[TOOL] ProxyStrike - Active Web Application Proxy



The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



ProxyStrike - Active Web Application Proxy
------------------------------------------------------------------------


SUMMARY



DETAILS

ProxyStrike is an active Web Application Proxy, is a tool designed to find
vulnerabilities while browsing an application. It was created because the
problems we faced in the pentests of web applications that depends heavily
on Javascript, not many web scanners did it good in this stage, so we came
with this proxy.

Right now it has available Sql injection and XSS modules. Both modules are
designed to catch as many vulnerabilities as we can, it's that why the SQL
Injection module is a Python port of the great DarkRaver "Sqlibf". The XSS
module is made by us, using our library Gazpacho (soon will be released as
standalone tool).

The process is very simple, ProxyStrike runs like a passive proxy
listening in port 8008 by default, so you have to browse the desired web
site setting your browser to use ProxyStrike as a proxy, and ProxyStrike
will analyze all the paremeters in background mode. For the user is a
passive proxy because you won't see any different in the behavior of the
application, but in the background is very active.


ADDITIONAL INFORMATION

The information has been provided by <mailto:laramies2k@xxxxxxxxxxxx>
Christian Martorella.
To keep updated with the tool visit the project's homepage at:
<http://www.edge-security.com/proxystrike.php>
http://www.edge-security.com/proxystrike.php



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.



Relevant Pages

  • [NEWS] Sun Java System Web Proxy Multiple Buffer Overflow Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Sun Java System Web Proxy Multiple Buffer Overflow Vulnerabilities ... Sun Microsystems Inc's Java System is "a collection of server applications ... No authentication is required to trigger this vulnerability. ...
    (Securiteam)
  • [TOOL] Odysseus - Passthrough Data Manipulation Proxy
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Odysseus - Passthrough Data Manipulation Proxy ... Odysseus is a tool designed for testing the security of web applications. ... browser and a web server. ...
    (Securiteam)
  • [TOOL] TCP Tunnel
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... to the Internet is by using a proxy. ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
    (Securiteam)
  • [TOOL] Perl Proxy Tester
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Perl Proxy Tester ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
    (Securiteam)
  • [NT] Cross Application Scripting in Trend Micros Antivirus Software
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The SecuriTeam alerts list - Free, Accurate, Independent. ... When the product alerts the user of a possible virus, it creates an HTML ...
    (Securiteam)