Secure Application Development And Modern Defenses

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEixQhMOndWwvmUt_x8xHUnTSX7uk8n-d9kWDEWBMAGZSzbhtVIHtsPbqko6pTBF5qGsBUktN4odSm9YX98vicvKd9IlTARdmm0pbkn1IkMlLyehXDKF5__4BOOlEQhZWLMzuTGYJBVbd3w/s1600/hacker+security-med_.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="258" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEixQhMOndWwvmUt_x8xHUnTSX7uk8n-d9kWDEWBMAGZSzbhtVIHtsPbqko6pTBF5qGsBUktN4odSm9YX98vicvKd9IlTARdmm0pbkn1IkMlLyehXDKF5__4BOOlEQhZWLMzuTGYJBVbd3w/s400/hacker+security-med_.jpg" width="400" /></a></div><div rtenodeid="3" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;"><h4>Abstract</h4></div><div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;"><span style="font-family: "calibri" , "arial" , "helvetica" , sans-serif;">When it comes to the internet, security has always been an after-thought. A great evidence to support the theory can be seen when we look at the history of the internet. The internet was created by US military back in 1969, branded as "Arpanet" at that time. In 1973, ARPANET created TCP IP protocol suite which later enabled the development of protocols such as "SMTP, POP3, FTP, TELNET " in 1980's and HTTP in 1991. </span><br /><span style="font-family: "calibri" , "arial" , "helvetica" , sans-serif;"><br /></span><span style="font-family: "calibri" , "arial" , "helvetica" , sans-serif;">All of these protocols could be easily eaves-dropped upon by an attacker as they do not encrypt the traffic. Their secure versions were released only later, such as FTPS, SMTPS, SSH, and HTTPS since at that time connecting people and building features was the priority.  If security would have been present by design, we would not have encountered these problems today. </span><br /><a name='more'></a>The same is the case of when we develop the products today, we consider security to be an after-thought rather than an in-built feature, as a reason of which, security breaches occur.  In this article, we would talk about secure application development and why SDLC (System Development Lifecycle) is an ideal model for building secure products.<br /><br />The model leads "Security By Design" and "In-depth Defense" approach. The idea behind this model is that security should be an essential part of all phases of SDLC so that the bugs are addressed during the early stages of development. Fixing security issues at earlier stages of the development cycle directly reduces costs, time, effortand resources.</div><div rtenodeid="4" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;"><h4>Application Layer Security Attacks</h4></div><div rtenodeid="4" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;"><span style="font-family: "calibri" , "arial" , "helvetica" , sans-serif;">As time passes by, we witness a rise in application security attacks, an upward progression in layer of insecurities of the OSI model. In 80 and 90's most of the attacks were related to Layer 1, Layer 2 and Layer 3 of the OSI model, ​today we are at the point that we have developed a great defense at Network Level, however application layer security remains a big challenge. </span><br /><span style="font-family: "calibri" , "arial" , "helvetica" , sans-serif;"><br /></span><span style="font-family: "calibri" , "arial" , "helvetica" , sans-serif;">According to a report by Gartner Research, it states that 75% of the attacks today occur at the application layer of the OSI Model.</span> According to a survey by Trustwave, 82% of web applications are vulnerable to XSS attacks. According to another survey, 80% of all the security incidents in the financial sector occur due to Cross-site Scripting. Therefore, building defense at application layer is mandatory.</div><div rtenodeid="4" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;"><h4>Application Layer Defenses/Approach</h4></div><div rtenodeid="4" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;"><span style="font-family: "calibri" , "arial" , "helvetica" , sans-serif;">Overtime, there have been multiple defenses and approaches established at application level, most notable being a "<b>Web Application Firewall</b>" and "<b>Runtime Application Self-Protection</b>" so on and so forth.  </span><br /><span style="font-family: "calibri" , "arial" , "helvetica" , sans-serif;"><br /></span><span style="font-family: "calibri" , "arial" , "helvetica" , sans-serif;">A Web Application firewall could be used as an additional layer of security, however all WAF's rely upon Blacklist i.e. Reject Known Bad, as whitelisting mode is not practically applicable in the real world (it's not easy to implement). This can be largely attributed to the fact that the majority of web applications are dynamic, and it is very difficult to predict all the possible inputs in order to write a whitlelist of what is allowed. The blacklist, however is not really effective, and this has been proven in past. As a matter of fact, Bypassing WAF's is my day-to-day job and back in 2013, I had written a cheatsheet "<b><a href="http://www.rafayhackingarticles.net/2013/12/bypassing-modern-wafs-xss-filters-cheat.html" target="_blank">Bypassing Modern WAF's XSS Filters</a></b>" for bypassing Web Application firewalls in which I had written bypasses for top Web Application firewalls. </span><br /><span style="font-family: "calibri" , "arial" , "helvetica" , sans-serif;"><b><br /></b></span><span style="font-family: "calibri" , "arial" , "helvetica" , sans-serif;"><b>Runtime Application Self Protection </b>is relatively a new approach for preventing application layer attacks, which empowers the application to protect in against attacks in real time. A RASP sits at each junction point of the application such as between the application and database, the file system and the network, it sits there and identifies & blocks any malicious activity, enabling the application an ability to protect itself. The problem, however, with this solution is that it still is based upon a blacklist, it is very costly and requires a lot of time to mature itself. </span><br /><span style="font-family: "calibri" , "arial" , "helvetica" , sans-serif;"><br /></span><span style="font-family: "calibri" , "arial" , "helvetica" , sans-serif;">“<b>The cost of removing an application security vulnerability during the design phase ranges from 30-60 times less than if removed during production.</b>”- NIST, IBM, and Gartner Group</span><br /><div style="font-family: calibri, arial, helvetica, sans-serif; font-size: 16px;"><br /></div><div style="font-family: calibri, arial, helvetica, sans-serif; font-size: 16px;">Bottom line is that,<strong> You cannot write a vulnerable code and rely upon WAF, </strong><span rtenodeid="28" style="font-size: 12pt;"><strong>RASP and other protection mechanisms to protect your application. </strong></span></div></div><div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;"><h4>Secure SDLC </h4></div><div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;"><div style="font-family: calibri, arial, helvetica, sans-serif;"></div><div style="font-family: calibri, arial, helvetica, sans-serif; line-height: 150%;"><span style="font-family: "calibri" , sans-serif;">The defenses we talked about above do help in improving our security model. However, in my opinion, it is the wrong way of solving the problem. The best approach is that the application should itself carry the ability to protect itself and henceforth, be built with security in mind from day one. Experts recommend that security should be embedded into all stages of SDLC i.e. Requirements gathering, Design, Development, Testing, Implementation.<o:p></o:p></span></div></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjmvs6B5waVwKIzk71B5bYydVoG2I71gRkJNcrbrD9MaPDqCdEdn2DLMt2Btw9efL8BHRhIh612qrNQbpm1px_NLog2ZfmZf0i3iFNf2LiHN2bWYoB4K7zRl8aWqqvpuGJJLM-08tM4kuc/s1600/600px-Security_in_the_SDLC_Process.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="370" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjmvs6B5waVwKIzk71B5bYydVoG2I71gRkJNcrbrD9MaPDqCdEdn2DLMt2Btw9efL8BHRhIh612qrNQbpm1px_NLog2ZfmZf0i3iFNf2LiHN2bWYoB4K7zRl8aWqqvpuGJJLM-08tM4kuc/s640/600px-Security_in_the_SDLC_Process.png" width="640" /></a></div><div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;">Let's talk about how security could fit into all stages of SDLC:</div><div rtenodeid="38" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;"><br rtenodeid="39" /></div><div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;"><strong>i) Requirements</strong></div><div rtenodeid="41" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;"><div style="line-height: 150%;"><span style="font-family: "calibri" , sans-serif;"><br /></span></div><div style="line-height: 150%;"><span style="font-family: "calibri" , sans-serif;">The first phase of SDLC is the "Requirement" in which project scope and goals are set.  In this phase, OWASP recommends the establishment of security requirements of the application. The requirements of the customer should be checked in accordance with the security standards such as the password policies, secure network protocols etc. <o:p></o:p></span></div></div><div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;"><br /></div><div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;"><strong>ii) Design </strong></div><div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;"><div style="line-height: 150%;"><span style="font-family: "calibri" , sans-serif;">In the design phase, OWASP recommends the building of design with security in mind. This involves what is known as <span style="background: white;">Threat modelling, which is an approach that involves analyzing the security of an application in order to mitigate the threats which yields the security plan. ​ The following is a great presentation on how threat modelling should be performed. </span><o:p></o:p></span></div><div style="line-height: 150%;"><br /></div></div><iframe allowfullscreen="" frameborder="0" height="360" src="https://www.youtube.com/embed/ZtSrcq7gscE" width="577"></iframe> <br /><div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;"><strong><br /></strong></div><div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;"><strong>iii) Development </strong></div><div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;"><div style="line-height: 150%;"><br /></div><span style="font-family: "calibri" , sans-serif; line-height: 150%;">In Development phase, OWASP recommends developers to follow "Secure Coding Standards" for which, the organization must conduct an awareness on Secure Coding for developers, because guidelines are often overlooked by developers. Apart from that Source code, reviews must by done by internal team. It is also recommended to have this conducted via third party to mitigate additional findings.</span><br /><strong><br /></strong><strong>iv) Testing </strong></div><div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;"><div style="line-height: 150%;"><br /></div><div style="line-height: 150%;"><span style="font-family: "calibri" , sans-serif;">In testing phase, OWASP recommends performing a penetration test including infrastructure assessment, in order to counter verify if the findings present inside the design and development phase have been properly fixed. Both Static and Dynamic code analysis should be thoroughly performed. <o:p></o:p></span></div><div style="line-height: 150%;"><br /></div><div style="line-height: 150%;"><span style="font-family: "calibri" , sans-serif;">Special attention should be paid to Business logic bugs which cannot be otherwise found by automated scanners as the business logic varies for every application. Efforts made in second phase i.e. Design could reduce the number of business logic bugs significantly. <o:p></o:p></span></div><br /><div style="line-height: 150%;"><br /></div><strong>v) Deployment </strong></div><div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px;"><span style="font-family: "calibri" , "arial" , "helvetica" , sans-serif;"><br /></span><span style="font-family: "calibri" , "arial" , "helvetica" , sans-serif;">Deployment is a phase where your application goes from development into production environment. In this phase, OWASP recommends securely conducting the migration process from development phase to production phase and to ensure that post production security requirements are met.</span><br /><span style="font-family: "calibri" , "arial" , "helvetica" , sans-serif;"><br /></span><span style="font-family: "calibri" , "arial" , "helvetica" , sans-serif;">In case you would like to learn more about Secure SDLC, I would recommend the following presentation -</span><span style="font-family: "calibri" , "arial" , "helvetica" , sans-serif; font-size: 16px;"> "</span><strong style="font-family: calibri, arial, helvetica, sans-serif; font-size: 16px;"><a href="https://www.owasp.org/images/7/76/Jim_Manico_(Hamburg)_-_Securiing_the_SDLC.pdf" target="_blank">Secure Development Lifecycle</a></strong><span style="font-family: "calibri" , "arial" , "helvetica" , sans-serif; font-size: 16px;">".</span></div><div rtenodeid="74" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; text-decoration: underline;"><strong style="line-height: 150%;"><span style="font-family: "calibri" , sans-serif;"><br /></span></strong><strong style="line-height: 150%;"><span style="font-family: "calibri" , sans-serif;">Security is an ongoing process, no specific requirement has to be met for 100% security. </span></strong></div><div rtenodeid="76" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; text-decoration: underline;"><br /><div style="line-height: 150%;"><span style="font-family: "calibri" , sans-serif;">It should be noted that even after introducing security in every process of SDLC, 100% security cannot be achieved. However, the threat probability could be reduced. As security analysts, we have to close a 100 doors from which an attacker could enter and as an attacker, s/he only needs one door.  The fact that appeals most to me about this approach is that it's proactive, not reactive which is how most of the application development nowadays is done. ​<u style="text-decoration: underline;"><o:p></o:p></u></span></div></div></div>

