4.0

214AppendixAppendixThis section is often used to describe the commercial and opensourcetools that were used in conducting the assessment. Whencustom scripts or code are utilized during the assessment, it shouldbe disclosed in this section or noted as attachment. Customers appreciatewhen the methodology used by the consultants is included. Itgives them an idea of the thoroughness of the assessment and whatareas were included.References Industry standard vulnerability severity and risk rankings(CVSS) [1] – http:/www.first.org/cvssAppendix A: Testing ToolsOpen Source Black Box Testing toolsGeneral TestingOWASP ZAP• The Zed Attack Proxy (ZAP) is an easy to use integrated penetrationtesting tool for finding vulnerabilities in web applications. It is designedto be used by people with a wide range of security experience and assuch is ideal for developers and functional testers who are new topenetration testing.• ZAP provides automated scanners as well as a set of tools that allowyou to find security vulnerabilities manually.OWASP WebScarab• WebScarab is a framework for analysing applications that communicateusing the HTTP and HTTPS protocols. It is written in Java, and isportable to many platforms. WebScarab has several modes of operationthat are implemented by a number of plugins.OWASP CAL9000• CAL9000 is a collection of browser-based tools that enable more effectiveand efficient manual testing efforts.• Includes an XSS Attack Library, Character Encoder/Decoder, HTTPRequest Generator and Response Evaluator, Testing Checklist, AutomatedAttack Editor and much more.OWASP Pantera Web Assessment Studio Project• Pantera uses an improved version of SpikeProxy to provide a powerfulweb application analysis engine. The primary goal of Pantera is tocombine automated capabilities with complete manual testing to getthe best penetration testing results.OWASP Mantra - Security Framework• Mantra is a web application security testing framework built on topof a browser. It supports Windows, Linux(both 32 and 64 bit) and Macintosh.In addition, it can work with other software like ZAP using builtin proxy management function which makes it much more convenient.Mantra is available in 9 languages: Arabic, Chinese - Simplified,Chinese - Traditional, English, French, Portuguese, Russian, Spanishand Turkish.SPIKE - http:/www.immunitysec.com/resources-freesoftware.shtml• SPIKE designed to analyze new network protocols for buffer overflowsor similar weaknesses. It requires a strong knowledge of C touse and only available for the Linux platform.Burp Proxy - http:/www.portswigger.net/Burp/• Burp Proxy is an intercepting proxy server for security testing of webapplications it allows Intercepting and modifying all HTTP(S) trafficpassing in both directions, it can work with custom SSL certificatesand non-proxy-aware clients.Odysseus Proxy - http:/www.wastelands.gen.nz/odysseus/• Odysseus is a proxy server, which acts as a man-in-the-middleduring an HTTP session. A typical HTTP proxy will relay packets to andfrom a client browser and a web server. It will intercept an HTTP session’sdata in either direction.Webstretch Proxy - http:/sourceforge.net/projects/webstretch• Webstretch Proxy enable users to view and alter all aspects of communicationswith a web site via a proxy. It can also be used for debuggingduring development.WATOBO - http:/sourceforge.net/apps/mediawiki/watobo/index.php?title=Main_Page• WATOBO works like a local proxy, similar to Webscarab, ZAP orBurpSuite and it supports passive and active checks.Firefox LiveHTTPHeaders - https:/addons.mozilla.org/en-US/firefox/addon/live-http-headers/• View HTTP headers of a page and while browsing.Firefox Tamper Data - https:/addons.mozilla.org/en-US/firefox/addon/tamper-data/• Use tamperdata to view and modify HTTP/HTTPS headers and postparametersFirefox Web Developer Tools - https:/addons.mozilla.org/en-US/firefox/addon/web-developer/• The Web Developer extension adds various web developer tools tothe browser.DOM Inspector - https:/developer.mozilla.org/en/docs/DOM_Inspector• DOM Inspector is a developer tool used to inspect, browse, and editthe Document Object Model (DOM)Firefox Firebug - http:/getfirebug.com/• Firebug integrates with Firefox to edit, debug, and monitor CSS,HTML, and JavaScript.Grendel-Scan - http:/securitytube-tools.net/index.php?title=Grendel_Scan• Grendel-Scan is an automated security scanning of web applicationsand also supports manual penetration testing.OWASP SWFIntruder - http:/www.mindedsecurity.com/swfintruder.html• SWFIntruder (pronounced Swiff Intruder) is the first tool specificallydeveloped for analyzing and testing security of Flash applications atruntime.SWFScan - http:/h30499.www3.hp.com/t5/Following-the-Wh1t3-Rabbit/SWFScan-FREE-Flash-decompiler/bap/5440167• Flash decompilerWikto - http:/www.sensepost.com/labs/tools/pentest/wikto• Wikto features including fuzzy logic error code checking, a back-endminer, Google-assisted directory mining and real time HTTP request/response monitoring.w3af - http:/w3af.org• w3af is a Web Application Attack and Audit Framework. The project’sgoal is finding and exploiting web application vulnerabilities.skipfish - http:/code.google.com/p/skipfish/• Skipfish is an active web application security reconnaissance tool.Web Developer toolbar - https:/chrome.google.com/webstore/detail/bfbameneiokkgbdmiekhjnmfkcnldhhm• The Web Developer extension adds a toolbar button to the browserwith various web developer tools. This is the official port of the WebDeveloper extension for Firefox.HTTP Request Maker - https:/chrome.google.com/webstore/detail/