/<br/ >
+Fierce Domain Scanner - http://ha.ckers.org/fierce/<br />
-net.toolkit - http://clez.net/<br/ >
+Googlegath - http://www.nothink.org/perl/googlegath/<br />
-ServerSniff - http://www.serversniff.net/<br/ >
+Advanced Dork (Firefox Add-on) - https://addons.mozilla.org/firefox/2144/<br />
-Online Microsoft script decoder - http://www.greymagic.com/security/tools/decoder/<br/ >
+Passive Cache (Firefox Add-on) - https://addons.mozilla.org/firefox/977/<br />
-Webmaster-Toolkit - http://www.webmaster-toolkit.com/<br/ >
+CacheOut! (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1453/<br />
-<br/ >
+BugMeNot Extension (Firefox Add-on) - http://roachfiend.com/archives/2005/02/07/bugmenot/<br />
-<b>Browser-based security fuzzing / checking</b><br/ >
+TrashMail.net Extension (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1813/<br />
-Zalewski's MangleMe - http://lcamtuf.coredump.cx/mangleme/mangle.cgi<br/ >
+DiggiDig (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/2819/<br />
-hdm's tools: Hamachi, CSSDIE, DOM-Hanoi, AxMan - http://metasploit.com/users/hdm/tools/<br/ >
+Digger (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1467/<br />
-TagBruteForcer - http://research.eeye.com/html/tools/RT20060801-3.html<br/ >
-COMRaider - http://labs.idefense.com<br/ >
+==Tools==
-bcheck - http://bcheck.scanit.be/bcheck/<br/ >
+===SSL certificate checking / scanning===
-Stop-Phishing: Projects page - http://www.indiana.edu/~phishing/?projects<br/ >
+SSL Labs - https://www.ssllabs.com/ssldb/<br />
-LinkScanner - http://linkscanner.explabs.com/linkscanner/default.asp<br/ >
+[ZIP] THCSSLCheck - http://thc.org/root/tools/THCSSLCheck.zip<br />
-BrowserCheck - http://www.heise-security.co.uk/services/browsercheck/<br/ >
+[ZIP] Foundstone SSLDigger - http://www.foundstone.com/us/resources/termsofuse.asp?file=ssldigger.zip<br />
-Cross-browser Exploit Tests - http://www.jungsonnstudios.com/cool.php<br/ >
+Cert Viewer Plus (Firefox Add-on) - https://addons.mozilla.org/firefox/1964/<br />
-Stealing information using DNS pinning demo - http://www.jumperz.net/index.php?i=2&a=1&b=7<br/ >
+testssl.sh - http://drwetter.eu/software/ssl/<br />
-Javascript Website Login Checker - http://ha.ckers.org/weird/javascript-website-login-checker.html<br/ >
+[[O-Saft]] - OWASP SSL audit for testers: list information about and test remote SSL certificate and connection [https://github.com/OWASP/O-Saft/archive/master.zip Download] <br />
-Mozilla Activex - http://www.iol.ie/~locka/mozilla/mozilla.htm<br/ >
-About Flash: is your flash up-to-date? - http://www.macromedia.com/software/flash/about/<br/ >
+===HTTP proxying / editing===
-Test your installation of Java software - http://java.com/en/download/installed.jsp?detect=jre&try=1<br/ >
+WebScarab - http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project<br />
-<br/ >
+Burp Suite - http://www.portswigger.net/<br />
-<b>PHP file inclusion scanning</b><br/ >
+Paros - http://www.parosproxy.org/<br />
-Unl0ck Research Team: tool for searching in google for include bugs - http://unl0ck.net/tools.php
+Paros fork #1: Zed Attack Proxy (ZAP) - http://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project<br />
-<br/ >
+Paros fork #2: Andiparos - http://code.google.com/p/andiparos/<br />
-FIS: File Inclusion Scanner - http://www.segfault.gr/index.php?cat_id=3&cont_id=25<br/>
+Fiddler - http://www.fiddlertool.com/<br />
-PHPSecAudit - http://developer.spikesource.com/projects/phpsecaudit<br/ >
+Web Proxy Editor - http://www.microsoft.com/mspress/companion/0-7356-2187-X/<br />
-<br/ >
+Pantera - http://www.owasp.org/index.php/Category:OWASP_Pantera_Web_Assessment_Studio_Project<br />
-<b>Web Application Firewall (WAF) rules and resources</b><br/ >
+Suru - http://www.sensepost.com/research/suru/<br />
-GotRoot: ModSecuirty rules - http://www.gotroot.com/tiki-index.php?page=mod_security+rules<br/ >
+httpedit (curses-based) - http://www.neutralbit.com/en/rd/httpedit/<br />
-The Web Security Gateway (WSGW) - http://wsgw.sourceforge.net/<br/ >
+Charles - http://www.xk72.com/charles/<br />
-mod_security rules generator - http://noeljackson.com/tools/modsecurity/<br/ >