Secure Application Development And Modern Defenses

Abstract When it comes to the internet, security has always been an after-thought. A great evidence to support the theory can be seen when w...

+ Read more »

Airtel Diwali Offer — Get 100MB 3G Data For Free [ Limited Time]

<div dir="ltr" style="text-align: left;" trbidi="on"><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;">Airtel Is Come Up With Free Data Diwali Offer. Where You Will Get Free 100 MB 3G Data Without Any Cost, This Offer Is Valid For Very Short Time So Friends Avail This Offer Now.</span></span><br /><br /><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;"></span></span><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;"><b><span style="color: red;">How to Get This Deal ?</span></b></span></span><br /><br /><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;"></span></span><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;">* First Go to "Messaging" Of Your Phone</span></span><br /><br /><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;"></span></span><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;">* Create a New Message</span></span><br /><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;"> </span></span><br /><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;"></span></span><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;">* TYPE <b>TRY3G</b> And Send It to <b>51617</b></span></span><br /><br /><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;"></span></span><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;">* Done Your Will Get 100MB 3G Data.</span></span><br /><br /><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;"></span></span><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;"><b><span style="color: red;">Second Method :-</span></b></span></span><br /><br /><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;"></span></span><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;">• Call On <b>129</b>, Now Choose Language Between Hindi or English</span></span><br /><br /><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;"></span></span><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;">• Now You Will Hear Something Like That <b>Get 100 MB 3G Data Platinum Pack For Free</b></span></span><br /><br /><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;"></span></span><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;">* Now Press <b>1</b> For Activait This Plan</span></span><br /><br /><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;"><b><span style="color: red;">Enjoy Free Data</span></b></span></span></div>

Airtel Diwali Offer — Get 100MB 3G Data For Free [ Limited Time]

Airtel Is Come Up With Free Data Diwali Offer. Where You Will Get Free 100 MB 3G Data Without Any Cost, This Offer Is Valid For Very Short ...

+ Read more »

Tokri.com Offer — Register Now And Get Free Rs.500 Cash [Pune Users]

<div dir="ltr" style="text-align: left;" trbidi="on"><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;">Hi Friends</span></span><br /><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;"></span></span><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;">Here Is A New Offer For Our Visitors, Tokri.com Is Offering Free Rs.500 Cash For Pune Users. You Can Use This Cash For Purchasing Item Thats You Need Daily. So Friends What Are You Waiting For, Avail This Offer Now.</span></span><br /><br /><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;"></span></span><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;"><b><span style="color: red;">How to Get This Deal ?</span></b></span></span><br /><br /><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;"></span></span><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;">* Goto <a href="http://tokri.com/"><span style="color: red;">Offer Page</span></a></span></span><br /><br /><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;"></span></span><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;">* Register New Account</span></span><br /><br /><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;"></span></span><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;">* Enjoy Free Rs.500 Cash</span></span><br /><br /><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;"></span></span><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: large;">* You Can Use This Cash For Online Purchase.</span></span></div>

Tokri.com Offer — Register Now And Get Free Rs.500 Cash [Pune Users]

Hi Friends Here Is A New Offer For Our Visitors, Tokri.com Is Offering Free Rs.500 Cash For Pune Users. You Can Use This Cash For Purchasin...

+ Read more »

Vodafone Diwali Loot - Get 100 MB 3G Data For Free !!

