PenQ - The Security Testing Browser Bundle

PenQ is an open source Linux based penetration testing browser bundle we built over Mozilla Firefox. It comes pre-configured with security tools for spidering, advanced web searching, fingerprinting, anonymous browsing, web server scanning, fuzzing, report generating and more. 

PenQ is configured to run on Debian based distributions including Ubuntu and its derivative distros, and penetration testing operating systems such as BackTrack and Kali.With all its integrations, PenQ is a powerful tool. Be mindful of what use you put it to. Responsible use of PenQ can help secure web apps in a zap.

Features

• OWASP ZAP
• OWASP WebScarab
• OWASP WebSlayer
• Nikto Web Server Scanner

• Wfuzz Web Application Fuzzer
• Mozilla Add-ons Collection
• Integrated Tor
• OWASP Penetration Testing Checklist

• PenTesting Report Generator
• Vulnerability Databases Search
• Access to Shell and System Utilities
• Collection of Useful Links

Download and more info: http://www.qburst.com/products/PenQ

Web Application Penetration testing with Google Chrome Browser

Just found some interesting and useful extensions that can help many of us when we are doing an penetration test...

XSS Rays

Complete XSS reversing/scanner tool. Find how a site is filtering code, check for injections and inspect objects.
XSS Rays is a security tool to help pen test large web sites. It's core features include a XSS scanner, XSS Reverser and object inspection. Need to know how a certain page filters output? Don't have the source? No problem. XSS Rays will blackbox reverse a XSS filter without needing the source code.

Google Hack Data Base

Google Hack Data Base - application to work with GHDB.
Google Hack Data Base - application to work with GHDB. Choose a category and click on the necessary query. To find description vulnerability, click "Search on www.exploit-db.com". Application provides possibility to search vulnerabilities on the specified site. Just click on the search button and enter the site name. This application allows a better understanding of the basis web security.

Websecurify Scanner

Websecurify is a powerful cross-platform web security testing technology designed from the ground up with simplicity in mind. 
 Websecurify is an advanced testing solution built to quickly and accurately identify web application security issues.Websecurify saves you time and money by automating a tiresome and very technical process used by experts to find scary security vulnerabilities.

HPP Finder

Detect potential HPP attack vectors.
HTTP Parameter Pollution (HPP) is a recently discovered web exploitation technique. Please read the NDSS 2010 paper for more details about the technique. HPP Finder is a Chrome extension designed for detecting HPP attempts. HPP Finder can detect URLs and HTML forms that might be susceptible of parameter pollution, but it is not a complete solution against HPP.

Form Fuzzer

HTML form fuzz tester.
This is a fuzz testing, utility created to assist in populating web forms with some random data.

Site Spider

Website Crawler
Use this extension to spider a website looking for dead links. One can restrict the spidering to a directory, a domain, or any other regular expression. The spider can also follow one link beyond this restriction, allowing one to find broken external links.


XSS ChEF

Chrome Extension Exploitation Framework
This is a Chrome Extension Exploitation Framework - think BeEF for Chrome extensions. Whenever you encounter a XSS vulnerability in Chrome extension, ChEF will ease the exploitation.


That's all...Cheers!

XSS ChEF - Chrome Extension Exploitation Framework

This is a Chrome Extension Exploitation Framework - think BeEF for Chrome extensions. Whenever you encounter a XSS vulnerability in Chrome extension, ChEF will ease the exploitation. 

What can you actually do (when having appropriate permissions)?

• Monitor open tabs of victims
• Execute JS on every tab (global XSS)
• Extract HTML, read/write cookies (also httpOnly), localStorage
• Get and manipulate browser history
• Stay persistent until whole browser is closed (or even futher if you can persist in extensions' localStorage)
• Make screenshot of victims window
• Further exploit e.g. via attaching BeEF hooks, keyloggers etc.
• Explore filesystem through file:// protocol
• Bypass Chrome extensions content script sandbox to interact directly with page JS 

Demo:
See http://youtu.be/KmIG2EKLP2M for a demonstrational video.
BeEF hooking: http://youtu.be/uonVWh0QO1A

Download and more info: https://github.com

http://blog.kotowicz.net  -  @kkotowicz

An Evaluation of the Google Chrome Extension Security Architecture

 Abstract
Vulnerabilities in browser extensions put users at risk by providing a way for website and network attackers to gain access to users� private data and credentials. Extensions can also introduce vulnerabilities into the websites that they modify. In 2009, Google Chrome introduced a new extension platform with several features intended to prevent and mitigate extension vulnerabilities: strong isolation between websites and extensions,privilege separation within an extension, and an extension permission system. We performed a security review of 100 Chrome extensions and found 70 vulnerabilities across 40 extensions. Given these vulnerabilities,we evaluate how well each of the security mechanisms defends against extension vulnerabilities. We find that the mechanisms mostly succeed at preventing web attacks,new security mechanisms are needed to protect users from network attacks on extensions, website metadata attacks on extensions, and vulnerabilities that extensions add to websites. We propose and evaluate additional defenses, and we conclude that banning HTTP scripts and inline scripts would prevent 47 of the 50 most severe vulnerabilities with only modest impact on developers. 