+Odysseus - http://www.bindshell.net/tools/odysseus<br />
-Akismet: blog spam defense - http://akismet.com/<br/ >
+Burp, Paros, and WebScarab for Mac OS X - http://www.corsaire.com/downloads/<br />
-Samoa: Formal tools for securing web services - http://research.microsoft.com/projects/samoa/<br/ >
+Web-application scanning tool from `Network Security Tools'/O'Reilly - http://examples.oreilly.com/networkst/<br />
-<br/ >
+JS Commander - http://jscmd.rubyforge.org/<br />
-<b>Web services enumeration / scanning / fuzzing</b><br/ >
+Ratproxy - http://code.google.com/p/ratproxy/<br />
-WebServiceStudio2.0 - http://www.gotdotnet.com/Community/UserSamples/Details.aspx?SampleGuid=65a1d4ea-0f7a-41bd-8494-e916ebc4159c<br/ >
+Arachni - https://github.com/Zapotek/arachni/<br />
-Net-square: wsChess - http://net-square.com/wschess/index.shtml<br/ >
+WATOBO - http://watobo.sourceforge.net/<br />
-WSFuzzer - http://www.owasp.org/index.php/Category:OWASP_WSFuzzer_Project<br/ >
-SIFT: web method search tool - http://www.sift.com.au/73/171/sift-web-method-search-tool.htm<br/ >
+==RSnake's XSS cheat sheet based-tools, webapp fuzzing, and encoding tools==
-iSecPartners: WSMap, WSBang, etc - http://www.isecpartners.com/tools.html<br/ >
+Wfuzz - http://www.edge-security.com/wfuzz.php<br />
-<br/ >
+ProxMon - http://www.isecpartners.com/proxmon.html<br />
-<b>Web application static source-code analysis</b><br/ >
+Wapiti - http://wapiti.sourceforge.net/<br />
-Security compass web application auditing tools (SWAAT) - http://www.securitycompass.com/index.html<br/ >
+Grabber - http://rgaucher.info/beta/grabber/<br />
-<br/ >
+XSSScan - http://darkcode.ath.cx/scanners/XSSscan.py<br />
-<b>Add-ons for Firefox that help with general web application security</b><br/ >
+CAL9000 - http://www.owasp.org/index.php/Category:OWASP_CAL9000_Project<br />
-Web Developer Toolbar - https://addons.mozilla.org/firefox/60/<br/ >
+EnDe - http://www.owasp.org/index.php/Category:OWASP_EnDe<br />
-XML Developer Toolbar - https://addons.mozilla.org/firefox/2897/<br/ >
+HTMangLe - http://www.fishnetsecurity.com/Tools/HTMangLe/publish.htm<br />
-HackBar - https://addons.mozilla.org/firefox/3899/<br/ >
+JBroFuzz - http://www.owasp.org/index.php/JBroFuzz<br />
-XForms Buddy - http://beaufour.dk/index.php?sec=misc&pagename=xforms<br/ >
+J-Baah - http://www.sensepost.com/labs/tools/pentest/j-baah<br />
-MR Tech Local Install - http://www.mrtech.com/extensions/local_install/<br/ >
+XSSFuzz - http://ha.ckers.org/blog/20060921/xssfuzz-released/<br />
-Nightly Tester Tools - http://users.blueprintit.co.uk/~dave/web/firefox/buildid/index.html<br/ >
+WhiteAcid's XSS Assistant - http://www.whiteacid.org/greasemonkey/<br />
-IE Tab - https://addons.mozilla.org/firefox/1419/<br/ >
+Overlong UTF - http://www.microsoft.com/mspress/companion/0-7356-2187-X/<br />
-User-Agent Switcher - https://addons.mozilla.org/firefox/59/<br/ >
+[TGZ] MielieTool (SensePost Research) - http://packetstormsecurity.org/UNIX/utilities/mielietools-v1.0.tgz<br />
-SeverSwitcher - https://addons.mozilla.org/firefox/2409/<br/ >
+RegFuzzer: test your regular expression filter - http://rgaucher.info/b/index.php/post/2007/05/26/RegFuzzer%3A-Test-your-regular-expression-filter<br />
-HeaderMonitor - https://addons.mozilla.org/firefox/575/<br/ >
+screamingCobra - http://www.dachb0den.com/projects/screamingcobra.html<br />
-RefControl - https://addons.mozilla.org/firefox/953/<br/ >
+SPIKE and SPIKE Proxy - http://immunitysec.com/resources-freesoftware.shtml<br />
-refspoof - https://addons.mozilla.org/firefox/667/<br/ >
+RFuzz - http://rfuzz.rubyforge.org/<br />
-no-referrer<br/ >
+WebFuzz - http://www.codebreakers-journal.com/index.php?option=com_content&task=view&id=112&Itemid=99999999<br />
-LocationBar^2 - https://addons.mozilla.org/firefox/4014/<br/ >
+TestMaker - http://www.pushtotest.com/Docs/downloads/features.html<br />
-Fire Encrypter - https://addons.mozilla.org/firefox/3208/<br/ >
+ASP Auditor - http://michaeldaw.org/projects/asp-auditor-v2/<br />
-<br/ >
+WSTool - http://wstool.sourceforge.net/<br />
-<b>Add-ons for Firefox that help with Javascript and Ajax web application security</b><br/ >