<p dir="ltr"><b><i>Vodafone Is Also Celebrating </i></b><b><i>Diwali</i></b><b><i> In This 2015 Year, So It Is Giving Free 100 MB Data Pack</i></b><br><b><i>(3G or 2G) On 11 Nov. by Sending A </i></b><b><i>Sms</i></b><b><i> So Friends Enjoy Free 100MB Data In This </i></b><b><i>Dewali</i></b><b><i>.</i></b><br></p><p dir="ltr"><b><i>How to Get This Deal ?</i></b></p><p dir="ltr"><b><i>* First Take Your Phone In Your Hand</i></b></p><p dir="ltr"><b><i>* Now Go to "Messaging"</i></b></p><p dir="ltr"><b><i>* Create A New Message</i></b></p><p dir="ltr"><b><i>* TYPE "</i></b><b><i>DIWALI</i></b><b><i>" And Sent it To 199</i></b></p><p dir="ltr"><b><i>* Enjoy Free 100 MB Data.</i></b></p><p dir="ltr"><b><i>NOTE :- This Offer Will Work On 11th Nov.Only.</i></b></p>

Vodafone Diwali Loot - Get 100 MB 3G Data For Free !!

Vodafone Is Also Celebrating Diwali In This 2015 Year, So It Is Giving Free 100 MB Data Pack (3G or 2G) On 11 Nov. by Sending A Sms So Fri...

+ Read more »

Paytm 100% Cashback Sale [Live]

<p dir="ltr"><b><i>Paytm</i></b><b><i> Now A Big Recharge Shopping Site.</i></b><br><b><i>Which Has Come Up With A New </i></b><b><i>Cashback</i></b><b><i> Offer,</i></b><br><b><i>Where You Will Get Flat 100% </i></b><b><i>Cashback</i></b><b><i> On</i></b><br><b><i>Selected Products So Make Your Shopping From</i></b><br><b><i>Paytm</i></b><b><i> & Get Huge Discount & </i></b><b><i>Cashback</i></b><b><i>.</i></b><br></p><p dir="ltr"><b><i>How to Get This Deal ?</i></b></p><p dir="ltr"><b><i>* Go to Offer Page</i></b><br></p><p dir="ltr"><b><i>* Select Product & Click On Buy Now</i></b></p><p dir="ltr"><b><i>* Log In Or Register</i></b><br></p><p dir="ltr"><b><i>* Proceed to Checkout</i></b></p><p dir="ltr"><b><i>* Apply Promo Code :- </i></b><b><i>MKT100</i></b></p><p dir="ltr"><b><i>* Add Shipping Details</i></b></p><p dir="ltr"><b><i>* Pay Amount</i></b></p><p dir="ltr"><b><i>Cashback</i></b><b><i> Added To Your Wallet Soon</i></b></p>

Paytm 100% Cashback Sale [Live]

Paytm Now A Big Recharge Shopping Site. Which Has Come Up With A New Cashback Offer, Where You Will Get Flat 100% Cashback On Selected Pr...

+ Read more »

GoGo Read- Swipe App Offer — Get Rs .10 For Each Referral [ Max .100 ]

<p dir="ltr"><b><i>GoGo</i></b><b><i> Is A New Earning Android App Which Is Giving Rs.10 For Each Referral And You Can Also</i></b><br><b><i>Earn Money By Reading Article & Doing Other Tasks.</i></b><br><b><i>This Android App Is Also Giving 500 Points Means Rs.5 For Sign Up Bonus And You Can Earn Maximum Of Rs.100. </i></b></p><p dir="ltr"><b><i>So Hurry Up & Claim Your Rs.100 Now.</i></b><br><b><i>How to Get This Deal ?</i></b><br><b><i>* Download </i></b><a href="http://r.planetgogo.com/dz742/3"><b><i>GoGo</i></b></a><a href="http://r.planetgogo.com/dz742/3"><b><i> Swipe Earn </i></b></a><a href="http://r.planetgogo.com/dz742/3"><b><i>Talktime</i></b></a><b><i> App</i></b></p><p dir="ltr"><b><i>* Open The App & Register New Account</i></b></p><p dir="ltr"><b><i>* After That Complete Verification.</i></b></p><p dir="ltr"><b><i>* After Successful Registration, You Will Get 500 Points Mean Rs.5 Sign Up</i></b></p><p dir="ltr"><b><i>* Now Start Referring Your Friends And Earn 1000 Points Means Rs.10 Per Refer.</i></b></p><p dir="ltr"><b><i>* You Can Refer Maximum Of Your 10 Friends, And Max Earn Rs.100.</i></b></p><p dir="ltr"><b><i>Minimum Redeem Amount Is Rs.100</i></b></p><p dir="ltr"><b><i>Happy Earning.</i></b></p>

GoGo Read- Swipe App Offer — Get Rs .10 For Each Referral [ Max .100 ]

GoGo Is A New Earning Android App Which Is Giving Rs.10 For Each Referral And You Can Also Earn Money By Reading Article & Doing Other ...

+ Read more »

[Freecharge] Get Rs.50 Cashback On Recharge Of Rs.50 For New Users

<div dir="ltr" style="text-align: left;" trbidi="on"><i><b><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: small;">Freecharge Has Come Up With A New Loot Offer, Where You Will Get Rs.50 Cashback On Min Recharge Of Rs.50 This Offer Is Valid For New Users, Payment Must Done by Credit/Debit Card to Get Cashback.</span></span></b></i><br /><i><b><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: small;"></span></span></b></i><i><b><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: small;"><span style="color: red;">How to Get This Deal ?</span></span></span></b></i><br /><i><b><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: small;"></span></span></b></i><i><b><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: small;">• Go to Freecharge</span></span></b></i><br /><i><b><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: small;"></span></span></b></i><i><b><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: small;">• Register New Account</span></span></b></i><br /><i><b><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: small;"></span></span></b></i><i><b><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: small;">• Start a Recharge Worth Rs.50</span></span></b></i><br /><i><b><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: small;"></span></span></b></i><i><b><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: small;">• Apply Promo Code :- <span style="color: red;">HEY75</span></span></span></b></i><br /><i><b><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: small;"></span></span></b></i><i><b><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: small;">• Make Payment.</span></span></b></i><br /><i><b><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: small;"></span></span></b></i><i><b><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: small;">After Successful Payment You Will Get Cashback</span></span></b></i><br /><i><b><span style="font-family: "Trebuchet MS",sans-serif;"><span style="font-size: small;"></span></span></b></i><i><b><span style="font-family: "Trebuchet MS",sans-serif;"><span style="color: red; font-size: small;">Terms Added Soon</span></span></b></i></div>

[Freecharge] Get Rs.50 Cashback On Recharge Of Rs.50 For New Users

Freecharge Has Come Up With A New Loot Offer, Where You Will Get Rs.50 Cashback On Min Recharge Of Rs.50 This Offer Is Valid For New Users...

+ Read more »

OLA STORE MAHALOOT:- Rs 100 off on min purchase of Rs 101 (New users)

<div dir="ltr" style="text-align: left;" trbidi="on"><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><img alt="ola-store-logo@2x.png" src="https://olastore.com/img/ola-store-logo@2x.png" /></span></span></i><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><br /></span></span></i><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><strong>Hi Friends</strong></span></span></i><br /><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"></span></span></i><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><strong><strong>[Ola Store] Rs 100 off on min purchase ofRs 101 (New users)</strong></strong></span></span></i><br /><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"></span></span></i><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><strong><br /></strong></span></span></i><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"></span></span></i><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><strong><strong><span style="color: red; text-align: center;">HOW TO GET THIS DEAL:-</span></strong></strong></span></span></i><br /><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"></span></span></i><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><strong><strong>1. Firstly Visit <a href="https://olastore.com/?_e_pi_=7%2CPAGE_ID10%2C5843375310">OLA STORE</a></strong></strong></span></span></i><br /><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"></span></span></i><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><strong><strong>2.Coupon code:“<span style="color: red;">FLAT100</span>"</strong></strong></span></span></i><br /><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"></span></span></i><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><strong><strong><strong><strong><strong><strong><strong>3.Valid till Nov 15 2015</strong></strong></strong></strong></strong></strong></strong></span></span></i><br /><br /></div>

OLA STORE MAHALOOT:- Rs 100 off on min purchase of Rs 101 (New users)

Hi Friends [Ola Store] Rs 100 off on min purchase ofRs 101 (New users) HOW TO GET THIS DEAL:- 1. Firstly Visit OLA STORE 2.Coupon code:“ FLA...

