JOOMSCAN (JOOMLA SECURITY SCANNER)

                                                           Joomscan
                                 (Joomla Security Scanner)

Joomscan is one of penetration testing tool that help to find the vulnerability in Joomla CMS. The Updated version can detects 673 vulnerabilities . Detects file inclusion, sql injection, command execution vulnerabilities of a target Joomla! web site.

VIDEO TUTORIAL:
http://adf.ly/VVqO6

DOWNLOAD LINK:       LINK 1

WEBACOO - WEB BACKDOOR COOKIE SCRIPT-KIT

                                          WeBaCoo
                        (Web Backdoor Cookie Script-Kit)

Usage: webacoo.pl [options]

Options:

-g Generate backdoor code (-o is required)

-f FUNCTION PHP System function to use


FUNCTION:
1: system (default)
2: shell_exec
3: exec
4: passthru
5: popen

-o OUTPUT Generated backdoor output filename

-r Return un-obfuscated backdoor code

-t Establish remote "terminal" connection (-u is required)

-u URL Backdoor URL

-c C_NAME Cookie name (default: "M-cookie")

-d DELIM Delimiter (default: New random for each request)

-a AGENT HTTP header user-agent (default exist)

-p PROXY Use proxy (tor, ip:port or user:pass:ip:port)

-v LEVEL Verbose level
LEVEL:
0: no additional info (default)
1: print HTTP headers
2: print HTTP headers + data

-h Display help and exit

update Check for updates and apply if any

1. Generate php backdoor file
- ./webacoo.pl -g -o backdoor.php

2. Upload backdoor to victim

3. Use WeBaCoo connect to backdoor
- ./webacoo.pl -t -u http://victim/backdoor.php

4. Now you are in the victim console, do whatever you want :)

VIDEO TUTORIAL:
http://www.youtube.com/watch?v=6PS3ul7_JRo

DOWNLOAD LINK:     LINK 1

WSORROW TOOL

web-sorrow is a PERL based tool used for checking a Web server for misconfiguration, version detection, enumeration, and server information. It is NOT a vulnerability scanner, inspection proxy, DDoS tool or an exploitation framework.

Current Functionality:

-S – stands for standard. a set of Standard tests and includes: indexing of directories testing,
banner grabbing, language detection (should be obvious), robots.txt, and 200 response testing (some servers send a 200 ok for every req)


-Eb – stands for error bagging. The default config for servers is to put the server daemon and version and sometimes even the OS inside of error pages. web-sorrow reqs a URl of 20 random bytes with get and post methods.

-auth – looks for login pages with a list of some of the most common login files and dirs. We don’t need to be very big list of URLs because what else are going to name it?


-cmsPlugins – run a huge list of plugins dirs for cms servers. the list is a bit old (2010)


-I – searches the responses for interesting strings

-Ws – looks for web services such as hosting provider, blogging services, favicon fingerprinting, and cms version info

-Fd – look for generally things people don’t want you to see. The list is generated form a TON of robot.txt so whatever it finds should be interesting
-proxy – send all http reqs via a proxy. example: 255.255.255.254:8080-e – run all the scans in the scannerweb-sorrow also has false positives checking on most of it’s requests (it pretty accurate but not perfect).

VIDEO TUTORIAL:
http://www.youtube.com/watch?v=GoSzXtKGU9o

DOWNLOAD LINK:       LINK 1

Cupp (Common User Passwords Profiler)

Cupp is a common user password profiler. Using this script we can make our own dictionary on someone profiling such as a birthday, nickname, address, name of a pet or relative, or some common works like god, love, money, or any different passwords.

Options:

-h You are looking at it baby! :)
For more help take a look in docs/README
Global configuration file is cupp.cfg


-i Interactive questions for user password profiling

-w Use this option to improve existing dictionary, or WyD.pl output to make some pwnsauce

-l Download huge wordlists from repository

-a Parse default usernames and passwords directly from Alecto DB.
Project Alecto uses purified databases of Phenoelit and CIRT which where merged and enhanced.


-v Version of the program


VIDEO TUTORIAL:
http://www.youtube.com/watch?v=U0kAE3uj4Qs


DOWNLOAD LINK:    LINK 1

Sqlmap: Automatic SQL injection attack tool

 sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.