+Web Hack Control Center (WHCC) - http://ussysadmin.com/whcc/<br />
-Firebug - http://www.joehewitt.com/software/firebug/<br/ >
+Web Text Converter - http://www.microsoft.com/mspress/companion/0-7356-2187-X/<br />
-Venkman - http://www.mozilla.org/projects/venkman/<br/ >
+HackBar (Firefox Add-on) - https://addons.mozilla.org/firefox/3899/<br />
-Chickenfoot - http://groups.csail.mit.edu/uid/chickenfoot/<br/ >
+Net-Force Tools (NF-Tools, Firefox Add-on) - http://www.net-force.nl/library/downloads/<br />
-Greasemonkey compiler - http://www.letitblog.com/greasemonkey-compiler/<br/ >
+PostIntercepter (Greasemonkey script) - http://userscripts.org/scripts/show/743<br />
-RSnake's security bookmarklets - http://ha.ckers.org/bookmarklets.html<br/ >
+fuzzdb - https://code.google.com/p/fuzzdb/<br />
-Javascript shell - http://www.squarefree.com/shell/<br/ >
-Huge list of bookmarklets - http://www.squarefree.com/bookmarklets/<br/ >
+===HTTP general testing / fingerprinting===
-<br/ >
+Wbox: HTTP testing tool - http://hping.org/wbox/<br />
-<b>Java web application security</b><br/ >
+ht://Check - http://htcheck.sourceforge.net/<br />
-Java Explorer - http://metal.hurlant.com/jexplore/<br/ >
+WebInject - http://www.webinject.org/<br />
-HTTPClient - http://www.innovation.ch/java/HTTPClient/<br/ >
+Torture.pl Home Page - http://stein.cshl.org/~lstein/torture/<br />
-<br/ >
+JoeDog's Seige - http://www.joedog.org/JoeDog/Siege/<br />
-<b>SSL certificate checking / scanning</b><br/ >
+OPEN-LABS: metoscan (http method testing) - http://www.open-labs.org/<br />
-[ZIP] THCSSLCheck - http://thc.org/root/tools/THCSSLCheck.zip<br/ >
+Load-balancing detector - http://ge.mine.nu/lbd.html<br />
-[ZIP] Foundstone SSLDigger - http://foundstone.com/resources/freetooldownload.htm?file=ssldigger.zip<br/ >
+HMAP - http://ujeni.murkyroc.com/hmap/<br />
-Cert Viewer Plus (Firefox Add-on) - https://addons.mozilla.org/firefox/1964/<br/ >
+Net-Square: httprint - http://net-square.com/httprint/<br />
-<br/ >
+Wpoison: http stress testing - http://wpoison.sourceforge.net/<br />
-<b>Honeyclients, Web Application, and Web Proxy honeypots</b><br/ >
+Net-square: MSNPawn - http://net-square.com/msnpawn/index.shtml<br />
-HoneyC: the low-interaction honeyclient - http://honeyc.sourceforge.net/<br/ >
+hcraft: HTTP Vuln Request Crafter - http://druid.caughq.org/projects/hcraft/<br />
-Capture: a high-interaction honeyclient - http://capture-hpc.sourceforge.net/<br/ >
+rfp.labs: LibWhisker - http://www.wiretrip.net/rfp/lw.asp<br />
-Google Hack Honeypot - http://ghh.sourceforge.net/<br/ >
+Nikto - http://www.cirt.net/code/nikto.shtml<br />
-PHP.Hop - PHP Honeynet Project - http://www.rstack.org/phphop/<br/ >
+Websecurify - http://www.websecurify.com<br />
-<br/ >
+W3AF: Web Application Attack and Audit Framework - http://w3af.sourceforge.net/<br />
-<b>Blackhat SEO and maybe some whitehat SEO</b><br/ >
+twill - http://twill.idyll.org/<br />
-SearchStatus - http://www.quirk.biz/searchstatus/<br/ >
+DirBuster - http://www.owasp.org/index.php/Category:OWASP_DirBuster_Project<br />
-SEO for Firefox (Firefox Add-on) - http://tools.seobook.com/firefox/seo-for-firefox.html<br/ >
+[ZIP] DFF Scanner - http://security-net.biz/files/dff/DFF.zip<br />
-<br/ >
+[ZIP] The Elza project - http://packetstormsecurity.org/web/elza-1.4.7-beta.zip ([http://www.stoev.org/elza.html dead link])<br />
-<b>Footprinting for web application security</b><br/ >
+HackerFox and Hacking Addons Bundled: Portable Firefox with web hacking addons bundled - http://sf.net/projects/hackfox <br />
-Fierce Domain Scanner - http://ha.ckers.org/fierce/<br/ >
-Googlegath - http://www.nothink.org/perl/googlegath/<br/ >
+===== dead, vanished links (March/2012) =====
-<br/ >
+Mumsie - http://www.secureworks.com/research/tools/mumsie/ ([http://www.lurhq.com/tools/mumsie.html dead link])<br />
-<b>Browser Defenses</b><br/ >
+Torture.pl Home Page - source probably here http://www.foo.be/docs/tpj/issues/vol2_4/tpj0204-0002.html ([http://stein.cshl.org/~lstein/torture/ dead link])<br />
-DieHard - http://www.diehard-software.org/<br/ >