+ Read more »

Celebrate Diwali with Mi – Get Deals at Re. 1 & Many More

<div dir="ltr" style="text-align: left;" trbidi="on"><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;">Hi Friends</span></span></i></b><br /><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"></span></span></i></b><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><span>Diwali is just around the corner and the festive shopping has already begun. While most e-commerce sites have already started their respective festive sales, Xiaomi also seems prepared to hold its sale. A couple of days back, the company had hinted about its Diwali sale in the market.Today, Xiaomi has shed some more light on its Diwali sales plan – it will be hosting <span style="color: firebrick;">Re. 1 Flash sale</span> on some of its products. On Diwali on November 3, 4 and 5, So get ready to bangthis Diwali and avail this offer, here are the steps :-</span></span></span></i></b><br /><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"></span></span></i></b><br /><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"></span></span></i></b><h2><i><span style="font-weight: normal;"><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><span>How to Get Rs.1 Flash Sale :-</span></span></span></span></i></h2><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"></span></span></i></b><ul><li><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><span><a href="http://bit.ly/MI_Diwali_Sale" rel="nofollow" target="_blank">Visit here for the MI Flash Sale Offer page</a></span></span></span></i></b></li><li><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><span>Login or Register</span></span></span></i></b></li><li><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><span>Share this on Facebook or Twitter to register for the ₹1 Flash Sale</span></span></span></i></b></li><li><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><span>You will see msg ” Yippie! Your hot seat is booked for the awesome ₹1 offer”</span></span></span></i></b></li><li><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><span>Back on  2pm and 6pm during 3rd-5th November to grab product at Rs. 1.</span></span></span></i></b></li><li><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><a href="http://mobile.mi.com/in/service/diwali2015/" rel="nofollow" target="_blank"><span>For More Info About Rs.1 Flash Sale</span></a></span></span></i></b></li></ul><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"></span></span></i></b><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><a href="http://mobile.mi.com/in/service/diwali2015/" rel="nofollow" target="_blank"><span>About Rs.1 Sale:-</span></a></span></span></i></b><br /><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"></span></span></i></b><ul><li><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><span>The flash sale will be held on mi.com/in at 2pm and 6pm on the 3rd, 4th and 5th November.</span></span></span></i></b></li><li><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><span>Users are eligible for the flash sale only if the promotion from mi.com/in/— hasbeen shared via Facebook/Twitter between 10 am 28th Oct to 4 pm 5th Nov.</span></span></span></i></b></li><li><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><span>To be eligible users need to share the promotion2 hours prior to the flash sale. i.e 2pm and 6pm during 3rd-5th November.</span></span></span></i></b></li><li><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><span>Sharing the promotion once via Facebook/Twitter will be sufficient for users to be eligible for all the flash sales held between 3rd to 5th November.</span></span></span></i></b></li><li><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><span>Warranty service are not applicable for products sold during the flash sale at ₹1</span></span></span></i></b></li></ul><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"></span></span></i></b><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><img alt="1" class="alignnone size-full wp-image-286972" height="310" src="http://dogpodd8wzoz.cloudfront.net/wp-content/uploads/11214.jpg" width="683" /></span></span></i></b><br /><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"></span></span></i></b><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><span>After Sharing this on Facebook you will get this Message</span></span></span></i></b><br /><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"></span></span></i></b><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><img alt="Untitled" class="alignnone size-full wp-image-286973" height="356" src="http://dogpodd8wzoz.cloudfront.net/wp-content/uploads/Untitled2454.png" width="662" /></span></span></i></b><br /><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"></span></span></i></b><h2 style="text-align: center;"><i><span style="font-weight: normal;"><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><span style="color: firebrick;"><span>Festive</span></span> <span style="color: firebrick;"><span>Offer prices to be revealed soon :-</span></span></span></span></span></i></h2><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"></span></span></i></b><br /><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"></span></span></i></b><div style="text-align: center;"><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><span><a href="http://www.mi.com/in/redmi2/" rel="nofollow" target="_blank"><img alt="23" class="alignnone size-full wp-image-286935" height="236" src="http://dogpodd8wzoz.cloudfront.net/wp-content/uploads/2327.png" title="" width="412" /></a></span></span></span></i></b></div><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"></span></span></i></b><div style="text-align: center;"><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><span><a href="http://www.mi.com/in/mi4/" rel="nofollow" target="_blank"><img alt="24" class="alignnone size-full wp-image-286936" height="241" src="http://dogpodd8wzoz.cloudfront.net/wp-content/uploads/2410.png" title="" width="402" /></a></span></span></span></i></b></div><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"></span></span></i></b><div style="text-align: center;"><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><span><a href="http://www.mi.com/in/mi4i/" rel="nofollow" target="_blank"><img alt="25" class="alignnone size-full wp-image-286937" height="226" src="http://dogpodd8wzoz.cloudfront.net/wp-content/uploads/2515.png" title="" width="383" /></a></span></span></span></i></b></div><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"></span></span></i></b><div style="text-align: center;"><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><span><a href="http://www.mi.com/in/mipad/" rel="nofollow" target="_blank"><img alt="26" class="alignnone size-full wp-image-286938" height="223" src="http://dogpodd8wzoz.cloudfront.net/wp-content/uploads/2610.png" title="" width="375" /></a></span></span></span></i></b></div><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"></span></span></i></b><b><i><span style="font-size: small;"><span style="font-family: "Trebuchet MS",sans-serif;"><br /></span></span></i></b></div>

Celebrate Diwali with Mi – Get Deals at Re. 1 & Many More

Hi Friends Diwali is just around the corner and the festive shopping has already begun. While most e-commerce sites have already started t...

+ Read more »

Paymyreview Refer And Earn Offer — Refer Your Friends And Get Rs.10 Recharge For Each [Ending Soon]

