Difference between revisions of "Appendix A: Testing Tools"

From OWASP
Jump to: navigation, search
(16 intermediate revisions by one user not shown)
Line 21: Line 21:
 
* '''Burp Proxy''' - http://www.portswigger.net/Burp/
 
* '''Burp Proxy''' - http://www.portswigger.net/Burp/
 
** Burp Proxy is an intercepting proxy server for security testing of web applications it allows Intercepting and modifying all HTTP/S traffic passing in both directions, it can work with custom SSL certificates and non-proxy-aware clients.
 
** Burp Proxy is an intercepting proxy server for security testing of web applications it allows Intercepting and modifying all HTTP/S traffic passing in both directions, it can work with custom SSL certificates and non-proxy-aware clients.
 
+
* '''Odysseus Proxy''' - http://www.wastelands.gen.nz/odysseus/
* Achilles Proxy - http://www.mavensecurity.com/achilles
+
** Odysseus is a proxy server, which acts as a man-in-the-middle during an HTTP session. A typical HTTP proxy will relay packets to and from a client browser and a web server. It will intercept an HTTP session's data in either direction.
* Odysseus Proxy - http://www.wastelands.gen.nz/odysseus/
+
* '''Webstretch Proxy''' - http://sourceforge.net/projects/webstretch
* Webstretch Proxy - http://sourceforge.net/projects/webstretch
+
** Webstretch Proxy enable users to view and alter all aspects of communications with a web site via a proxy. It can also be used for debugging during development.
* Firefox LiveHTTPHeaders - https://addons.mozilla.org/en-US/firefox/addon/live-http-headers/
+
*  '''WATOBO''' - http://sourceforge.net/apps/mediawiki/watobo/index.php?title=Main_Page
* Firefox Tamper Data - https://addons.mozilla.org/en-US/firefox/addon/tamper-data/
+
** WATOBO works like a local proxy, similar to Webscarab, ZAP or BurpSuite and it supports passive and active checks.
* Firefox Web Developer Tools - https://addons.mozilla.org/en-US/firefox/addon/web-developer/
+
* '''Firefox LiveHTTPHeaders''' - https://addons.mozilla.org/en-US/firefox/addon/live-http-headers/
* Firefox Firebug - http://getfirebug.com/
+
** View HTTP headers of a page and while browsing.
* Grendel-Scan - http://securitytube-tools.net/index.php?title=Grendel_Scan
+
* '''Firefox Tamper Data''' - https://addons.mozilla.org/en-US/firefox/addon/tamper-data/
* OWASP SWFIntruder - http://www.mindedsecurity.com/swfintruder.html
+
** Use tamperdata to view and modify HTTP/HTTPS headers and post parameters
* Sensepost Wikto (Google cached fault-finding) - http://www.sensepost.com/labs/tools/pentest/wikto
+
* '''Firefox Web Developer Tools''' - https://addons.mozilla.org/en-US/firefox/addon/web-developer/
* w3af - http://w3af.org
+
** The Web Developer extension adds various web developer tools to the browser.
* skipfish - http://code.google.com/p/skipfish/
+
* '''DOM Inspector''' - https://developer.mozilla.org/en/docs/DOM_Inspector
 
+
**  DOM Inspector is a developer tool used to inspect, browse, and edit the Document Object Model (DOM)
 +
* '''Firefox Firebug''' - http://getfirebug.com/
 +
** Firebug integrates with Firefox to edit, debug, and monitor CSS, HTML, and JavaScript.
 +
* '''Grendel-Scan''' - http://securitytube-tools.net/index.php?title=Grendel_Scan
 +
** Grendel-Scan is an automated security scanning of web applications and also supports manual penetration testing.
 +
*  '''OWASP SWFIntruder''' - http://www.mindedsecurity.com/swfintruder.html
 +
** SWFIntruder (pronounced Swiff Intruder) is the first tool specifically developed for analyzing and testing security of Flash applications at runtime.
 +
* '''SWFScan''' - http://h30499.www3.hp.com/t5/Following-the-Wh1t3-Rabbit/SWFScan-FREE-Flash-decompiler/ba-p/5440167
 +
** Flash decompiler
 +
*  '''Wikto''' - http://www.sensepost.com/labs/tools/pentest/wikto
 +
** Wikto features including fuzzy logic error code checking, a back-end miner, Google-assisted directory mining and real time HTTP request/response monitoring.
 +
* '''w3af''' - http://w3af.org
 +
** w3af is a Web Application Attack and Audit Framework. The project’s goal is finding and exploiting web application vulnerabilities.
 +
* '''skipfish''' - http://code.google.com/p/skipfish/
 +
** Skipfish is an active web application security reconnaissance tool.
 +
* '''Web Developer toolbar''' - https://chrome.google.com/webstore/detail/bfbameneiokkgbdmiekhjnmfkcnldhhm
 +
** The Web Developer extension adds a toolbar button to the browser with various web developer tools. This is the official port of the Web Developer extension for Firefox.
 +
** '''HTTP Request Maker''' - https://chrome.google.com/webstore/detail/kajfghlhfkcocafkcjlajldicbikpgnp?hl=en-US
 +
* Request Maker is a tool for penetration testing. With it you can easily capture requests made by web pages, tamper with the URL, headers and POST data and, of course, make new requests
 +
** '''Cookie Editor''' - https://chrome.google.com/webstore/detail/fngmhnnpilhplaeedifhccceomclgfbg?hl=en-US
 +
* Edit This Cookie is a cookie manager. You can add, delete, edit, search, protect and block cookies
 +
** '''Cookie swap''' - https://chrome.google.com/webstore/detail/dffhipnliikkblkhpjapbecpmoilcama?hl=en-US
 +
* Swap My Cookies is a session manager, it manages cookies, letting you login on any website with several different accounts.
  
