WEB2.0 Detective

Hint: flag is not a frag: once you've got it, you can get one more...

WEB2.0 Detective is a small package of scripts for web application analysis.

It includes:

  • the module for finding the parameters, that the application handles.
  • the module for detection web-server software, testing for several configuration, dead code and information disclosure vulnerabilities
  • the script for grabbing the dictionary for Arguments Finder module
  • the sample dictionary, made by args_grabber.php
  • the module for searching (temporary) file copies, left, for example, by various text editors

  • Currently, there're tests for typical Apache, NginX, Microsoft-IIS, PHP, ASP.NET, Ruby on Rails issues or vulnerabilities.

    One of the main advantages of this tool is a small number of requests sent to the server.
    BTW, system requirements: Python 3.
    You can find more information in docs.html in the release.

    DOWNLOAD: .rar | .zip

    Last update: 17.12.2012

    Example. Suppose you have a php-script:

    if( rand0) == ) echo 'ads';
    $_SERVER'HTTP_X_REQUESTED_WITH' ] == 'XMLHttpRequest' ) echo $_GET'page' ];
    htmlspecialchars$_GET'a' ] );

    And this is how the WEB2.0 Detective observes such a script:

    Now launching Software Detector with the revealed args:

    As you can see, a lot of interesting information has been found.
    Now let's search sources of some script.