<div dir="ltr" style="text-align: left;" trbidi="on"><b><span style="font-family: "Trebuchet MS",sans-serif;">Paymyreview Is A New Earning App, Where You Will Get Rs.10 Fo Each Referral. You Can Earn Maximum Of Rs.200 By Referring Friends.</span></b><br /><br /><b><span style="font-family: "Trebuchet MS",sans-serif;"></span></b><b><span style="font-family: "Trebuchet MS",sans-serif;"><span style="color: red;">How to Get This Deal ?</span></span></b><br /><b><span style="font-family: "Trebuchet MS",sans-serif;"></span></b><b><span style="font-family: "Trebuchet MS",sans-serif;">* Download <a href="https://play.google.com/store/apps/details?id=com.paymyreview"><span style="color: red;">Paymyreview</span></a></span></b><br /><br /><b><span style="font-family: "Trebuchet MS",sans-serif;"></span></b><b><span style="font-family: "Trebuchet MS",sans-serif;">* Open The App & Register With Facebook Or Gmail</span></b><br /><br /><b><span style="font-family: "Trebuchet MS",sans-serif;"></span></b><b><span style="font-family: "Trebuchet MS",sans-serif;">* At Last Complete Your Profile & Verify Your Mobile No.</span></b><br /><br /><b><span style="font-family: "Trebuchet MS",sans-serif;"></span></b><b><span style="font-family: "Trebuchet MS",sans-serif;">* Apply This Referral Code For Supporting Us :- <span style="color: red;">A6F582A9</span></span></b><br /><br /><b><span style="font-family: "Trebuchet MS",sans-serif;"></span></b><b><span style="font-family: "Trebuchet MS",sans-serif;"><span style="color: red;">Now Refer Your Friends Using Your Referral Code, You Will Get Rs.10 For Each Friends</span></span></b><br /><br /><b><span style="font-family: "Trebuchet MS",sans-serif;"></span></b><b><span style="font-family: "Trebuchet MS",sans-serif;">You Can Use This Cash For Recharge</span></b><br /><br /><b><span style="font-family: "Trebuchet MS",sans-serif;"></span></b><b><span style="font-family: "Trebuchet MS",sans-serif;"><span style="color: red;">Unlimited Trick -</span></span></b><b><span style="font-family: "Trebuchet MS",sans-serif;"><br />* Install Youwave On Your Computer</span></b><b><span style="font-family: "Trebuchet MS",sans-serif;"><br />* After That Download Paymyreview App On Youwave</span></b><b><span style="font-family: "Trebuchet MS",sans-serif;"><br />* Open Paymyreview</span></b><b><span style="font-family: "Trebuchet MS",sans-serif;"><br />* Register New Account Using New Email Or No.</span></b><b><span style="font-family: "Trebuchet MS",sans-serif;"><br />* Enter Your Referral Code.</span></b><b><span style="font-family: "Trebuchet MS",sans-serif;"><br />* You Will Get Rs.10 For Each Referral.</span></b><b><span style="font-family: "Trebuchet MS",sans-serif;"><br /></span></b><b><span style="font-family: "Trebuchet MS",sans-serif;">Now Restore Youwave & Repeat Above Steps Again For Earn Unlimited.</span></b></div>

Paymyreview Refer And Earn Offer — Refer Your Friends And Get Rs.10 Recharge For Each [Ending Soon]

Paymyreview Is A New Earning App, Where You Will Get Rs.10 Fo Each Referral. You Can Earn Maximum Of Rs.200 By Referring Friends. How to Ge...

+ Read more »

Wooplr Offer - Get 50 Points On Registration + 20 Per Refer !

<p dir="ltr"><i><b>Wooplr</b></i><i><b> Is New Android App Which Is Giving 50 Points For Registration Bonus + You Can Also Refer Your Friends And Earn 20 Points For Each Friends.</b></i></p><p dir="ltr"><i><b>You Can Redeem Your Earning As</b></i><br><i><b>Shopping Gift Cards So Friends Download This Amazing App & Start Earning.</b></i></p><p dir="ltr"><i><b>• You Will Also Get </b></i><i><b>Gigato</b></i><i><b> 25 MB Gift Voucher Via </b></i><i><b>Sms</b></i><i><b> For Redeem This Coupon, Go to </b></i><i><b>Gigato</b></i><i><b> </b></i><i><b>App</b></i><i><b> & Redeem Your Coupon/></b></i></p><p dir="ltr"><i><b>How to Get This Deal ?</b></i></p><p dir="ltr"><i><b>* Download </b></i><i><b><a href="http://justwoop.it/get-app">Wooplr</a></b></i><i><b> App</b></i></p><p dir="ltr"><i><b>* Install The App & Open it</b></i></p><p dir="ltr"><i><b>* To Get 50 Points Enter This Promo Code :- AMA506 And Apply It.</b></i></p><p dir="ltr"><i><b>If You Skip This Steps Then You Will Not Get 50 Points Joining Bonus</b></i></p><p dir="ltr"><i><b>* After That Choose Log In Option Between Facebook Or Google</b></i></p><p dir="ltr"><i><b>* Now </b></i><i><b>Select</b></i><i><b> Gift Logo, Now Share Your Referral Code</b></i></p><p dir="ltr"><i><b>You Will Get 20 Points For Each Referral Minimum Payout Is 500 Points</b></i></p>

Wooplr Offer - Get 50 Points On Registration + 20 Per Refer !

Wooplr Is New Android App Which Is Giving 50 Points For Registration Bonus + You Can Also Refer Your Friends And Earn 20 Points For Each Fr...

+ Read more »

Paypal Mobile Verification And Payment Restrictions Bypass

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYmFzmkMyKmScriu10jOqcs_-RLPL1ZJnTFkdGg5j3fJ6ooP3zpX7vrL9F2cH_28pKZH7G78QEKcoX2XguLvhdMIu3YLkD66a0Y9LdekFwpz1jLg_mP-nERnbl-9Y7oz6H0zxjPKJDAJc/s1600/download.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="266" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYmFzmkMyKmScriu10jOqcs_-RLPL1ZJnTFkdGg5j3fJ6ooP3zpX7vrL9F2cH_28pKZH7G78QEKcoX2XguLvhdMIu3YLkD66a0Y9LdekFwpz1jLg_mP-nERnbl-9Y7oz6H0zxjPKJDAJc/s400/download.jpg" width="400" /></a></div><br />In this post, i would like to share a very simple logic flaw I found earlier this year I have found a way to circumvent mobile verification by utilizing a different portal for logging into a paypal account. The flaw lies in the fact that paypal does not perform two step verification/authorization checks on all different portals that are used to log into a paypal account. Ideally, there should be a centralized authentication mechanism to authenticate the user or else additional authorization checks have to be applied to all different portals that are used to log into paypal ccount.<br /><a name='more'></a><br />In this case, We could use the mobile activation page to log into the paypal account without happen to use a mobile phone.<br /><br /><b><a href="https://www.paypal.com/us/cgi-bin/?cmd=_mobile-activate-outside">https://www.paypal.com/us/cgi-bin/?cmd=_mobile-activate-outside</a></b><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgiAR2RxIM2fIQfBpkxjeIyUn03QYxvCxDXO69gl4_yJZ176ZgdxcaoLwSzzg2DM6FwkQxUHb0n2EA1f-IMswf2icRKCDBnuY3JR0-b4pe87ssKx-_FCuE-26tUIm_LVVSNHc4YeXljfRI/s1600/sss.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="572" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgiAR2RxIM2fIQfBpkxjeIyUn03QYxvCxDXO69gl4_yJZ176ZgdxcaoLwSzzg2DM6FwkQxUHb0n2EA1f-IMswf2icRKCDBnuY3JR0-b4pe87ssKx-_FCuE-26tUIm_LVVSNHc4YeXljfRI/s640/sss.png" width="577" /></a></div><br /><h4>Demonstration</h4><iframe allowfullscreen="" frameborder="0" height="281" mozallowfullscreen="" src="https://player.vimeo.com/video/140455516" webkitallowfullscreen="" width="500"></iframe> <br /><br />Unfortunately, the bug was marked as duplicate so it was not eligible for a bounty, however that really doesn't matter as the fun and the learning is more important. However, there are still other ways to circumvent mobile verification, however i did not wish to report.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEinoqkLXPjFYaPo_xxdUbbYJfhY2Abwl8GTg-lC6DdIv_LHaojTotHokNZKKNFrTuvPVeq0vL5Baml2eTKvnZaeckKwKiXf5mqkji4IYl2HsaPU5TezuGi69j_ujslEgayGD3wqfZqNVho/s1600/fix.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="178" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEinoqkLXPjFYaPo_xxdUbbYJfhY2Abwl8GTg-lC6DdIv_LHaojTotHokNZKKNFrTuvPVeq0vL5Baml2eTKvnZaeckKwKiXf5mqkji4IYl2HsaPU5TezuGi69j_ujslEgayGD3wqfZqNVho/s640/fix.png" style="cursor: move;" width="577" /></a></div><div class="separator" style="clear: both; text-align: left;"></div><h4>Bypassing Payment Restrictions</h4><div class="separator" style="clear: both; text-align: left;">After you have bypassed paypal might restrict you from transferring funds to another account, however there is a simple way of bypassing it as well, all you have to do is to create a donation button or any other payment button from paypal and directly use that to transfer money, paypal does not enforce any restriction on it.</div><h4>Example</h4><b><a href="https://www.paypal.com/id/cgi-bin/webscr?cmd=_flow&SESSION=OvGwImW-aZGi7_Jf-oBOYlXFljX6KfnUMxeUoxyow7Woq8ZZYb7SihFpKQy&dispatch=50a222a57771920b6a3d7b606239e4d529b525e0b7e69bf0224adecfb0124e9b61f737ba21b08198d1a93361f052308ac20c1249d8113f4c">https://www.paypal.com/id/cgi-bin/webscr?cmd=_flow&SESSION=OvGwImW-aZGi7_Jf-oBOYlXFljX6KfnUMxeUoxyow7Woq8ZZYb7SihFpKQy&dispatch=50a222a57771920b6a3d7b606239e4d529b525e0b7e69bf0224adecfb0124e9b61f737ba21b08198d1a93361f052308ac20c1249d8113f4c</a></b></div>

