the-web-application-hackers-handbook

Chapter 20 n A Web Application Hacker’s Toolkit 785
Other Tools
In addition to the tools already discussed, you may find countless others useful
in a specific situation or to perform a particular task. The remainder of this
chapter describes a few other tools you are likely to encounter and use when
attacking applications. It should be noted that this is only a brief survey of
some tools that the authors have used. It is recommended that you investigate
the various tools available for yourself, and choose those which best meet your
needs and testing style.
Wikto/Nikto
Nikto is useful for locating default or common third-party content that exists
on a web server. It contains a large database of files and directories, including
default pages and scripts that ship with web servers, and third-party items such
as shopping cart software. The tool essentially works by requesting each item
in turn and detecting whether it exists.
The database is updated frequently, meaning that Nikto typically is more
effective than any other automated or manual technique for identifying this
type of content.
Nikto implements a wide range of configuration options, which can be specified
on the command line or via a text-based configuration file. If the application
uses a customized “not found” page, you can avoid false positives by using the
-404 setting, which enables you to specify a string that appears in the custom
error page.
Wikto is a Windows version of Nikto that has some additional features, such
as enhanced detection of custom “not-found” responses and Google-assisted
directory mining.
Firebug
Firebug is a browser debugging tool that lets you debug and edit HTML and
JavaScript in real time on the currently displayed page. You can also explore
and edit the DOM.
Firebug is extremely powerful for analyzing and exploiting a wide range of
client-side attacks, including all kinds of cross-site scripting, request forgery
and UI redress, and cross-domain data capture, as described in Chapter 13.
Hydra
Hydra is a password-guessing tool that can be used in a wide range of situations,
including with the forms-based authentication commonly used in web