Day 61: My Top 5 Web Hacking Tools

3 min readMar 1, 2019

Burp Suite PRO

I say pro, because honestly if you are serious about pentesting web apps you need this. The free version is too throttled and you miss out on some great plugins, to me it’s well worth the investment.

Thousands of organizations use Burp Suite to find security exposures before it’s too late. By using cutting-edge scanning technology, you can identify the very latest vulnerabilities. Our researchers frequently uncover brand new vulnerability classes that Burp is the first to report. Burp Suite constantly raises the bar of what security testing is able to achieve.

Burp Suite documentation: desktop editions

Burp Suite contains a wealth of features and capabilities to support manual and automated security testing. Use the…

portswigger.net

The JSON Web Token Toolkit

ticarpi/jwt_tool

snake: A toolkit for testing, tweaking and cracking JSON Web Tokens - ticarpi/jwt_tool

github.com

The JSON Web Token Toolkit is great for validating, forging and cracking JWTs (JSON Web Tokens).

Its functionality includes:

Checking the validity of a token
Testing for the RS/HS256 public key mismatch vulnerability
Testing for the alg=None signature-bypass vulnerability
Testing the validity of a secret/key/key file
Identifying weak keys via a High-speed Dictionary Attack
Forging new token header and payload values and creating a new signature with the key or via another attack method

python jwt_tool.py eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpbiI6InRpY2FycGkifQ.aqNCvShlNT9jBFTPBpHDbt2gBB1MyHiisSDdp8SQvgw /usr/share/wordlists/rockyou.txt

Sqlmap

Sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.

SQLMAP has a google dork feature, try it, it’s fun…

sqlmap -g "inurl:\'php?id=\'"

Wfuzz

Wfuzz is a tool designed for bruteforcing Web Applications, it can be used for finding resources not linked (directories, servlets, scripts, etc), bruteforce GET and POST parameters for checking different kind of injections (SQL, XSS, LDAP,etc), bruteforce Forms parameters (User/Password), Fuzzing,etc.

Some features:

Multiple Injection points capability with multiple dictionaries
Recursion (When doing directory bruteforce)
Post, headers and authentication data brute forcing
Output to HTML
Colored output
Hide results by return code, word numbers, line numbers, regex
Cookies fuzzing
Multi threading
Proxy support
SOCK support
Time delays between requests
Authentication support (NTLM, Basic)
All parameters bruteforcing (POST and GET)
Multiple encoders per payload
Payload combinations with iterators
Baseline request (to filter results against)
Brute force HTTP methods
Multiple proxy support (each request through a different proxy)
HEAD scan (faster for resource discovery)
Dictionaries tailored for known applications (Weblogic, Iplanet, Tomcat, Domino, Oracle 9i, Vignette, Coldfusion and many more

wfuzz -c -z file,/usr/share/wfuzz/wordlist/general/common.txt --hc 404 http://192.168.1.202/FUZZ

Gobuster

Gobuster is a tool used to brute-force:

URIs (directories and files) in web sites.
DNS subdomains (with wildcard support).

OJ/gobuster

Directory/file & DNS busting tool written in Go. Contribute to OJ/gobuster development by creating an account on…