Paypal Mobile Verification And Payment Restrictions Bypass

In this post, i would like to share a very simple logic flaw I found earlier this year I have found a way to circumvent mobile verification ...

+ Read more »

How to Spy on Text Messages

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEild9_bAB0eTfSFqfGwlbzhLuNZbIw7n6FFe9aBlA9MK6K-srrAPEC5-vhLAI8MYVPltwzODQRaeHpdnBUvspQDfxPB5t1yWa_HJZZsAwRYlL6UDVvLGiMFxTV9C8urStbpEaXLtSDjiuw/s1600/download.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEild9_bAB0eTfSFqfGwlbzhLuNZbIw7n6FFe9aBlA9MK6K-srrAPEC5-vhLAI8MYVPltwzODQRaeHpdnBUvspQDfxPB5t1yWa_HJZZsAwRYlL6UDVvLGiMFxTV9C8urStbpEaXLtSDjiuw/s1600/download.jpeg" /></a></div>It seems that in recent years most of society, especially the younger generations, have turned to texting as their preferred mode of conversation. The infinite ability to communicate with other people around the world effortlessly has become a growing concern for parents and employers alike who wish to 'keep an eye on', or monitor, their children or employees. In this post we will discuss the methods and implications of text message spying.<br /><a name='more'></a><h4>Methods To Spy On Text Messages</h4>There are several methods to spy on text messages, however we would only discuss the following two methods which happen to be easy for parents/employeers to monitor their children/employees  activities.<br /><h4>Method 1: Using a Spying App</h4>The easiest way to spy on text messages is to use one of spying application. Today there exist literally hundred's of products claiming to spy on text messages, however most of them are overpriced or they are not compatible with wide variety of smartphones. With that being said, there are still very few spying softwares that stand out to competition and one of my favorite is <a href="http://mspy.go2cloud.org/SH2aF" rel="nofollow" target="_blank">mspy</a>.<br /><br /><a href="http://mspy.go2cloud.org/SH2aF" rel="nofollow" target="_blank">mspy</a> posses state of art stealth capabilities to spy on various text messaging applications such as Whatsapp, Viber, Facebok Messenger, LINE so on and so forth. Apart from that you can also monitor call logs and track location of smartphone (Absolutely must have for Parents).  The best part being that you don't have to jailbreak your iOS device or root your android device in order to install it.<br /><h4>How it works?</h4>Upon placing and order for mspy, you would receive an application that you have to install on target's phone by simply launching the browser from the target phone, typing the URL and downloading and executing the application. Once you have successfully installed it, it would send alerts to your control panel or account which would be created once you have signed up. In case of any issue you can simply contact their 24/7 support team.<br /><br /><div style="text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0rpxVr_gG3ZSL_k5viZ_XyRtxxrFm0XvOkULoSRXbPwxkkS76zAgU3x-HwHgzVevGLp_khndFmQ8sNqIdC0Pk3NMiwTIjg_ffcx9Q-1cWPu_XWGpSqjOxu5JolFWx1D1QDTv8zNBVCbE/s1600/mSpy.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0rpxVr_gG3ZSL_k5viZ_XyRtxxrFm0XvOkULoSRXbPwxkkS76zAgU3x-HwHgzVevGLp_khndFmQ8sNqIdC0Pk3NMiwTIjg_ffcx9Q-1cWPu_XWGpSqjOxu5JolFWx1D1QDTv8zNBVCbE/s1600/mSpy.jpg" /></a></div><div><div style="text-align: justify;">                                                             <a href="http://mspy.go2cloud.org/SH2aF" rel="nofollow" style="text-align: center;" target="_blank"><img border="0" height="66" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg2YolWh-0Ni78cACa65Oh4OENXDPmvS_wJPsGOZvz1QJGe8KlCZp-m2H5o2DBmF5fKzLewr74Awc3BHKXRN-JXPxNKFksm0bSlmnpjCo-jJ2loTTRiVoqZWUSCHgxe4aSaaHc8CAbfXxE/s320/download-4.png" width="320" /></a></div></div><h4>Features</h4><ul style="text-align: left;"><li>Monitor call logs, SMS and Contacts </li><li>Spy on Internet activity including social media like Facebook, Twitter and Gmail.</li><li>It is not detected by antiviruses and operates in complete stealth mode,.</li><li>Spy on text messaging apps like WhatsApp, iMessage, Viber, Snapchat, Skype, LINE and more.</li><li> Track GPS locations in real-time.</li><li> Spy on all multimedia content stored on a device. Monitor what childrens are storing on their devices. </li><li>24/7 live support.</li></ul><div style="-webkit-text-stroke-width: 0px; color: black; font-family: 'Times New Roman'; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; margin: 0px; orphans: auto; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px;"><h4>Compatibility</h4></div><div style="margin: 0px; orphans: auto; text-align: left; text-indent: 0px; widows: 1;"><ul style="text-align: left;"><li>iPhone/iPad (iOS 6 – 8.3)</li><li>Android Phones (Version 4+)</li></ul></div><div style="-webkit-text-stroke-width: 0px; color: black; font-family: 'Times New Roman'; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; margin: 0px; orphans: auto; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px;"><b><span style="font-size: x-small;">Disclaimer: SOFTWARE INTENDED FOR LEGAL USES ONLY. It is the violation of the United States federal and/or state law and your local jurisdiction law to install surveillance software, such as the Licensed Software, onto a mobile phone or other device you do not have the right to monitor. RHA shall not be responsible for any misuse of this product.</span></b></div><h4>Method 2: Using SIM Card Reader To Recover Messages</h4>In case, if you can't afford an spying app, you could look for free alternatives, however there are few drawbacks to it. One being that a lot of them found on forums are backdoored, also they require good amount of technical knowledge to setup and operate. Another way is to buy a SIM card reader from market and use victim's SIM card to recover messages or phone contacts stored on it.<br /><h4>Requirements</h4><ul style="text-align: left;"><li>PC/SC compliant smart card reader</li></ul><b><u>Note: Some phones tend to keep messages inside their internal memory, in that case you have to move messages from internal memory to SIM card. </u></b><br /><div><br /></div><b>Step 1: </b>Download "<b>Dekart SIM Manager</b>"from <b><a href="http://www.dekart.com/index.php?id=2396" rel="nofollow" target="_blank">here</a></b>.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUYz2E3AJZNiOiNtND9gZ808bOLnrMBO_g9VyZCnxEk9q-LG1eLBEgfvXOYofZs9dhyphenhyphenKS_dT3Qh2MsTxmqCHf4KDlSFMnryBCLJ1xfofdxXl7d8q4lhygLG68Z-qp7x7Epi6AOhu8nMKM/s1600/download.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="283" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUYz2E3AJZNiOiNtND9gZ808bOLnrMBO_g9VyZCnxEk9q-LG1eLBEgfvXOYofZs9dhyphenhyphenKS_dT3Qh2MsTxmqCHf4KDlSFMnryBCLJ1xfofdxXl7d8q4lhygLG68Z-qp7x7Epi6AOhu8nMKM/s400/download.png" width="400" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;"><b>Step 2: </b>Once the sim card has been plugged into the SIM card reader and the card reader has been connected to your computer. Press the"<b>READ"</b> button to read the messages, GSM contacts, last dialed numbers etc. </div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjoRw8XMpfTjWhUth_aUQuFbskrjrxQEYb2tIAe4vvsL2iodJcVubFc1wLLjXn-FUDjVJrH0CR32FMIh3HqAATpjYzfB2fnektwpGcLc2vt65GJ21Nr1aoXq3F8YX_K4RDuMzeEgVBi5rI/s1600/nami.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjoRw8XMpfTjWhUth_aUQuFbskrjrxQEYb2tIAe4vvsL2iodJcVubFc1wLLjXn-FUDjVJrH0CR32FMIh3HqAATpjYzfB2fnektwpGcLc2vt65GJ21Nr1aoXq3F8YX_K4RDuMzeEgVBi5rI/s1600/nami.png" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><b>Step  3 -> </b>Since, our aim here is to recover deleted messages, we would go to the "<b>SMS messages</b>" tab. To recover a message right click on a message and select "<b>Undelete</b>" option.  Once this is done, press the "<b>Write</b>" button to write it on the sim card. </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><b>Note: The messages marked in "<span style="color: red;">RED</span>" are deleted messages where as the messages marked in black are the ones which are still available on the sim card.  </b></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiYwDewByydwCWkKIifkwvBsWlxsH_Am3CF4WxSgJFqADuEAUgCQwXFf5zqDS1_2QDHCG4U7jL9sp8fKI2ReS1dSVlSLPzpABAeFW4ihM0BKMayTNCWWc1g_oxHU7EBXJ39qtpfh-mmKdw/s1600/SIM-Manager-undelete-SMS.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="497" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiYwDewByydwCWkKIifkwvBsWlxsH_Am3CF4WxSgJFqADuEAUgCQwXFf5zqDS1_2QDHCG4U7jL9sp8fKI2ReS1dSVlSLPzpABAeFW4ihM0BKMayTNCWWc1g_oxHU7EBXJ39qtpfh-mmKdw/s640/SIM-Manager-undelete-SMS.png" width="577" /></a><span style="font-size: xx-small;">Ref:https://www.dekart.com/fileadmin/howto/Howto-recover-deleted-SMS/SIM-Manager-undelete-SMS.png</span></div><div class="separator" style="clear: both; text-align: center;"><span style="font-size: xx-small;"><br /></span></div><b>Note: Please note that this method can only be used to recover SMS messages that are stored on the SIM not Whatsapp, Viber etc messages. To overcome this, I would suggest you to use method 1.</b> </div>

