[Full-disclosure] Context App Tool - New Web Application Testing Tool Released



CAT is an application to facilitate manual web application penetration testing. It was designed to cope with a more demanding level of application testing, taking away some of the more repetitive nature of testing and allowing the tester to focus their time instead on the individual application, enabling them to conduct a much more thorough test. Conceptually it is similar to other proxies available both commercially and open source. CAT provides a richer feature set and greater performance, combined with a more intuitive user interface to aid a professional manual penetration tester.

There are a number of differences between CAT and currently available web proxies. Some key differences are:

* Uses Internet Explorer's rendering engine for accurate HTML representation
* Supports many different types of text conversations including: URL, Base64, Hex, Unicode, HTML/XML, SQL and JavaScript no Quotes
* Integrated SQL Injection and XSS Detection
* Synchronised Proxies for Authentication and Authorisation checking
* Faster due to HTTP connection caching
* SSL Version and Cipher checker using OpenSSL
* Greater flexibility for importing/exporting logs and saving projects
* Tabbed Interface allowing for multiple tools at once e.g. multiple repeaters and different logs
* The ability to repeat and modify a sequence of requests (particular useful in SSO testing)
* Free!

There are a number of features which CAT has to enable a wide variety of testing to be conducted:

* Request Repeater – Used for repeating a single request
* Proxy – Classic Inline proxy
* Fuzzer – Allows for batch of tests to be sent to a server for brute forcing, parameter fuzzing, forced browsing etc.
* Log – View a list of requests to sort, search repeat etc. Allows for a sequence of requests to be repeated and modified.
* Authentication Checker – Two synchronised proxies which can be used to check authentication and authorisation controls.
* SSL Checker – Request a specific page with various SSL ciphers and versions.
* Notepad – A text/RTF editor which can be used as a scratch pad for conversions etc.
* Web Browser – An integrated web browser with proxy pre-configured based on the Internet Explorer's rendering engine.


For more information and to download a copy go to http://cat.contextis.com

Look forward to any feedback,
Michael Jordon


About Context Information Security
----------------------------------
Context Information Security Limited is a specialist information security consultancy based in London and Dusseldorf.
Context promotes the holistic approach to information security and helps clients to identify, assess and control their exposure to risk within the fields of IT, telephony and physical security. Context employs experienced information security professionals who are subject-matter experts in their various technical specialisms. Context works extensively within the finance, legal, defence and government sectors, delivering high-end information security projects to organisations for which security is a priority.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • Context App Tool - New Web Application Testing Tool Released
    ... There are a number of differences between CAT and currently available web proxies. ... View a list of requests to sort, search repeat etc. Allows for a sequence of requests to be repeated and modified. ... Context Information Security Limited is a specialist information security consultancy based in London and Dusseldorf. ...
    (Pen-Test)
  • Re: [Full-disclosure] Arbitrary DDoS PoC
    ... Your poc calls curl multiple times via a list of proxies. ... that make the requests, thus reducing the wake of a failure, even if you say ... anonymity and obfuscation but does not actually increase effectiveness. ... aren't going to overwhelm the server. ...
    (Full-Disclosure)
  • Re: [Full-disclosure] Arbitrary DDoS PoC
    ... Your poc calls curl multiple times via a list of proxies. ... that make the requests, thus reducing the wake of a failure, even if you say ... anonymity and obfuscation but does not actually increase effectiveness. ... aren't going to overwhelm the server. ...
    (Full-Disclosure)
  • Re: [Full-disclosure] Arbitrary DDoS PoC
    ... Your poc calls curl multiple times via a list of proxies. ... not measured by the band, but the requests, especially the heavier, could ... in anonymity and obfuscation but does not actually increase effectiveness. ... aren't going to overwhelm the server. ...
    (Full-Disclosure)
  • Re: [Full-disclosure] Arbitrary DDoS PoC
    ... Dear God what will we do?!?!? ... packets through proxies to somehow make them more bigger. ... servers and protocols are used to arbitrarily make requests on ... Hosted and sponsored by Secunia - http://secunia.com/ ...
    (Full-Disclosure)