  
Line 49: Line 71:
 
* Bernardo Damele A. G.: sqlmap, automatic SQL injection tool - http://sqlmap.org/
 
* Bernardo Damele A. G.: sqlmap, automatic SQL injection tool - http://sqlmap.org/
 
* Absinthe 1.1 (formerly SQLSqueal) - http://sourceforge.net/projects/absinthe/
 
* Absinthe 1.1 (formerly SQLSqueal) - http://sourceforge.net/projects/absinthe/
* SQLInjector - http://www.databasesecurity.com/sql-injector.htm
+
* SQLInjector - Uses inference techniques to extract data and determine the backend database server.  http://www.databasesecurity.com/sql-injector.htm
 
* Bsqlbf-v2: A perl script allows extraction of data from Blind SQL Injections - http://code.google.com/p/bsqlbf-v2/
 
* Bsqlbf-v2: A perl script allows extraction of data from Blind SQL Injections - http://code.google.com/p/bsqlbf-v2/
 
* Pangolin: An automatic SQL injection penetration testing tool - http://www.darknet.org.uk/2009/05/pangolin-automatic-sql-injection-tool/
 
* Pangolin: An automatic SQL injection penetration testing tool - http://www.darknet.org.uk/2009/05/pangolin-automatic-sql-injection-tool/
Line 70: Line 92:
 
* Medusa - http://www.foofus.net/~jmk/medusa/medusa.html
 
* Medusa - http://www.foofus.net/~jmk/medusa/medusa.html
 
*Ncat - http://nmap.org/ncat/
 
*Ncat - http://nmap.org/ncat/
 +
 +
  
 
==== Testing Buffer Overflow ====
 
==== Testing Buffer Overflow ====

Revision as of 14:19, 22 April 2013

This article is part of the new OWASP Testing Guide v4. 
At the moment the project is in the REVIEW phase.

Back to the OWASP Testing Guide v4 ToC: https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents Back to the OWASP Testing Guide Project: http://www.owasp.org/index.php/OWASP_Testing_Project

Contents


Open Source Black Box Testing tools

General Testing


Testing for specific vulnerabilities

Testing for DOM XSS

Testing AJAX

Testing for SQL Injection



Testing Oracle

Testing SSL

Testing for Brute Force Password


Testing Buffer Overflow

Fuzzer

Googling

Commercial Black Box Testing tools

Source Code Analyzers

Open Source / Freeware

Commercial

Acceptance Testing Tools

Acceptance testing tools are used to validate the functionality of web applications. Some follow a scripted approach and typically make use of a Unit Testing framework to construct test suites and test cases. Most, if not all, can be adapted to perform security specific tests in addition to functional tests.

Open Source Tools

  • WATIR - http://wtr.rubyforge.org
    • A Ruby based web testing framework that provides an interface into Internet Explorer.
    • Windows only.
  • HtmlUnit - http://htmlunit.sourceforge.net
    • A Java and JUnit based framework that uses the Apache HttpClient as the transport.
    • Very robust and configurable and is used as the engine for a number of other testing tools.
  • jWebUnit - http://jwebunit.sourceforge.net
    • A Java based meta-framework that uses htmlunit or selenium as the testing engine.
  • Canoo Webtest - http://webtest.canoo.com
    • An XML based testing tool that provides a facade on top of htmlunit.
    • No coding is necessary as the tests are completely specified in XML.
    • There is the option of scripting some elements in Groovy if XML does not suffice.
    • Very actively maintained.
  • HttpUnit - http://httpunit.sourceforge.net
    • One of the first web testing frameworks, suffers from using the native JDK provided HTTP transport, which can be a bit limiting for security testing.
  • Watij - http://watij.com
    • A Java implementation of WATIR.
    • Windows only because it uses IE for its tests (Mozilla integration is in the works).
  • Solex - http://solex.sourceforge.net
    • An Eclipse plugin that provides a graphical tool to record HTTP sessions and make assertions based on the results.
  • Selenium - http://seleniumhq.org/
    • JavaScript based testing framework, cross-platform and provides a GUI for creating tests.
    • Mature and popular tool, but the use of JavaScript could hamper certain security tests.

Other Tools

Runtime Analysis

Binary Analysis

Requirements Management

Site Mirroring