-NoMoXSS - http://www.seclab.tuwien.ac.at/projects/jstaint/<br/ >
+===Cookie editing / poisoning===
-Request Rodeo - http://savannah.nongnu.org/projects/requestrodeo<br/ >
+[TGZ] stompy: session id tool - http://freecode.com/projects/stompy ([http://lcamtuf.coredump.cx/stompy.tgz old link])<br />
-FlashBlock - http://flashblock.mozdev.org/<br/ >
+Add'N Edit Cookies (AnEC, Firefox Add-on) - http://addneditcookies.mozdev.org/<br />
-NoScript - http://www.noscript.net/<br/ >
+CookieCuller (Firefox Add-on) - http://cookieculler.mozdev.org/<br />
-Adblock - <br/ >
+CookiePie (Firefox Add-on) - http://www.nektra.com/oss/firefox/extensions/cookiepie/<br />
-httpOnly in Firefox - http://blog.php-security.org/archives/40-httpOnly-Cookies-in-Firefox-2.0.html<br/ >
+CookieSpy - http://www.codeproject.com/shell/cookiespy.asp<br />
-SafeCache - http://www.safecache.com/<br/ >
+Cookies Explorer - http://www.dutchduck.com/Features/Cookies.aspx<br />
-SafeHistory - http://www.safehistory.com/<br/ >
+Cookie Safe - https://addons.mozilla.org/de/firefox/addon/2497/ <br />
-PrefBar - http://prefbar.mozdev.org/<br/ >
-QArchive.org web file checker - https://addons.mozilla.org/firefox/4115/<br/ >
+==Fuzzer==
+===Browser-based security fuzzing / checking===
+Zalewski's MangleMe - http://freecode.com/projects/mangleme tool see here http://lcamtuf.coredump.cx/soft/mangleme.tgz ([http://lcamtuf.coredump.cx/mangleme/mangle.cgi mangle.cgi dead link]) <br />
+hdm's tools: Hamachi, CSSDIE, DOM-Hanoi, AxMan - http://metasploit.com/users/hdm/tools/<br />
+Peach Fuzzer Framework - http://peachfuzzer.com/  ([http://peachfuzz.sourceforge.net old link])/<br />
+TagBruteForcer - http://research.eeye.com/html/tools/RT20060801-3.html<br />
+PROTOS Test-Suite: c05-http-reply - http://www.ee.oulu.fi/research/ouspg/protos/testing/c05/http-reply/index.html<br />
+COMRaider - https://github.com/dzzie/COMRaider ([http://labs.idefense.com dead link])<br />
+BrowserCheck - http://www.heise-security.co.uk/services/browsercheck/<br />
+Stealing information using DNS pinning demo - http://www.jumperz.net/index.php?i=2&a=1&b=7<br />
+Javascript Website Login Checker - http://ha.ckers.org/weird/javascript-website-login-checker.html<br />
+Mozilla Activex - http://www.adamlock.com/mozilla/ ([http://www.iol.ie/~locka/mozilla/mozilla.htm old link])<br />
+Mr. T (Master Recon Tool, includes Read Firefox Settings PoC) - http://ha.ckers.org/mr-t/<br />
+Test your installation of Java software - http://java.com/en/download/installed.jsp?detect=jre&try=1<br />
+WebPageFingerprint - Light-weight Greasemonkey Fuzzer - http://userscripts.org/scripts/show/30285<br />
+===== dead, vanished links (March/2012) =====
+bcheck - http://bcheck.scanit.be/bcheck/<br />
+Cross-browser Exploit Tests - http://www.jungsonnstudios.com/cool.php<br />
+Jungsonn's Black Dragon Project - http://blackdragon.jungsonnstudios.com/<br />
+Vulnerable Adobe Plugin Detection For UXSS PoC - http://www.0x000000.com/?i=324<br />
+About Flash: is your flash up-to-date? - http://www.macromedia.com/software/flash/about/<br />
+Stop-Phishing: Projects page - http://www.indiana.edu/~phishing/?projects<br />
+LinkScanner - <nowiki>http://linkscanner.explabs.com/linkscanner/default.asp</nowiki> (seems to be a vendor link now)<br />
+===Application and protocol fuzzing (random instead of targeted)===
+Sulley - http://fuzzing.org/<br />
+taof: The Art of Fuzzing - http://sourceforge.net/projects/taof/<br />
+zzuf: multipurpose fuzzer - http://sam.zoy.org/zzuf/<br />
+autodafé: an act of software torture - http://autodafe.sourceforge.net/<br />
+===== dead, vanished links (March/2012) =====
+EFS and GPF: Evolutionary Fuzzing System - http://www.appliedsec.com/resources.html<br />
+==Ajax and XHR scanning==
+Sahi - http://sahi.co.in/<br />
+scRUBYt - http://scrubyt.org/<br />
+jQuery - http://jquery.com/<br />
+jquery-include - http://www.gnucitizen.org/projects/jquery-include<br />
+Sprajax - http://www.denimgroup.com/sprajax.html<br />
+Watir - http://wtr.rubyforge.org/<br />
+Watij - http://watij.com/<br />
+Watin - http://watin.sourceforge.net/<br />