How to Spy on Text Messages

It seems that in recent years most of society, especially the younger generations, have turned to texting as their preferred mode of convers...

+ Read more »

Top 14 Web Vulneranlity Scanners

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://s3.amazonaws.com/knowbe4-images/KnowBe4+WP+Images/vuln_scan_kb4.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="424" src="https://s3.amazonaws.com/knowbe4-images/KnowBe4+WP+Images/vuln_scan_kb4.jpg" width="640" /></a></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;"><br /></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">In the past, many popular websites have been hacked. Hackers are now active and always try to hack websites and leak data. This is why security testing of web applications is very important. And here comes the role of web application security scanners. Web Application Security Scanner is a software program which performs automatic black box testing on a web application and identifies security vulnerabilities. Scanners do not access the source code, they only perform functional testing and try to find security vulnerabilities.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Various paid and free web application vulnerability scanners are available. In this post, we are listing the best free open source web application vulnerability scanners. I am adding the tools in random order. So please do not think it is a ranking of tools.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">I am only adding open source tools which can be used to find security vulnerabilities in web applications. I am not adding tools to find server vulnerabilities. And do not confuse with free tools and open source tools. Because there are various other tools available for free, but they do not provide source code to other developers. Open source tools are those which offer source codes to developers so that developers can modify the tool or help in further development.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">These are the best open source web application penetration testing tools:</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: 700; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Grabber</span></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Grabber is a nice web application scanner which can detect many security vulnerabilities in web applications. It performs scans and tells where the vulnerability exists. It can detect the following vulnerabilities:</div><ul style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin: 0px 1.5em 1.5em; padding: 0px; vertical-align: baseline;"><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Cross site scripting</li><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">SQL injection</li><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Ajax testing</li><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">File inclusion</li><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">JS source code analyzer</li><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Backup file check</li></ul><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">It is not fast as compared to other security scanners, but it is simple and portable. This should be used only to test small web applications because it takes too much time to scan large applications.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">This tool does not offer any GUI interface. It also cannot create any PDF report. This tool was designed to be simple and for personal use. You can try this tool just for personal use. If you are thinking of it for professional use, I will never recommend it.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">This tool was developed in Python. And an executable version is also available if you want. Source code is available, so you can modify it according your needs. The main script is grabber.py, which once executed calls other modules like sql.py, xss.py or others.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Download it here: <a href="http://rgaucher.info/beta/grabber/" style="border: 0px; box-sizing: border-box; color: #297aa0; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; color: blue; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">http://rgaucher.info/beta/grabber/</span></a></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Source code on Github: <a href="https://github.com/neuroo/grabber" style="border: 0px; box-sizing: border-box; color: #297aa0; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; color: blue; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">https://github.com/neuroo/grabber</span></a></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: 700; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Vega</span></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Vega is another free open source web vulnerability scanner and testing platform. With this tool, you can perform security testing of a web application. This tool is written in Java and offers a GUI based environment. It is available for OS X, Linux and Windows.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">It can be used to find SQL injection, header injection, directory listing, shell injection, cross site scripting, file inclusion and other web application vulnerabilities. This tool can also be extended using a powerful API written in JavaScript.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">While working with the tool, it lets you set a few preferences like total number of path descendants, number of child paths of a node, depth and maximum number of request per second. You can use Vega Scanner, Vega Proxy, Proxy Scanner and also Scanner with credentials. If you need help, you can find resources in the documentation section:</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Documentation: <a href="https://subgraph.com/vega/documentation/index.en.html" style="border: 0px; box-sizing: border-box; color: #297aa0; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; color: blue; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">https://subgraph.com/vega/documentation/index.en.html</span></a></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Download Vega: <a href="https://subgraph.com/vega/" style="border: 0px; box-sizing: border-box; color: #297aa0; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; color: blue; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">https://subgraph.com/vega/</span></a></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;"><span class="pardot-title" style="background: rgb(51, 66, 75); border: 0px; box-sizing: border-box; color: white; display: block; font-family: inherit; font-size: 13px; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: 55px; margin: 0px; padding: 0px 45px; text-transform: uppercase; vertical-align: baseline; width: 580px;">Dont Forget To Comment Below</span><span style="font-family: inherit; font-style: inherit; font-variant: inherit; font-weight: 700; line-height: inherit;"></span></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;"><span style="font-family: inherit; font-style: inherit; font-variant: inherit; font-weight: 700; line-height: inherit;"><br /></span></div>Zed Attack Proxy<br /><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Zed Attack Proxy is also known as ZAP. This tool is open source and is developed by AWASP. It is available for Windows, Unix/Linux and Macintosh platforms. I personally like this tool. It can be used to find a wide range of vulnerabilities in web applications. The tool is very simple and easy to use. Even if you are new to penetration testing, you can easily use this tool to start learning penetration testing of web applications.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">These are the key functionalities of ZAP:</div><ul style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin: 0px 1.5em 1.5em; padding: 0px; vertical-align: baseline;"><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Intercepting Proxy</li><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Automatic Scanner</li><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Traditional but powerful spiders</li><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Fuzzer</li><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Web Socket Support</li><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Plug-n-hack support</li><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Authentication support</li><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">REST based API</li><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Dynamic SSL certificates</li><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Smartcard and Client Digital Certificates support</li></ul><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">You can either use this tool as a scanner by inputting the URL to perform scanning, or you can use this tool as an intercepting proxy to manually perform tests on specific pages.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Download ZAP : <a href="http://code.google.com/p/zaproxy/" style="border: 0px; box-sizing: border-box; color: #297aa0; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; color: blue; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">http://code.google.com/p/zaproxy/</span></a></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: 700; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Wapiti</span></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Wapiti is also a nice web vulnerability scanner which lets you audit the security of your web applications. It performs black-box testing by scanning web pages and injecting data. It tries to inject payloads and see if a script is vulnerable. It supports both GET and POSTHTTP attacks and detects multiple vulnerabilities.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">It can detect following vulnerabilities:</div><ul style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin: 0px 1.5em 1.5em; padding: 0px; vertical-align: baseline;"><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">File Disclosure</li><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">File inclusion</li><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Cross Site Scripting (XSS)</li><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Command execution detection</li><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">CRLF Injection</li><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">SEL Injection and Xpath Injection</li><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Weak .htaccess configuration</li><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Backup files disclosure</li><li style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">and many other</li></ul><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Wapiti is a command-line application. So, it may not be easy for beginners. But for experts, it will perform well. For using this tool, you need to learn lots of commands which can be found in official documentation.