Sitrep on the experimental branch.

Yes, it’s one of those days again…time to provide some info regarding the on-going development.
The most exciting thing was the WAVSEP benchmark I mentioned in my last post which pressed my obsessive perfectionism button.
So I went balls out these last 2-3 days and added some new modules and retested against WAVSEP.
The result? — 100% overall.

Here’s a list of the new modules:

  1. xss_event — It injects payloads and checks if they appear inside an event attribute of HTML tags
  2. xss_script_tag — It injects payloads and checks if they appear inside HTML ‘script’ tags
  3. xss_tag — It injects payloads and checks if they appear in any HTML tags (HTML attribute injection kind of deal)
  4. blind_timing_sqli — Uses timing attacks to ascertain the existence of SQL injection vulnerabilities

These 4 new babies did the trick. :)

I should mention here that if anyone gets different results do let me know, I want to keep the tests as consistent as possible.

The other changes include:

  1. a finished and quite tested multi-user XMLRPC dispatch server which is accompanied by an external monitoring utility which provides stats about the running jobs
  2. a pretty, color coded page health-list at the end of each scan to help users realise the security (or lack thereof) of the audited website in a glimpse.
  3. the Ctr+C interrupt handler which used to pause the system and provide a brief overview of the discovered vulnerabilities now provides pretty much the same info but without pausing the system and spewes out the progress of the scan while it auto-refreshes (sort of).
  4. Code cleanup and optimization in several framework areas with which I won’t bore you right now
SociBook del.icio.us Digg Facebook Google Yahoo Buzz StumbleUpon

Posted in: Arachni, Open Source, Projects, Security, Web Application

Tags: , , , , , , , , ,



addLeave a comment