+RBNarcissus - http://idontsmoke.co.uk/2005/rbnarcissus/<br />
+SpiderTest (Spider Fuzz plugin) - http://blog.caboo.se/articles/2007/2/21/the-fabulous-spider-fuzz-plugin<br />
+Javascript Inline Debugger (jasildbg) - http://jasildbg.googlepages.com/<br />
+Firebug Lite - http://www.getfirebug.com/lite.html<br />
+firewaitr - http://code.google.com/p/firewatir/<br />
+==SQL injection scanning==
+x90.org: home of Absinthe, Mezcal, etc - http://0x90.org/releases.php<br />
+SQLiX - http://www.owasp.org/index.php/Category:OWASP_SQLiX_Project<br />
+sqlninja: a SQL Server injection and takover tool - http://sqlninja.sourceforge.net/<br />
+JustinClarke's SQL Brute - http://www.justinclarke.com/archives/2006/03/sqlbrute.html<br />
+BobCat - http://www.northern-monkee.co.uk/projects/bobcat/bobcat.html<br />
+sqlmap - http://sqlmap.sourceforge.net/<br />
+Scully: SQL Server DB Front-End and Brute-Forcer - http://www.sensepost.com/research/scully/<br />
+FG-Injector - http://www.flowgate.net/?lang=en&seccion=herramientas<br />
+PRIAMOS - http://www.priamos-project.com/<br />
+==Web services enumeration / scanning / fuzzing==
+WebServiceStudio2.0 - http://www.codeplex.com/WebserviceStudio<br />
+Net-square: wsChess - http://net-square.com/wschess/index.shtml<br />
+WSFuzzer - http://www.owasp.org/index.php/Category:OWASP_WSFuzzer_Project<br />
+SIFT: web method search tool - http://www.sift.com.au/73/171/sift-web-method-search-tool.htm<br />
+iSecPartners: WSMap, WSBang, etc - http://www.isecpartners.com/tools.html<br />
+==3rd party services that aid in web application security assessment==
+Netcraft - http://www.netcraft.net<br />
+AboutURL - http://www.abouturl.com/<br />
+The Scrutinizer - http://www.scrutinizethis.com/<br />
+net.toolkit - http://clez.net/<br />
+ServerSniff - http://www.serversniff.net/<br />
+Online Microsoft script decoder - http://www.greymagic.com/security/tools/decoder/<br />
+Webmaster-Toolkit - http://www.webmaster-toolkit.com/<br />
+myIPNeighbbors, et al - http://digg.com/security/MyIPNeighbors_Find_Out_Who_Else_is_Hosted_on_Your_Site_s_IP_Address<br />
+PHP charset encoding - http://h4k.in/encoding<br />
+data: URL testcases - http://h4k.in/dataurl<br />
+=Server side stuff=
+==PHP static analysis and file inclusion scanning==
+Pixy: Open source flow based discovery of XSS and SQLi - http://pixybox.seclab.tuwien.ac.at/pixy/<br />
+PHP-SAT.org: Static analysis for PHP - http://www.program-transformation.org/PHP/<br />
+Unl0ck Research Team: tool for searching in google for include bugs - http://unl0ck.net/tools.php<br />
+FIS: File Inclusion Scanner - http://www.segfault.gr/index.php?cat_id=3&cont_id=25<br />
+PHPSecAudit - http://developer.spikesource.com/projects/phpsecaudit<br />
+==PHP Defensive Tools==
+PHPInfoSec - Check phpinfo configuration for security - http://phpsec.org/projects/phpsecinfo/ <br />
+Greasemonkey Replacement can be found at http://yehg.net/lab/#tools.greasemonkey <br />
+Php-Brute-Force-Attack Detector - Detect your web servers being scanned by brute force tools - http://yehg.net/lab/pr0js/files.php/php_brute_force_detect.zip <br />
+PHP-Login-Info-Checker (Strictly enforce admins/users to select stronger passwords via url loginfo_checker.php?testlic) - http://yehg.net/lab/pr0js/files.php/loginfo_checkerv0.1.zip, http://yehg.net/lab/pr0js/files.php/phploginfo_checker_demo.zip <br />
+php-DDOS-Shield (prevent idiot distributed bots which discontinue their flooding attacks by identifying HTTP 503 header code) - http://code.google.com/p/ddos-shield/ <br />
+PHPMySpamFIGHTER - http://yehg.net/lab/pr0js/files.php/phpmyspamfighter.zip, http://yehg.net/lab/pr0js/files.php/phpMySpamFighter_demo.rar <br />
+==Web Application Firewall (WAF) and Intrusion Detection (APIDS) rules and resources==
+APIDS on Wikipedia - http://en.wikipedia.org/wiki/APIDS<br />
+PHP Intrusion Detection System (PHP-IDS) - http://php-ids.org/ http://code.google.com/p/phpids/<br />
+dotnetids - http://code.google.com/p/dotnetids/<br />
+Secure Science InterScout - http://www.securescience.com/home/newsandevents/news/interscout1.0.html<br />
+Remo: whitelist rule editor for mod_security - http://remo.netnea.com/<br />