Features :


* Full support for MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2,  SQLite, Firebird, Sybase and SAP MaxDB database management systems.
* Full support for six SQL injection techniques: boolean-based blind, time-based blind, error-based, UNION query, stacked queries and out-of-band.
* Support to directly connect to the database without passing via a SQL injection, by providing DBMS credentials, IP address, port and database name.
* Support to enumerate users, password hashes, privileges, roles, databases, tables and columns.
* Automatic recognition of password hash formats and support for cracking them using a dictionary-based  attack.
* Support to dump database tables entirely, a range of entries or specific columns as per user's choice. The user can also choose to dump only a range of characters from each column's entry.
* Support to search for specific database names, specific tables across all databases or specific columns across all databases' tables.

* This is useful, for instance, to identify tables containing custom application credentials where relevant columns' names contain string like name and pass.
* Support to download and upload any file from the database server underlying file system when the database software is MySQL, PostgreSQL or Microsoft SQL Server.
* Support to execute arbitrary commands and retrieve their standard output on the database server underlying operating system when the database software is MySQL, PostgreSQL or Microsoft SQL Server.
* Support to establish an out-of-band stateful TCP connection between the attacker machine and the database server underlying operating system.

* This channel can be an interactive command prompt, a  Meterpreter session or a graphical user interface (VNC) session as per user's choice.
*Support for database process' user privilege escalation via Metasploit's Meterpreter getsystem command.

Video Demo:

  Download SQLMap :        LINK 1

WAppEx : Web Application Exploiter

WAppEx is an integrated platform for performing penetration testing and exploiting of web applications on Windows or Linux. It can automatically check for all type of security vulnerabilities in the given target and then let you to run various payloads to exploit and take advantages of the vulnerability.
WAppEx is a multi platform application and it is executable in Linux and Windows.

WAppEx's database which includes hundreds of exploits provides an automated, comprehensive and reliable exploit for penetration testers and security professionals worldwide.
Regular database update is available. Top priorities are high-risk and zero-day vulnerabilities.

Payloads for using in exploits are reliable payloads which contains connect-back, listener shell, arbitrary code execution, arbitrary file upload,...


WAppEx's script based engin let experienced users write their own scripts and payloads to test and exploit any vulnerability in web applications.

Software and vulnerability updates are available at any time and a daily support is available via phone or email.

WAppEx can exploit the following web application vulnerabilities:

SQL Injection:
The most dangerous vulnerability in web applications. WAppEx uses Havij - Advanced SQL Injection Tool engine to find and exploit this vulnerability.

Remote File Inclusion:
It allows an attacker to include a remote file. WAppEx can check for this vulnerability and run various payloads to execute commands on web server.

Local File Inclusion:
It allows an attacker to include a local file. Just like RFI WAppEx tests and exploits this vulnerability.

OS Commanding:
It let the attacker to execute OS commands on server. WAppEx tests and exploits this vulnerability to execute custom commands to get a reverse shell.

Script injection:
It can be used by an attacker to introduce (or "inject") script into a web application. WAppEx automatically tests and exploit this vulnerability to escalate access to web server and get a reverse shell.

Local File Disclosure:
as the name says it disclosure content of local files on the web server. WAppEx can exploit this vulnerability to read sensitive files on the server.


WAppEx contains the following tools to help you in penetration testing and exploiting web apps.

* Online Hash Cracker: A tool for cracking hashes using the reverse lookup in online sites.
* Encoder/Decoder: An encoder/decoder with a complete encryption algorithms.
* Find Login Page: It looks for login pages on a target.
* Browser: A small browser you can use to view source code and HTTP headers.

WAppEx is so easy to use and also so flexible. It doesn't matter you're a beginner or a professional, using WAppEx makes your works easier, faster and more effective.


Download  :            LINK 1

Burp Suite, a tool for performing security testing of web applications

Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application's attack surface, through to finding and exploiting security vulnerabilities.

Burp gives you full control, letting you combine advanced manual techniques with state-of-the-art automation, to make your work faster, more effective, and more fun.

Burp Suite contains the following key components:


* An intercepting proxy, which lets you inspect and modify traffic between your browser and the target        application.

* An application-aware spider, for crawling content and functionality.
* An advanced web application scanner, for automating the detection of numerous types of vulnerability.
* An intruder tool, for performing powerful customized attacks to find and exploit unusual vulnerabilities.
* A repeater tool, for manipulating and resending individual requests.
* A sequencer tool, for testing the randomness of session tokens.
* The ability to save your work and resume working later.
* Extensibility, allowing you to easily write your own plugins, to perform complex and highly customized  tasks within Burp.


Burp is easy to use and intuitive, allowing new users to begin working right away. Burp is also highly configurable, and contains numerous powerful features to assist the most experienced testers with their work.


Download Burp Suite  :         LINK 1