OWASP
Navigation
OWASP
Framework Tools - Websleuth

Author David Zimmer   
Platform(s) Windows
Version 1.2.2
Download Installer package - websleuthInstaller-1.2.zip
Download the Installer Package if you are installing for the first time or do not have the Visual Basic DLLs.

Source file and .exe - websleuth-1.2.2.zip
Download the .exe to update from a previous release.

Help file - websleuthHelp-complete.zip
This is included in the Installer package, but not in the .exe.

Although this software has been tested, we offer no guarantees regarding its operation and it is unsupported.

Plug-ins Sessions Plug-in Suite - A trio of plug-ins for brute-forcing active authentication tokens stored either in a URL, a cookie, or an HTTP header in the form of Basic Authentication.

Crawler Plug-in - A plug-in which will catalogue the contents of a site, providing an easy to digest view of all forms elements, cookies, images and other components.
Description WebSleuth is the first tool of the black-box testing toolkit, and is built to help a user manually understand various security issues of his/her system. It is not intended to replace or compete with commercial tools, and there is certainly no shiny red-button automating attacks. However it is an investigative learning tool that with some patience and knowledge, helps you to find and learn about issues you may have in your web applications.

WebSleuth allows you to edit HTTP and HTML requests on the fly in real-time. The first releases implements many features including the ability to test for:
Parameter Manipulation
Cookies
Form Fields
URL Query Strings
HTTP Headers (referrer etc)

Informational
Comments
Meta Tags

Input Validation
Cross Site Scripting
Client-Side Validation

WebSleuth Screenshot
Notes WebSleuth is open source and is subject to the OWASP Software license. It was written in Visual Basic to take advantage of the MS Internet Explorer object avoiding the need for a reverse proxy. The lead developer is David Zimmer wo can be contacted at dzzie@owasp.org.

As with any open source projects, we welcome your ideas, input and improvements. Suggestions for features or to participate in developing the tool, please email owasp@owasp.org and dzzie@owasp.org.

If you are interested in sponsoring the further development of this open source project, please contact owasp@owasp.org

Release History Release 1.2.2

  • Edit cookie changed to use windows API
  • Frame navigation enhanced (now navigates browser to specific frame)
  • Minor interace streamlining
  • Test inputs default script upgraded
Release 1.2

New Features
  • Substantial updates to test inputs plug-in - now includes scriptable interface!
  • Added HTTP PUT/DELETE functionality (plug-in)
  • Added "Log Actions" routine to log surfing
  • Added vertical splitter bar to resize lower listbox, enabling long list views
  • Address bar now updates as you surf
  • Added comprehensive HTML help file
  • Numerous interface cleanups, including separating main form menus
  • Can now open links in a new instance of WebSleuth
  • Raw HTTP Request functionality extended to downloading linked script files

Bug Fixes
  • Result filter bug fixed
  • Test inputs upgraded to Alpha level code
  • Extract script bug fixed
Back to top


OWASP

Home - Get Involved - Projects - Schedule - Tools - Tutorials - Contact