Sitrep on the experimental branch.
Yes, it’s one of those days again…time to provide some info regarding the on-going development.
The most exciting thing was the WAVSEP benchmark I mentioned in my last post which pressed my obsessive perfectionism button.
So I went balls out these last 2-3 days and added some new modules and retested against WAVSEP.
The result? — 100% overall.
Here’s a list of the new modules:
- xss_event — It injects payloads and checks if they appear inside an event attribute of HTML tags
- xss_script_tag — It injects payloads and checks if they appear inside HTML ‘script’ tags
- xss_tag — It injects payloads and checks if they appear in any HTML tags (HTML attribute injection kind of deal)
- blind_timing_sqli — Uses timing attacks to ascertain the existence of SQL injection vulnerabilities
These 4 new babies did the trick.
I should mention here that if anyone gets different results do let me know, I want to keep the tests as consistent as possible.
The other changes include:
- a finished and quite tested multi-user XMLRPC dispatch server which is accompanied by an external monitoring utility which provides stats about the running jobs
- a pretty, color coded page health-list at the end of each scan to help users realise the security (or lack thereof) of the audited website in a glimpse.
- the Ctr+C interrupt handler which used to pause the system and provide a brief overview of the discovered vulnerabilities now provides pretty much the same info but without pausing the system and spewes out the progress of the scan while it auto-refreshes (sort of).
- Code cleanup and optimization in several framework areas with which I won’t bore you right now
Leave a comment