SSHtrix - Fastest Multithreaded SSHv1 and SSH1v2 login cracker

sshtrix is a very fast multithreaded SSH login cracker. It supports SSHv1 and SSHv2.sshtrix was designed to automate rapid bruteforce attacks against SSH authentification screens. Unlike other public tools, the aim is to keep it simple, stable, fast and modular. With its clean code design, it is easy to extend the code to a framework or to fork it against protocols of your choice. In fact, sshtrix is a fork of my own generic login cracker framework.
Download SSHtrix here

Read More

WAVSEP 1.0.3 – Web Application Vulnerability Scanner Evaluation Project

A vulnerable web application designed to help assessing the features, quality and accuracy of web application vulnerability scanners. This evaluation platform contains a collection of unique vulnerable web pages that can be used to test the various properties of web application scanners. Additional information can be found in the developer's blog.

Project WAVSEP currently includes the following test cases:
Vulnerabilities:

• Reflected XSS: 66 test cases, implemented in 64 jsp pages (GET & POST)
• Error Based SQL Injection: 80 test cases, implemented in 76 jsp pages (GET & POST )
• Blind SQL Injection: 46 test cases, implemented in 44 jsp pages (GET & POST )
• Time Based SQL Injection: 10 test cases, implemented in 10 jsp pages (GET & POST )

False Positives:

• 7 different categories of false positive Reflected XSS vulnerabilities (GET & POST )
• 10 different categories of false positive SQL Injection vulnerabilities (GET & POST)

Additional Features:

• A simple web interface for accessing the vulnerable pages
• Sample detection & exploitation payloads for each and every test case
• Database connection pool support, ensuring the consistency of scanning results

Although some of the test cases are vulnerable to additional exposures, the purpose of each test case is to evaluate the detection accuracy of one type of exposure, and thus, “out of scope” exposures should be ignored when evaluating the accuracy of vulnerability scanners.

Download WAVSEP 1.0.3

Read More