Brainfoldb4u's Blog

Just another WordPress.com weblog

Automated Web app finger printing tool

Posted by brainfoldb4u on January 12, 2010

In penetration testing finger printing the target web presence and enumerating as much as information possible is the primary step for an attacker/ security professional to discover vulnerability. With fingerprinting information attacker can develop an accurate attack scenario to exploit vulnerability in the software type/version being used by the target host. As important security vulnerabilities like SQL injection, buffer over flow are extremely depend on specific software version and software vendor, accurately identifying this sort of information becomes critical. Namp is one of the best tool serves the purpose for free.

Another tool currently released by Richard.sammet on http://mytty.org/wafp/, Basically this is a ruby based web application finger pritning tool using SQlite DB.

How it works

WAFP fetches the files given by the Finger Prints from a webserver and checks if the checksums of those files are matching to the given checksums from the Finger Prints. This way it is able to detect the detailed version and even the build number of a web application.

A Web Application Finger Print consits of a set of relative file locations in conjunction with their md5sums. It is made based on a production or example installation of a Web Application or just out of an extracted Web Application install files tarball. For this task, generate_wafp_fingerprint.sh is to be used.

Visit Richard.sammet site for download and samples

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

 
%d bloggers like this: