|
|
Home : Framework Tools - WebSleuth |
 |
Framework Tools - Websleuth |
Author |
David Zimmer  |
Platform(s) |
Windows |
Version |
1.2.2 |
Download |
Installer package - websleuthInstaller-1.2.zip
Download the Installer Package if you are installing for the first time or do not have
the Visual Basic DLLs.
Source file and .exe - websleuth-1.2.2.zip
Download the .exe to update from a previous release.
Help file - websleuthHelp-complete.zip
This is included in the Installer package, but not in the .exe.
Although this software has been tested, we offer no guarantees regarding its operation and it
is unsupported.
|
Plug-ins |
Sessions Plug-in Suite - A trio of plug-ins for
brute-forcing active authentication tokens stored either in a URL, a cookie, or an
HTTP header in the form of Basic Authentication.
Crawler Plug-in - A plug-in which will
catalogue the contents of a site, providing an easy to digest view of all forms elements,
cookies, images and other components.
|
Description |
WebSleuth is the first tool of the black-box testing toolkit,
and is built to help a user manually understand various
security issues of his/her system. It is not intended to
replace or compete with commercial tools, and there is
certainly no shiny red-button automating attacks. However it
is an investigative learning tool that with some patience and
knowledge, helps you to find and learn about issues you may
have in your web applications.
WebSleuth allows you to edit HTTP and HTML requests on the fly
in real-time.
The first releases implements many features including the
ability to test for:
Parameter Manipulation
Cookies
Form Fields
URL Query Strings
HTTP Headers (referrer etc)
Informational
Comments
Meta Tags
Input Validation
Cross Site Scripting
Client-Side Validation
|
WebSleuth Screenshot
|
|
Notes |
WebSleuth is open source and is subject to the OWASP Software
license. It was written in Visual Basic to take advantage of
the MS Internet Explorer object avoiding the need for a reverse
proxy. The lead developer is David Zimmer wo can be contacted at
dzzie@owasp.org.
As with any open source projects, we welcome your ideas, input
and improvements. Suggestions for features or to participate in
developing the tool, please email owasp@owasp.org
and dzzie@owasp.org.
If you are interested in sponsoring the further development of
this open source project, please contact owasp@owasp.org
|
Release History |
Release 1.2.2
- Edit cookie changed to use windows API
- Frame navigation enhanced (now navigates browser to specific frame)
- Minor interace streamlining
- Test inputs default script upgraded
Release 1.2
New Features
- Substantial updates to test inputs plug-in - now includes scriptable interface!
- Added HTTP PUT/DELETE functionality (plug-in)
- Added "Log Actions" routine to log surfing
- Added vertical splitter bar to resize lower listbox, enabling long list views
- Address bar now updates as you surf
- Added comprehensive HTML help file
- Numerous interface cleanups, including separating main form menus
- Can now open links in a new instance of WebSleuth
- Raw HTTP Request functionality extended to downloading linked script files
Bug Fixes
- Result filter bug fixed
- Test inputs upgraded to Alpha level code
- Extract script bug fixed
|
Back to top
|
|
 |
|
|
|
|
|