+GotRoot: ModSecuirty rules - http://www.gotroot.com/tiki-index.php?page=mod_security+rules<br />
+The Web Security Gateway (WSGW) - http://wsgw.sourceforge.net/<br />
+mod_security rules generator - http://noeljackson.com/tools/modsecurity/<br />
+Mod_Anti_Tamper - http://www.wisec.it/projects.php?id=3<br />
+[TGZ] Automatic Rules Generation for Mod_Security - http://www.wisec.it/rdr.php?fn=/Projects/Rule-o-matic.tgz<br />
+AQTRONIX WebKnight - http://www.aqtronix.com/?PageID=99<br />
+Akismet: blog spam defense - http://akismet.com/<br />
+Samoa: Formal tools for securing web services - http://research.microsoft.com/projects/samoa/<br />
+=Code=
+==Web application non-specific static source-code analysis==
+Pixy: a static analysis tool for detecting XSS vulnerabilities - http://www.seclab.tuwien.ac.at/projects/pixy/<br />
+Brixoft.Net: Source Edit - http://www.brixoft.net/prodinfo.asp?id=1<br />
+Security compass web application auditing tools (SWAAT) - http://www.owasp.org/index.php/Category:OWASP_SWAAT_Project<br />
+An even more complete list here - http://www.cs.cmu.edu/~aldrich/courses/654/tools/<br />
+A nice list that claims some demos available - http://www.cs.cmu.edu/~aldrich/courses/413/tools.html<br />
+A smaller, but also good list - http://spinroot.com/static/<br />
+Yasca: A highly extensible source code analysis framework; incorporates several analysis tools into one package. http://www.yasca.org/<br />
+==Static analysis for C/C++ (CGI, ISAPI, etc) in web applications==
+RATS - http://www.securesoftware.com/resources/download_rats.html<br />
+ITS4 - http://www.cigital.com/its4/<br />
+FlawFinder - http://www.dwheeler.com/flawfinder/<br />
+Splint - http://www.splint.org/<br />
+Uno - http://spinroot.com/uno/<br />
+BOON (Buffer Overrun detectiON) - http://www.cs.berkeley.edu/~daw/boon/ http://boon.sourceforge.net<br />
+Valgrind - http://www.valgrind.org/<br />
+==Java static analysis, security frameworks, and web application security tools==
+LAPSE - http://suif.stanford.edu/~livshits/work/lapse/ <br />
+CodePro Analytix - http://code.google.com/webtoolkit/tools/codepro/doc/index.html<br />
+HDIV Struts - http://hdiv.org/<br />
+Orizon - http://sourceforge.net/projects/orizon/<br />
+FindBugs: Find bugs in Java programs - http://findbugs.sourceforge.net/<br />
+PMD - http://pmd.sourceforge.net/<br />
+CUTE: A Concolic Unit Testing Engine for C and Java - http://osl.cs.uiuc.edu/~ksen/cute/<br />
+EMMA - http://emma.sourceforge.net/<br />
+JLint - http://jlint.sourceforge.net/<br />
+Java PathFinder - http://javapathfinder.sourceforge.net/<br />
+Fujaba: Move between UML and Java source code - http://wwwcs.uni-paderborn.de/cs/fujaba/<br />
+Checkstyle - http://checkstyle.sourceforge.net/<br />
+Cookie Revolver Security Framework - http://sourceforge.net/projects/cookie-revolver<br />
+tinapoc - http://sourceforge.net/projects/tinapoc<br />
+jarsigner - http://java.sun.com/j2se/1.5.0/docs/tooldocs/solaris/jarsigner.html<br />
+Solex - http://solex.sourceforge.net/<br />
+Java Explorer - http://metal.hurlant.com/jexplore/<br />
+HTTPClient - http://www.innovation.ch/java/HTTPClient/<br />
+another HttpClient - http://jakarta.apache.org/commons/httpclient/<br />
+a list of code coverage and analysis tools for Java - http://mythinkpond.blogspot.com/2007/06/java-foss-freeopen-source-software.html<br />
+==Microsoft .NET static analysis and security framework tools, mostly for ASP.NET and ASP.NET AJAX, but also C# and VB.NET==
+* Visual Studio 2008 Code Analysis, available in:
+** VSTS 2008 Development Edition (http://msdn.microsoft.com/vsts2008/products/bb933752.aspx) and
+** VSTS 2008 Team Suite (http://msdn.microsoft.com/vsts2008/products/bb933735.aspx)
+* Visual Studio 2005 Code Analyzer, available in:
+** Visual Studio 2005 Team Edition for Software Developers  (http://msdn.microsoft.com/en-us/vstudio/aa718806.aspx)
+** Visual Studio 2005 Team Suite (http://msdn.microsoft.com/en-us/vstudio/aa718806.aspx)
+* Web Development Helper - http://www.nikhilk.net/Project.WebDevHelper.aspx
+* FxCop:
+** (blog) http://blogs.msdn.com/fxcop/