Download PDF:  http://www.eecs.berkeley.edu

Sandcat Browser v.1.5 Released

The fastest web browser combined with the fastest scripting language packed with features for pen-testers. 

Sandcat Browser is a freeware portable pen-test oriented multi-tabbed web browser with extensions support developed by the Syhunt team, the same creators of the Sandcat web application security scanner. The Sandcat Browser is built on top of Chromium, the same engine that powers the Google Chrome browser, and uses the Lua language to provide extensions and scripting support.  

This first Sandcat Browser release includes the following pen-test oriented features:

Live HTTP Headers
Request Editor extension
Fuzzer extension with multiple modes and support for filters
JavaScript Executor extension :allows you to load and run external JavaScript files
Lua Executor extension -- allows you to load and run external Lua scripts
Syhunt Gelo
HTTP Brute Force, CGI Scanner scripts and more.  


Runs on Windows XP, 2003, 2008, Vista and 7.

Download: http://www.syhunt.com

Declarative Security - Browser Addons for Mozilla Firefox

- Clickjacking Defense - Declarative Sec Detector

The X-FRAME-OPTIONS sets a restriction on the framing of a web page for a particular domain. It uses the value DENY and SAMEORIGIN for rendering the contents into a child frame.It is possible to stop the rendering completely in a child frame using DENY as a parameter. The SAMEORIGIN parameter declares that the content can only come
from the parent site and that no third party content rendering is allowed.This addon scans all the HTTP response headers that accompany with the web page and raises a notification in the status bar showing whether the declarative security for Clickjacking is applied on the respective domain or not.
For more details Refer: http://www.usenix.org/event/collsec10/tech/full_papers/Sood.pdf

Download: https://addons.mozilla.org



- HTTP Content Security Policy Detector

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP is designed to be fully backward compatible; browsers that don't support it still work with servers that implement it, and vice-versa. Browsers that don't support CSP simply ignore it, functioning as usual, defaulting to the standard same-origin policy for web content.
For more details refer: https://developer.mozilla.org/en/introducing_content_security_policy

Download: https://addons.mozilla.org

DOM Snitch - a passive reconnaissance tool inside the DOM

DOM Snitch is an experimental Chrome extension that enables non-security testers identify common bad practices when producing client-side code and security testers gain better understanding of the transformations that occur within the DOM.

DOM Snitch works by injecting a series of interceptors, also referred to as �hooks�, that allow the tool to listen when a page interacts with key (and sometimes dangerous) browser infrastructure such as window.postMessage, window.eval, or document.write (a complete list of the hooks is available here). Once a hook has been triggered, DOM Snitch gathers and stores various debug information from the execution stack (details are available here). If configured to modify data on the fly, DOM Snitch will wait for the tester to modify the used data as needed before letting normal execution to proceed.

Download: https://code.google.com

OWASP Mantra - Security Framework v.6.1

Mantra is a collection of free and open source tools integrated into a web browser, which can become handy for students, penetration testers, web application developers, security professionals etc. It is portable, ready-to-run, compact and follows the true spirit of free and open source software. Mantra is a security framework which can be very helpful in performing all the five phases of attacks including reconnaissance, scanning and enumeration, gaining access, escalation of privileges, maintaining access, and covering tracks. Apart from that it also contains a set of tools targeted for web developers and code debuggers which makes it handy for both offensive security and defensive security related tasks.

Download: http://www.getmantra.com

More: https://www.owasp.org

DOMinator - The DOM XSS Analyzer Tool

What is DOMinator?

DOMinator is a Firefox based software for analysis and identification of DOM Based Cross Site Scripting issues (DOMXss)It is the first runtime tool which can help security testers to identify DOMXss.



How it works?

It uses dynamic runtime tainting model on strings and can trace back taint propagation operations in order to understand if a DOMXss vulnerability is actually exploitable.You can have an introduction about the implementation flow and some interface description here

What are the possibilities?

In the topics of DOMXss possibilities are quite infinite.At the moment DOMinator can help in identifying reflected DOM Based Xss, but there is potential to extend it to stored DOMXss analysis.


Download: http://code.google.com

Comitari : Web Protection Suite

Only For Internet Explorer !

