Web application security .

Web application securityhttp://zeleet.com/security.htm

Web security tools that are on the web

Goals• Save time• Build a clean interface (Based on JQuery)• Accessible anywhere• Help other pen-testers

Limitations• Optimized for IE for now (personal project)

CSRF POC Helper What does it do?

• Automates x-domain post via link

• Linked page auto-submits form to make x-domain post.

Why?• Demonstrates CSRF in POST

just as dangerous as GET.

Web Text Converter What does it do?

• Generates Encoded Payloads Why?

• Save time! • Accessible!• Encoders supports:

Various base entity encoding Url encoding Various base script encoding Base 64 encoding Obfuscated Ascii encoding Regular UTF-7 Comprehensive UTF-7

Heap Spray Wizard What does it do?

• Sprays your heap with default payload to run calc.exe or provide your own shellcode.

Why?• Meant to be used with AX

tools• Configure how much heap

memory you want to spray.• Makes it one click process to

spray with working payload

Html Test Tool What does it do?

• Render various content in the browser using arbitrary content-type.

Why?• Different browsers treat

different mime-types differently.

• Browsers sniff based on content-type.

• Flirting with mime-type paper by Blake Frantz. Great paper.

• Sanity check mime-type behavior.

Web Bug Tool What does it do?

• Creates temporary web bug.• Record hits to a page.

Why?• Save time reusing web bug.

Online Strings What does it do?

• Extract out unicode and ascii strings from binary files.

Why?• Quick and accessible.• Thought it was cool :-P

Makes it one click operation to map

Again it’s available anywhere with web access.

Nothing surprising but fun tool

Lesson: Don’t share photos taken with phone! j/k

View State Decoder What does it do?

• Allows you to peek inside what’s inside ViewState data.

Why?• Demystifies content of

viewstate• Allows you to see a tree view

of all the property values in viewstate

• Any server side sensitive info inside?

• Any questionable property being stored?

Feel free to use it for authorized pen-testing.• http://zeleet.com/security.htm

Over 20+ tools (including bookmarklets)

If you have tools you’d like to see online please shoot me a mail.• [email protected]

Thanks!