+** (download) http://code.msdn.microsoft.com/codeanalysis
+* Microsoft internal tools you can't have yet:
+** http://www.microsoft.com/windows/cse/pa_projects.mspx
+** http://research.microsoft.com/Pex/
+** http://www.owasp.org/images/5/5b/OWASP_IL_7_FuzzGuru.pdf<br />
+=Database security assessment=
+Scuba by Imperva Database Vulnerability Scanner - http://www.imperva.com/scuba/<br />
+=Threat modeling=
+Microsoft Threat Analysis and Modeling Tool v2.1 (TAM) - http://www.microsoft.com/downloads/details.aspx?FamilyID=59888078-9daf-4e96-b7d1-944703479451&displaylang=en<br />
+Amenaza: Attack Tree Modeling (SecurITree) - http://www.amenaza.com/software.php<br />
+Octotrike - http://www.octotrike.org/<br />
+=Misc=
+==RSS extensions and caching==
+rss-cache - http://www.dubfire.net/chris/projects/rss-cache/<br />
+==Blackhat SEO and maybe some whitehat SEO==
+SearchStatus (Firefox Add-on) - http://www.quirk.biz/searchstatus/<br />
+SEO for Firefox (Firefox Add-on) - http://tools.seobook.com/firefox/seo-for-firefox.html<br />
+SEOQuake (Firefox Add-on) - http://www.seoquake.com/<br />
+Analytics seo - http://www.analyticsseo.com/<br />
+==Web application security malware, backdoors, and evil code==
+Jikto - http://busin3ss.name/jikto-in-the-wild/<br />
+XSS Shell - http://ferruh.mavituna.com/article/?1338<br />
+XSS-Proxy - http://xss-proxy.sourceforge.net<br />
+AttackAPI - http://www.gnucitizen.org/projects/attackapi/<br />
+FFsniFF - http://azurit.elbiahosting.sk/ffsniff/<br />
+HoneyBlog's web-based junkyard - http://honeyblog.org/junkyard/web-based/<br />
+BeEF - http://www.beefproject.com<br />
+Firefox Extension Scanner (FEX) - http://www.gnucitizen.org/projects/fex/<br />
+What is my IP address? - http://reglos.de/myaddress/<br />
+xRumer: blogspam automation tool - http://www.botmaster.net/movies/XFull.htm<br />
+SpyJax - http://www.merchantos.com/makebeta/tools/spyjax/<br />
+Greasecarnaval - http://www.gnucitizen.org/projects/greasecarnaval<br />
+Technika - http://www.gnucitizen.org/projects/technika/<br />
+Load-AttackAPI bookmarklet - http://www.gnucitizen.org/projects/load-attackapi-bookmarklet<br />
+MD's Projects: JS port scanner, pinger, backdoors, etc - http://michaeldaw.org/my-projects/<br />
+==Honeyclients, Web Application, and Web Proxy honeypots==
+Honeyclient Project: an open-source honeyclient - http://www.honeyclient.org/trac/ <br />
+HoneyC: the low-interaction honeyclient - http://honeyc.sourceforge.net/<br />
+Capture: a high-interaction honeyclient - http://capture-hpc.sourceforge.net/<br />
+Google Hack Honeypot - http://ghh.sourceforge.net/<br />
+PHP.Hop - PHP Honeynet Project - http://www.rstack.org/phphop/<br />
+SpyBye - http://www.monkey.org/~provos/spybye/<br />
+Honeytokens - http://www.securityfocus.com/infocus/1713<br />
+=Browser Privacy/ Defenses=
+==Browser Defenses==
+Adblock Plus (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/adblock-plus/<br />
+NoScript (Firefox Add-on) - http://www.noscript.net/<br />
+DieHard - http://www.diehard-software.org/<br />
+LocalRodeo (Firefox Add-on) - http://databasement.net/labs/localrodeo/<br />
+NoMoXSS - http://www.seclab.tuwien.ac.at/projects/jstaint/<br />
+FlashBlock (Firefox Add-on) - http://flashblock.mozdev.org/<br />
+FormFox (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1579/<br />
+SafeCache (Firefox Add-on) - http://www.safecache.com/<br />
+SafeHistory (Firefox Add-on) - http://www.safehistory.com/<br />
+PrefBar (Firefox Add-on) - http://prefbar.mozdev.org/<br />
+All-in-One Sidebar (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/1027/<br />
+Update Notified (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/2098/<br />
+FireKeeper - http://firekeeper.mozdev.org/<br />
+Greasemonkey: XSS Malware Script Detector - http://yehg.net/lab/#tools.greasemonkey<br />
+==Browser Privacy==
+BetterPrivacy (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/betterprivacy/<br />
+TrackMeNot (Firefox Add-on) - https://addons.mozilla.org/en-US/firefox/addon/trackmenot/<br />
+Privacy Bird - http://www.privacybird.com/<br />
+HTTPS Everywhere - https://www.eff.org/https-everywhere<br />

