DotDotPwn v3.0.1 - The Directory Traversal Fuzzer released

The latest version of DotDotPwn v3.0.1 released.
DotDotPwn is a flexible intelligent fuzzer to discover traversal directory vulnerabilities in software such as HTTP/FTP/TFTP servers, Web platforms such as CMSs, ERPs, Blogs, etc. It's written in perl programming language and can be run either under *NIX or Windows platforms. Also, it has a protocol-independent module to send the desired payload to the host and port specified. On the other hand, it also could be used in a scripting way using the STDOUT module.

Supported modules are HTTP, HTTP, URL, FTP , TFTP , Payload (Protocol independent) and STDOUT.

Download from here

CHANGELOG
This file contains the history of the changes made to DotDotPwn since it's conception. 
DotDotPwn v3.0.1 
Release date: 24/01/2013
Changes / Enhancements / Features:- 

HTTP::Lite dependancy removed (Replaced with LWP core modules) 

* -S switch enables SSL for the http module 

* http-uri module supports SSL via https:// url 

* More dot encodings to bypass string replace and blacklist filters

Requirements - - Perl (http://www.perl.org) Programmed and tested on Perl 5.8.8 and 5.10
- Nmap (http://www.nmap.org) Only if you plan to use the OS detection feature (needs root privileges) 

 Perl modules: - Net::FTP 

- TFTP 

- Time::HiRes 

- Socket 

- IO::Socket 

- Getopt::Std 

- Switch

You can easily install the missing modules doing the following as root:

# perl -MCPAN -e "install <MODULE_NAME>" 

or 

# cpan cpan> install <MODULE_NAME> 

Examples - 

Read EXAMPLES.txt

Sources-
https://github.com/wireghoul/dotdotpwn

Powerfuzzer - Highly automated and fully customizable web fuzzer

Powerfuzzer is a highly automated and fully customizable web fuzzer (HTTP protocol based application fuzzer) based on many other Open Source fuzzers available and information gathered from numerous security resources and websites. It was designed to be user friendly, modern, effective and working.

Don't have a clue what a Fuzzer/Fuzz testing is ? Not a problem, read on here

Currently, it is capable of identifying these problems:
- Cross Site Scripting (XSS)
- Injections (SQL, LDAP, code, commands, and XPATH)
- CRLF
- HTTP 500 statuses (usually indicative of a possible misconfiguration/security flaw incl. buffer overflow)

Designed and coded to be modular and extendable. Adding new checks should simply entail adding new methods.

Prerequisites and Installation

It is platform independent, hence powerfuzzer should run on Windows/Linux/Unix (Tested on Windows XP SP2 and Linux). Install Python(Tested with Python 2.5), wxPython (Tested with wxPython 2.8), HTML Tidy Library, ctypes, TidyLib Python wrapper and you're ready to go.

To start using the application execute powerfuzzer.exe when installed using the installer package or unzip the package and double click (execute) powerfuzzer.py

Download powerfuzzer_v1_beta_patched_binary_installer_complete.exe (6.1 MB)

Source-

http://www.powerfuzzer.com/

Screenshot -

PowerFuzzer - automated and fully customizable web fuzzer

Powerfuzzer is a highly automated and fully customizable web fuzzer (HTTP protocol based application fuzzer) based on many other Open Source fuzzers available and information gathered from numerous security resources and websites. It was designed to be user friendly, modern, effective and working.

Don't have a clue what a Fuzzer/Fuzz testing is ? Not a problem, read on here

Currently, it is capable of identifying these problems:
- Cross Site Scripting (XSS)
- Injections (SQL, LDAP, code, commands, and XPATH)
- CRLF
- HTTP 500 statuses (usually indicative of a possible misconfiguration/security flaw incl. buffer overflow)

Designed and coded to be modular and extendable. Adding new checks should simply entail adding new methods.

 

Download

 

Source -

http://www.powerfuzzer.com/

 

 

backfuzz v0.3 released - protocol fuzzing toolkit

backfuzz is a popular fuzzing tool. This fuzzing tool offers for different protocols (FTP, HTTP, IMAP, etc) but also has no-protocol plug-ins (Example: File Fuzzer).
This script is well coded and easy to extend. If you want to extend the tool with your own plugins, you need to read “functions.py” once. In that file, several functions already predefined. So whoever wants to write their own plugin’s (for another protocol), He can do so in a few lines and add it to the script.

That’s the main power of it, it’s extensible. You can follow the format of existing plugins – for example the HTTP fuzzing plugin.

The code is still in BETA and requires a lot of work to get better, so any questions / suggestions / criticism / comment are welcomed by the author.

backfuzz v0.3 released
(*) Added the ability to use different type of patterns while fuzzing (Cyclic | CyclicExtended | Single | Format-String).
(*) Removed a lot of un-useful parameters and use global variables instead.
(*) Minor Help Screen improvements.

Download -

functions.py

backfuzz.py

globalvars.py
https://github.com/localh0t/backfuzz

Installation
git clone https://github.com/localh0t/backfuzz

Source -

https://github.com/localh0t/backfuzz

Visit website -

http://www.localh0t.com.ar/