Comitari welcomes you to the next generation of Web Security solutions - protecting you in real-time as you surf the web, from within your browser applications. Comitari does not rely on blacklists but rather uses patent-pending algorithms that cover 0-day phishing and identity theft attempts � and is the only solution of its kind in the market today. Offering complete protection against client-side attacks, identity theft and online frauds, Comitari Web Protection Suite is a complementary must to existing End Point Security and Web Gateway solutions.

What does Comitari protect you from?
Identity theft
Phishing & pharming
Web site impersonation
Session riding attacks (CSRF, aka XSRF)
User impersonation
Intranet network equipment attacks
DNS rebinding
Cross-Site Scripting (XSS) attacks
ClickJacking (aka UI Redressing)
Buffer Overflow (browser & plugin exploits)
File Stealing

Download: http://backoffice.comitari.com

Web application vulnerabilities in context of browser extensions

Intro:
Current days Google Chrome web browser becomes more and more popular. It is really fast, easy-to-use and in same time powerful browser. I will not write about whole security architecture of Chrome. There is a good article about it by Larry Seltzer called "Google's Chrome Extensions Show Security Focus". Let's focus our attention on Chrome extensions platform. Like Mozilla Firefox Chrome supports extensions or addons, which makes your web surfing with it more comfortable.

What are extensions in Google Chrome browser? Extensions are small software programs that can modify and enhance the functionality of the Chrome browser. Developers writes them using well-know web technologies such as HTML, JavaScript (including HTML5 features) and CSS. Using of such technologies of course makes developing ease. But what security risks they will bring to us?

Download: PDF

BeEF v0.4.2.1 released

Browser Exploitation Framework

BeEF, the Browser Exploitation Framework is a professional security tool provided for lawful research and testing purposes. It allows the experienced penetration tester or system administrator additional attack vectors when assessing the posture of a target. The user of BeEF will control which browser will launch which command module and at which target.

@beefproject - now with keylogger!

Download: http://code.google.com

Websecurify 0.8Beta1 released

Websecurify is a powerful web application security testing platform designed from the ground up to provide the best combination of automatic and manual vulnerability testing technologies.

Some of the main features of Websecurify include:
Available for all major operating systems (Windows, Mac OS, Linux)
Simple to use user interface
Built-in internationalization support
Easily extensible with the help of add-ons and plugins
Exportable and customisable reports with any level of detail
Moduler and reusable design
Powerful manual testing tools and helper facilities
Powerful analytical and scanning technology
Scriptable support for JavaScript and Python
Extensible via many languages including JavaScript, Python, C, C++ and Java

Download: http://code.google.com

Now you can try also Websecurify Google Chrome Extension: This extension is useful to anyone who wants to quickly assess the security of their web applications.

More Info: http://websecurify.com

WEB BROWSER SECURITY SOCIALLY-ENGINEERED MALWARE PROTECTION

In September 2010, NSS Labs performed the fourth test of web browser protection against socially-engineered malware�the most common and impactful security threat facing Internet users today.1 This report followed the same Live Testing methodology as the tests conducted in Q1 2009, Q3 2009, and Q1 2010 (www.nsslabs.com/browser-security). This report contains empirically-validated evidence gathered during 11 days of 24 x 7 testing, performed every six hours, over 39 discrete test runs, each one adding fresh new malware URLs. Each product was updated to the most current version available at the time testing began, and allowed access to the live Internet.

Comparative Test Results
Apple� Safari� 5
Google Chrome� 6
Windows� Internet Explorer� 8
Windows� Internet Explorer� 9
Mozilla� Firefox� 3.6
Opera� 10

Download: PDF

Article: Stopping malware with a browser

Mantra Security Toolkit v0.01

Free and Open Source Browser based Security Framework

Mantra is a dream that came true. It is a collection of free and open source tools integrated into a web browser, which can become handy for students, penetration testers, web application developers, security professionals etc.
Mantra is portable, ready-to-run, compact and follows the true spirit of free and open source software.
Mantra is a security framework which can be very helpful in performing all the five phases of attacks including reconnaissance, scanning and enumeration, gaining access, escalation of privileges, maintaining access, and covering tracks.
Apart from that it also contains a set of tools targeted for web developers and code debuggers which makes it handy for both offensive security and defensive security related tasks.
Mantra is lite, flexible, portable and user friendly with a nice graphical user interface. You can carry it in memory cards, flash drives, CD/DVDs, etc. It can be run natively on Linux, Windows and Mac platforms. It can also be installed on to your system within minutes. Mantra is absolutely free of cost and takes no time for you to set up.

Download: http://www.getmantra.com

Beef - v0.4.2-alpha Browser Exploitation Framework

BeEF, the Browser Exploitation Framework is a professional security tool provided for lawful research and testing purposes. It allows the experienced penetration tester or system administrator additional attack vectors when assessing the posture of a target. The user of BeEF will control which browser will launch which command module and at which target.