Difference between revisions of "Phoenix/Tools"

Latest revision as of 15:27, 18 October 2017

Testing grounds

LiveCDs

Test sites

External Assessment

Browser

Add-ons for Firefox that help with general web application security

Browser-based HTTP tampering / editing / replaying

Add-ons for Firefox that help with Javascript and Ajax web application security

Bookmarklets that aid in web application security

Footprinting for web application security

Tools

SSL certificate checking / scanning

HTTP proxying / editing

RSnake's XSS cheat sheet based-tools, webapp fuzzing, and encoding tools

HTTP general testing / fingerprinting

dead, vanished links (March/2012)

Cookie editing / poisoning

Fuzzer

Browser-based security fuzzing / checking

dead, vanished links (March/2012)

Application and protocol fuzzing (random instead of targeted)

dead, vanished links (March/2012)

Ajax and XHR scanning

SQL injection scanning

Web services enumeration / scanning / fuzzing

3rd party services that aid in web application security assessment

Server side stuff

PHP static analysis and file inclusion scanning

PHP Defensive Tools

Web Application Firewall (WAF) and Intrusion Detection (APIDS) rules and resources

Code

Web application non-specific static source-code analysis

Static analysis for C/C++ (CGI, ISAPI, etc) in web applications

Java static analysis, security frameworks, and web application security tools

Microsoft .NET static analysis and security framework tools, mostly for ASP.NET and ASP.NET AJAX, but also C# and VB.NET

Database security assessment

Threat modeling

Misc

RSS extensions and caching

Blackhat SEO and maybe some whitehat SEO

Web application security malware, backdoors, and evil code

Honeyclients, Web Application, and Web Proxy honeypots

Browser Privacy/ Defenses

Browser Defenses

Browser Privacy

Navigation menu

Search