VA-PT v0.8.223 -Vulnerability Assessment, Penetration Testing and Risk Management Framework

The set of scripts included in this package will create a Backtrack/SamuraiWTF type environment for the performing of Vulnerability Assessments and Penetration Testing.

The goal of this project was to allow a portable set of tools to be easily installed onto any release of Ubuntu at a moments notice, allowing the tester to be free of distribution release specific constraints.

Note: Ubuntu 11 does not come with Konsole installed, you will need to install it prior to running these scripts.

Download latest version updated in Dec2012
VA-PT Script Package v0.8.223
Download other versions 

Contents of Files
-----------------
deps.sh - Contains the necessary software dependencies for the tools within the kit to function.
exploits.sh - Contains the scripts to download various exploit code from public sources
services.sh - Starts the various integrated services of the kit such as msfrpcd, OpenVAS, Dradis, etc
static.sh - Downloads static applications which are not svn capable
svn.sh - SVN repository scripts to checkout and update the various tools
wordlists.sh - Contains the scripts to download the various wordlists from public sources
update.sh - The script that makes it all happen
readme - You're looking at it
search/ - the PHP Files for the local vulnerability and exploitdb search interface

How To
------
To start, run the installer: sudo ./install.sh
Install the dependencies first via option 1) Install/Check Dependencies

--Setup for postgres DB 
sudo su postgres
psql
create user <username with password 'password' createdb;
create database msf owner <your username>;
\q
./msfconsole
db_connect <username>:<password>@localhost/msf

If you are running, or are planning on running, Nexpose on the same system. You will need to change the listening port on the postgresql database.

/etc/postgresql/8.4/main/postgresql.conf

Make sure your msf rc files reference the port number you set.
-- .msf4/msfconsole.rc
-- db_connect username:password@localhost:port/msf

All tools are loaded into the /pentest directory.

Future Major Release to include
-------------------------
Security Assessment Management Portal
-- PCI-DSS Assessment
-- ISO Assessment
-- NIST 800-53a Assessment
-- Vulnerability Assessment & Penetration Testing Management

Keith Pachulski
Security Consultant
keithp@protectors.cc

Source-
http://code.google.com/p/va-pt/

Previous post regarding VA-PT
http://santoshdudhade.blogspot.in/2012/12/va-pt-vulnerability-assessment.html

va-pt - Vulnerability Assessment, Penetration Testing and Risk Management Framework

This project aims to offer a portable set of tools used during the course of vulnerability assessment and penetration tests. The tool set and vulnerability database are based on the Ubuntu Linux distribution. This will create a Backtrack/Samurai WTF type environment on your Ubuntu system.

Included in the SVN checkout is the PHP based vulnerability search portal which will allow you to search for vulnerabilities through common databases such as NVD and OSVDB, as well as available exploits from exploitdb. 

All of the noted databases are loaded into the local database during kit installation.

Future versions will offer a PHP based interface for the documentation of assessments efforts, generation of reports as well as the generation of common deliverable items such as rules of engagement, findings and technical/executive reports.

Supported Ubuntu Distributions:

10.x / 11.x

Not tested at all on 12.x

Any problems, comments or requests, feel free to contact me here or on twitter.

-Keith

Twitter: @sec0ps

Download -

va-pt-r8.tar.7z
Download other version 

• Run the install.sh script first. This will create the needed directories for the package.
• Run the "Install Dependencies" option. Depending on whether you are running this on a fresh install or not, some portions may need some manual assistance for the install to complete such as Math-Pari perl (this will be corrected soon).
• After the dependencies have been installed, run the remaining SVN/Static options to install the remainder of the code.
• My recommended firefox plugins can be installed using the "Install Firefox Extensions" option.

for more documentation 

Source-

http://code.google.com/p/va-pt/

WAppEx - The Web Application Exploiter

WAppEx is an integrated platform for performing penetration testing and exploiting of web applications on Windows or Linux. It can automatically check for all type of security vulnerabilities in the given target and then let you to run various payloads to exploit and take advantages of the vulnerability. WAppEx is a multi platform application and it is executable in Linux and Windows.WAppEx‘s database which includes hundreds of exploits provides an automated, comprehensive and reliable exploit for penetration testers and security professionals worldwide.

Regular database update is available. Top priorities are high-risk and zero-day vulnerabilities.Payloads for using in exploits are reliable payloads which contains connect-back, listener shell, arbitrary code execution, arbitrary file upload,…

WAppEx‘s script based engin let experienced users write their own scripts and payloads to test and exploit any vulnerability in web applications.

Software and vulnerability updates are available at any time and a daily support is available via phone or email. WAppEx can exploit the following web application vulnerabilities:

SQL Injection: 

The most dangerous vulnerability in web applications. WAppEx uses Havij – Advanced SQL Injection Tool engine to find and exploit this vulnerability.

Remote File Inclusion:

It allows an attacker to include a remote file. WAppEx can check for this vulnerability and run various payloads to execute commands on web server.

Local File Inclusion:

It allows an attacker to include a local file. Just like RFI WAppEx tests and exploits this vulnerability.
OS Commanding:

It let the attacker to execute OS commands on server. WAppEx tests and exploits this vulnerability to execute custom commands to get a reverse shell.
Script injection:

It can be used by an attacker to introduce (or “inject”) script into a web application.WAppEx automatically tests and exploit this vulnerability to escalate access to web server and get a reverse shell.
Local File Disclosure:

as the name says it disclosure content of local files on the web server. WAppEx can exploit this vulnerability to read sensitive files on the server.

WAppEx contains the following tools to help you in penetration testing and exploiting web apps.

• Online Hash Cracker: A tool for cracking hashes using the reverse lookup in online sites.
• Encoder/Decoder: An encoder/decoder with a complete encryption algorithms.
• Find Login Page: It looks for login pages on a target.
• Browser: A small browser you can use to view source code and HTTP headers.

WAppEx is so easy to use and also so flexible. It doesn’t matter you’re a beginner or a professional, using WAppEx makes your works easier, faster and more effective.

Download

Visit website -
http://itsecteam.com/