SandCat: Web Server & Application Vulnerability Scanner

O SandCat e uma ferramenta que permite que sejam feitos scans agressivos e compreensivos de web servers de organizacoes a fim de identificar e isolar falhas de seguranca.

Sua operacao e simples, requerendo apenas inputar dados como hostnames, URLs e a porta de comunicacao com o webserver para que ele faca um scan completo em um web site e teste toda a web application a procura de falhas.

Abaixo as features principais do software.

Key Features:

Provides over 260 web application security checks,
covering over 38 types of web security attacks — a
target server can be local or remote.

Crawls web sites and detects cross-site scripting,
directory transversal problems, attempts to execute
commands and multiple other attacks.

Scans web servers for the SANS Top Twenty (C1),
the OWASP Top 10 and the OWASP PHP Top 5
vulnerabilities.

Allows to scan for specific vulnerabilities, such as
Fault Injection, SQL Injection and XSS
(Cross-Site Scripting) vulnerabilities.

Allows to define a range or list of IP addresses to be
scanned.

Allows to define multiple start URLs.

Allows to perform destructive and non-destructive
scans.

Allows to edit the crawling depth: maximum number
of links per server, maximum links per page, maximum
URL length and maximum response size and more.

Allows to create user signatures for detecting
application vulnerabilities.

Prevents logout.

Tests intrusion detection systems.

Exploits AJAX-based web applications.

Supports host authentication (basic and web form authentication).

Supports OSVDB, NVD, CVE and CWE.

Stores and allows you to view the HTTP request and
response for each successful test.

Automatically discovers and analyzes the server’s
configuration to determine which tests are needed.

Analyzes robots.txt file and javascript.

Includes a Baseline Security Scanner — ensures
security against outdated server software.

Expansion Tools – Sandcat™ Log Analyzer and
Sandcat™ Hardener.

Runs on these systems: Windows 95, 98, ME, NT, 2000,
2003, XP or Vista.

—-

E uma ferramenta que deve estar em todo toolkit de um penetration tester a fim de alcancar um maior compliance com as normas do OWASP.

OBS: Existe uma versao Professional que deve ser adiquirida para ter acesso a todos os features do programa mas o link abaixo da acesso a uma versao que ja tem muitos features e pode ser utilizada para avaliacao.

http://w15.easy-share.com/11485101.html

Advertisements

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s