Appendix A: Testing Tools

[Up]

Open Source Black Box Testing tools

 * OWASP WebScarab - http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project


 * OWASP CAL9000 - http://www.owasp.org/index.php/Category:OWASP_CAL9000_Project
 * CAL9000 is a collection of browser-based tools that enable more effective and efficient manual testing efforts. Includes an XSS Attack Library, Character Encoder/Decoder, HTTP Request Generator and Response Evaluator, Testing Checklist, Automated Attack Editor and much more.


 * OWASP Pantera - http://www.owasp.org/index.php/Category:OWASP_Pantera_Web_Assessment_Studio_Project


 * SPIKE - http://www.immunitysec.com
 * Paros - http://www.proofsecure.com
 * Burp Proxy - http://www.portswigger.net
 * Achilles Proxy - http://www.mavensecurity.com/achilles
 * Odysseus Proxy - http://www.wastelands.gen.nz/odysseus/
 * Webstretch Proxy - http://sourceforge.net/projects/webstretch
 * Firefox LiveHTTPHeaders, Tamper Data and Developer Tools- http://www.mozdev.org
 * Sensepost Wikto (Google cached fault-finding) - http://www.sensepost.com/research/wikto/index2.html

Testing for specific vulnerabilities
Testing AJAX  Testing for SQL Injection  Testing Oracle Testing SSL  Testing for Brute Force Password Testing for HTTP Methods Testing Buffer Overflow Fuzzer Googling
 * OWASP SPRAJAX - http://www.owasp.org/index.php/Category:OWASP_Sprajax_Project
 * OWASP SQLiX - http://www.owasp.org/index.php/Category:OWASP_SQLiX_Project
 * Multiple DBMS Sql Injection tool - [SQL Power Injector]
 * MySql Blind Injection Bruteforcing, Reversing.org - [sqlbftools]
 * Antonio Parata: Dump Files by sql inference on Mysql - [SqlDumper]
 * Sqlninja: a SQL Server Injection&Takeover Tool - http://sqlninja.sourceforge.net
 * SQLmap - http://www.linux.it/~belch/creations/sqlmap-0.0.1.tgz
 * Absinthe 1.1 (formerly SQLSqueal) - http://www.0x90.org/releases/absinthe/
 * TNS Listener tool (Perl) - http://www.jammed.com/%7Ejwa/hacks/security/tnscmd/tnscmd-doc.html
 * Toad for Oracle - http://www.quest.com/toad
 * Foundstone SSL Digger - http://www.foundstone.com/resources/proddesc/ssldigger.htm
 * THC Hydra - http://www.thc.org/thc-hydra/
 * John the Ripper - http://www.openwall.com/john/
 * Brutus - http://www.hoobie.net/brutus/
 * NetCat - http://www.vulnwatch.org/netcat
 * OllyDbg: "A windows based debugger used for analyzing buffer overflow vulnerabilities" - http://www.ollydbg.de
 * Spike, A fuzzer framework that can be used to explore vulnerabilities and perform length testing - http://www.immunitysec.com/downloads/SPIKE2.9.tgz
 * Brute Force Binary Tester (BFB), A proactive binary checker - http://bfbtester.sourceforge.net/
 * Metasploit, A rapid exploit development and Testing frame work - http://www.metasploit.com/projects/Framework/
 * OWASP WSFuzzer - http://www.owasp.org/index.php/Category:OWASP_WSFuzzer_Project
 * Foundstone Sitedigger (Google cached fault-finding) - http://www.foundstone.com/resources/proddesc/sitedigger.htm

Commercial Black Box Testing tools

 * Watchfire AppScan - http://www.watchfire.com
 * Cenzic Hailstorm - http://www.cenzic.com/products_services/cenzic_hailstorm.php
 * SPI Dynamics WebInspect - http://www.spidynamics.com
 * Burp Intruder - http://portswigger.net/intruder
 * Acunetix Web Vulnerability Scanner - http://www.acunetix.com/
 * ScanDo - http://www.kavado.com
 * WebSleuth - http://www.sandsprite.com
 * NT Objectives NTOSpider - http://www.ntobjectives.com/products/ntospider.php
 * Fortify Pen Testing Team Tool - http://www.fortifysoftware.com/products/tester
 * Sandsprite Web Sleuth - http://sandsprite.com/Sleuth/
 * MaxPatrol Security Scanner - http://www.maxpatrol.com/
 * Ecyware GreenBlue Inspector - http://www.ecyware.com/
 * Parasoft WebKing (more QA-type tool)

Open Source / Freeware

 * http://www.securesoftware.com
 * FlawFinder - http://www.dwheeler.com/flawfinder
 * Microsoft’s FXCop - http://www.gotdotnet.com/team/fxcop
 * Split - http://splint.org
 * Boon - http://www.cs.berkeley.edu/~daw/boon
 * Pscan - http://www.striker.ottawa.on.ca/~aland/pscan

Commercial

 * Fortify - http://www.fortifysoftware.com
 * Ounce labs Prexis - http://www.ouncelabs.com
 * GrammaTech - http://www.grammatech.com
 * ParaSoft - http://www.parasoft.com
 * ITS4 - http://www.cigital.com/its4
 * CodeWizard - http://www.parasoft.com/products/wizard

Runtime Analysis

 * Rational PurifyPlus - http://www-306.ibm.com/software/awdtools

Binary Analysis

 * BugScam - http://sourceforge.net/projects/bugscam
 * BugScan - http://www.hbgary.com

Requirements Management

 * Rational Requisite Pro - http://www-306.ibm.com/software/awdtools/reqpro

Site Mirroring
 * wget - http://www.gnu.org/software/wget, http://www.interlog.com/~tcharron/wgetwin.html
 * curl - http://curl.haxx.se
 * Sam Spade - http://www.samspade.org
 * Xenu - http://home.snafu.de/tilman/xenulink.html