HomeCalendarCertificationsColumnsFeaturesForumResourcesVitals
 
Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.
Lost Password?
No account yet? Register
Who's Online
We have 44 guests online
 
Advertisement

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Web Applicationsarrow Tools to find XSS and SQL Injection Vulnerabilities
EH-Net
May 21, 2013, 08:47:15 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
« previous next »
  Print  
Author Topic: Tools to find XSS and SQL Injection Vulnerabilities  (Read 8677 times)
0 Members and 1 Guest are viewing this topic.
H1t M0nk3y
Hero Member
*****
Offline Offline

Posts: 864



View Profile
« on: July 07, 2010, 06:56:03 AM »
Hi,

I am looking for tools to find XSS and SQL Injection flaws in web applications. I know Acunetix, Nessus and Nikto can find these types of vulnerabilities, but with limited success (at least for Nessus and Nikto, I have never tried Acunetix).

So what tool do you use for this task?
Logged
OSCP, GPEN, GWAPT, GSEC, CEH, CISSP
H1t M0nk3y
Hero Member
*****
Offline Offline

Posts: 864



View Profile
« Reply #1 on: July 07, 2010, 07:13:37 AM »
I also forgot to mentioned XSS-Me and SQL Inject-Me from Seccom Labs: http://labs.securitycompass.com/index.php/exploit-me/
Logged
OSCP, GPEN, GWAPT, GSEC, CEH, CISSP
mambru
Jr. Member
**
Offline Offline

Posts: 98


View Profile
« Reply #2 on: July 07, 2010, 09:31:24 AM »
You should try Netsparker, I've used the free version and got good results
Logged
secureseven
Jr. Member
**
Offline Offline

Posts: 79



View Profile
« Reply #3 on: July 07, 2010, 09:49:50 AM »
You can also try w3af. It's a very nice framework for web application testing.
Logged
http://twitter.com/mikesantillana
eLearnSecurity Team Member.
sachitre
Newbie
*
Offline Offline

Posts: 22


View Profile
« Reply #4 on: July 07, 2010, 08:27:00 PM »
Hi,

Paros has some limited scanning capabilities. I have only only used it in labs against Webgoat and OwaspBWA though.

Cheers.
Logged
CISSP, GPEN, CCNA
H1t M0nk3y
Hero Member
*****
Offline Offline

Posts: 864



View Profile
« Reply #5 on: July 08, 2010, 07:21:28 AM »
Ok, so far, I have tried a few tools. Here are my humble findings:

  • Nessus- very limited for web apps. More checks are done against the web server and almost nothing is done for the web applications. This is obviously normal since Nessus scans way more than the web app.
  • Nikto - good for what it does, but tests more the web server than the web application. Also search for hidden files and default configuration.
  • XSS-Me and SQL Injection-Me - Not bad at all. Closer to what I was looking for. This Firefox plugin really helps finding XSS and SQL Injection vulnerabilities (among other things). I recommend all developers to start using this tool.
  • Community version of Netsparker - Pretty good too. As expected, Netsparker and XSS-Me/SQL Injection-Me found different things. So they complete each other quite well.

My conclusion is more or less the same with other security tools: run them all and compare the results! Running these 4 tools against the same target will definitively give you a good idea of what is going on.
Logged
OSCP, GPEN, GWAPT, GSEC, CEH, CISSP
vekarman
Newbie
*
Offline Offline

Posts: 28



View Profile
« Reply #6 on: July 08, 2010, 07:31:43 AM »

For Xss only - use XSSploit. written in Python and very lean structure, no frills. Try it.
Logged
CISSP
H1t M0nk3y
Hero Member
*****
Offline Offline

Posts: 864



View Profile
« Reply #7 on: July 08, 2010, 08:15:12 AM »
Ok, I just tried XSSploit, but I get mixed feelings. The spider functionality didn't work well with our web site (which is xhtml compliant). It only found 30 pages out of about 2600... So I had to manually go to every form and start analyzing them.

And since our new web site is quite secure, the tool didn't find anything, not even a warning (which is quite good for us!).

So I will try it again against another web site, but XSS-Me gave me a better feeling.

But thanks vekarman for your suggestion!

Now I will try w3af...
Logged
OSCP, GPEN, GWAPT, GSEC, CEH, CISSP
Ketchup
Hero Member
*****
Offline Offline

Posts: 1021



View Profile
« Reply #8 on: July 08, 2010, 11:21:12 AM »
WebScarab is another great tool.   It has a fuzzing capability that can test for XSS and SQLi.   You do need a good fuzz template file.
Logged
~~~~~~~~~~~~~~
Ketchup
H1t M0nk3y
Hero Member
*****
Offline Offline

Posts: 864



View Profile
« Reply #9 on: July 08, 2010, 11:49:48 AM »
Quote
You do need a good fuzz template file

Do you know where I can find a good one?
Logged
OSCP, GPEN, GWAPT, GSEC, CEH, CISSP
JollyJokker
Guest
« Reply #10 on: July 09, 2010, 03:15:54 PM »
Since you mentioned Acunetix, the Acunetix free edition is XSS capable only. So it can probably meet your XSS requirements and probably give you a good idea on its overall effectiveness.

Logged
Ketchup
Hero Member
*****
Offline Offline

Posts: 1021



View Profile
« Reply #11 on: July 10, 2010, 08:52:19 AM »
Quote from: H1t M0nk3y on July 08, 2010, 11:49:48 AM
Quote
You do need a good fuzz template file

Do you know where I can find a good one?

You can convert this one to a template:

http://ha.ckers.org/xss.html

Also, check out this blog post on WebScarab's fuzzing functionality.   It actually links you a cool and very inclusive template:

http://travisaltman.com/webscarab-tutorial-part-3-fuzzing/
Logged
~~~~~~~~~~~~~~
Ketchup
Pages: [1]   Go Up
  Print  
« previous next »
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com 		Valid XHTML 1.0! Valid CSS!
Page created in 0.087 seconds with 23 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Free Business and Tech Magazines and eBooks

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.