BeEF hooks one or more web browsers as beachheads for the launching of directed command modules in real-time. Each browser is likely to be within a different security context. This provides additional vectors that can be exploited by security professionals.

Download: http://code.google.com

HTTPS Everywhere now protects against Firesheep

The EFF launched a new version of HTTPS Everywhere, a security tool that offers enhanced protection for Firefox browser users against Firesheep and other exploits of webpage security flaws.
HTTPS secures web browsing by encrypting both requests from your browser to websites and the resulting pages that are displayed. Without HTTPS, your online reading habits and activities are vulnerable to eavesdropping, and your accounts are vulnerable to hijacking.

Unfortunately, while many sites on the web offer some limited support for HTTPS, it is often difficult to use. Websites may default to using the unencrypted, and therefore vulnerable, HTTP protocol or may fill HTTPS pages with insecure HTTP references. EFF's HTTPS Everywhere tool uses carefully crafted rules to switch sites from HTTP to HTTPS.

This new version of HTTPS Everywhere responds to growing concerns about website vulnerability in the wake of Firesheep, an attack tool that could enable an eavesdropper on a network to take over another user's web accounts - on social networking sites or webmail systems, for example - if the browser's connection to the web application either does not use cryptography or does not use it thoroughly enough.

Source: http://www.net-security.org

BlackSheep � Firefox Add-on - Protect Against Firesheep

Zscaler Creates Free Tool That Allows Consumers To Protect Against Firesheep Security Threat

BlackSheep alerts users if sessions are hijacked after logging in to a social network or email

Firesheep enables others to surreptitiously �hijack� your user session, without your knowledge or consent, after you log in to Gmail or popular social networks such as Facebook and Twitter. Recently released by developer Eric Butler at the Toorcon security conference in October, Firesheep was downloaded over 100,000 times in the first 24 hours alone. Because it, also, is offered as a free Firefox plugin, Firesheep can be obtained by anybody, letting them listen passively on a network to obtain session information on users logged in to over two dozen popular websites. All a Firesheep user needs to do is click on a newly captured session to be effectively logged in with your credentials (username and password). Because it�s so easy, the likelihood of it being misused for wrong-doing or attacks on consumers is high.

By design, BlackSheep is a countermeasure to Firesheep to help consumers combat this threat and avoid falling victim, and it�s the only protection mechanism that exists to date. Given the popularity and rapid growth of Firesheep, BlackSheep can provide peace of mind to users on shared WiFi, home or corporate networks. Once downloaded, it displays a warning when Firesheep is detected.

Download: http://www.zscaler.com

An Analysis of Private Browsing Modes in Modern Browsers

Introduction
The four major browsers (Internet Explorer, Firefox,Chrome and Safari) recently added private browsing modes to their user interfaces. Loosely speaking, these modes have two goals. First and foremost, sites visited while browsing in private mode should leave no trace on the user�s computer. A family member who examines the browser�s history should find no evidence of sites visited in private mode. More precisely, a local attacker who takes control of the machine at time T should learn no information about private browsing actions prior to time T. Second, users may want to hide their identity from web sites they visit by, for example, making it difficult for web sites to link the user�s activities in private mode to the user�s activities in public mode. We refer to this as privacy from a web attacker.While all major browsers support private browsing, there is a great deal of inconsistency in the type of privacy provided by the different browsers. Firefox and Chrome, for example, attempt to protect against a local attacker and take some steps to protect against a web attacker,while Safari only protects against a local attacker

Download: PDF

Firesheep - Firefox HTTP session hijacking extension

Firefox extension that demonstrates HTTP session hijacking attacks

When logging into a website you usually start by submitting your username and password. The server then checks to see if an account matching this information exists and if so, replies back to you with a "cookie" which is used by your browser for all subsequent requests.
It's extremely common for websites to protect your password by encrypting the initial login, but surprisingly uncommon for websites to encrypt everything else. This leaves the cookie (and the user) vulnerable. HTTP session hijacking (sometimes called "sidejacking") is when an attacker gets a hold of a user's cookie, allowing them to do anything the user can do on a particular website. On an open wireless network, cookies are basically shouted through the air, making these attacks extremely easy.

Firesheep is free, open source, and is available now for Mac OS X and Windows. Linux support is on the way.
Websites have a responsibility to protect the people who depend on their services. They've been ignoring this responsibility for too long, and it's time for everyone to demand a more secure web. My hope is that Firesheep will help the users win.

Download and more details : http://codebutler.com

check also Firefox extension allows users to hack into Facebook, Twitter accounts