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Download Wapiti with source code: <a href="http://wapiti.sourceforge.net/" style="border: 0px; box-sizing: border-box; color: #297aa0; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; color: blue; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">http://wapiti.sourceforge.net/</span></a></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: 700; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">W3af</span></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">W3af is a popular web application attack and audit framework. This framework aims to provide a better web application penetration testing platform. It is developed using Python. By using this tool, you will be able to identify more than 200 kinds of web application vulnerabilities including SQL injection, Cross-Site Scripting and many others.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">It comes with a graphical and console interface. You can use it easily by using its easy to understand interface.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">If you are using it with Graphical Interface, I do not think that you are going to face any problem with the tool. You only need to select the options and then start the scanner. If a website needs authentication, you can also use authentication modules to scan the session-protected pages.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">We have already covered this tool in detail in our previous W3af walkthrough <a href="http://resources.infosecinstitute.com/series/" style="border: 0px; box-sizing: border-box; color: #297aa0; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">series</a>. You can read those <a href="http://resources.infosecinstitute.com/articles/" style="border: 0px; box-sizing: border-box; color: #297aa0; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">articles</a> to know more about this tool.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">You can access source code at the Github repository:<a href="https://github.com/andresriancho/w3af/" style="border: 0px; box-sizing: border-box; color: #297aa0; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; color: blue; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">https://github.com/andresriancho/w3af/</span></a></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Download it from the official website: <a href="http://w3af.org/" style="border: 0px; box-sizing: border-box; color: #297aa0; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; color: blue; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">http://w3af.org/</span></a></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: 700; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">WebScarab</span></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">WebScarab is a Java-based security framework for analyzing web applications using HTTP or HTTPS protocol. With available plugins, you can extend the functionality of the tool. This tool works as an intercepting proxy. So, you can review the request and response coming to your browser and going to thw server. You can also modify the request or response before they are received by server or browser.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">If you are a beginner, this tool is not for you. This tool was designed for those who have a good understanding of HTTP protocol and can write codes.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Webscarab provides many features which helps penetration testers work closely on a web application and find security vulnerabilities. It has a spider which can automatically find new URLs of the target website. It can easily extract scripts and HTML of the page. Proxy observes the traffic between server and your browser, and you can take control of the request and response by using available plugins. Available modules can easily detect most common vulnerabilities like SQL injection, XSS< CRLF and many other vulnerabilities.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Source code of the tool is available on Github: <a href="https://github.com/OWASP/OWASP-WebScarab" style="border: 0px; box-sizing: border-box; color: #297aa0; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; color: blue; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">https://github.com/OWASP/OWASP-WebScarab</span></a></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Download WebScarab here:<a href="https://www.owasp.org/index.php/Category:OWASP_WebScarab_Project" style="border: 0px; box-sizing: border-box; color: #297aa0; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; color: blue; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">https://www.owasp.org/index.php/Category:OWASP_WebScarab_Project</span></a></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: 700; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Skipfish</span></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Skipfish is also a nice web application security tool. It crawls the website and then check each pages for various security threats and at the end prepares the final report. This tool was written in C. It is highly optimized for HTTP handling and utilizing minimum CPU. It claims that it can easily handle 2000 requests per second without adding a load on CPU. It use a heuristics approach while crawling and testing web pages. This tool also claims to offer high quality and less false positives.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">This tool is available for Linux, FreeBSD, MacOS X and Windows.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Download Skipfish or code from GOogle Codes: <a href="http://code.google.com/p/skipfish/" style="border: 0px; box-sizing: border-box; color: #297aa0; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; color: blue; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">http://code.google.com/p/skipfish/</span></a></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: 700; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Ratproxy</span></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Ratproxy is also an open source web application security audit tool which can be used to find security vulnerabilities in web applications. It is supports Linux, FreeBSD, MacOS X, and Windows (Cygwin) environments.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">This tool is designed to overcome the problems users usually face while using other proxy tools for security audits. It is capable of distinguishing between CSS stylesheets and JavaScript codes. It also supports SSL man in the middle attack, which means you can also see data passing through SSL. You can read more about this tool here: <a href="http://code.google.com/p/ratproxy/wiki/RatproxyDoc" style="border: 0px; box-sizing: border-box; color: #297aa0; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; color: blue; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">http://code.google.com/p/ratproxy/wiki/RatproxyDoc</span></a></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Download <a href="http://code.google.com/p/ratproxy/" style="border: 0px; box-sizing: border-box; color: #297aa0; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; color: blue; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">http://code.google.com/p/ratproxy/</span></a></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: 700; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">SQLMap</span></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">SQLMap is another popular open source penetration testing tool. It automates the process of finding and exploiting SQL injection vulnerability in a website’s database. It has a powerful detection engine and many useful features. So, a penetration tester can easily perform SQL injection check on a website.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">It supports range of database servers including MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase and SAP MaxDB. It offers full support to 6 kinds of SQL injection techniques: time-based blind, boolean-based blind, error-based, UNION query, stacked queries and out-of-band.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Access the source code on Github repository:<a href="https://github.com/sqlmapproject/sqlmap" style="border: 0px; box-sizing: border-box; color: #297aa0; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; color: blue; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">https://github.com/sqlmapproject/sqlmap</span></a></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Download SQLMap here: <a href="https://github.com/sqlmapproject/sqlmap" style="border: 0px; box-sizing: border-box; color: #297aa0; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; color: blue; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">https://github.com/sqlmapproject/sqlmap</span></a></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: 700; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Wfuzz</span></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Wfuzz is another freely available open source tool for web application penetration testing. It can be used to brute force GET and POST parameters for testing against various kinds of injections like SQL, XSS, LDAP and many others. It also supports cookie fuzzing, multi-threading, SOCK, Proxy, Authentication, parameters brute forcing, multiple proxy and many other things. You can read more about the features of the tool here: <a href="http://code.google.com/p/wfuzz/" style="border: 0px; box-sizing: border-box; color: #297aa0; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; color: blue; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">http://code.google.com/p/wfuzz/</span></a></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">This tool does not offer a GUI interface, so you will have to work on command line interface.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Download Wfuzz from code.google.com: <a href="http://code.google.com/p/wfuzz/" style="border: 0px; box-sizing: border-box; color: #297aa0; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; color: blue; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">http://code.google.com/p/wfuzz/</span></a></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: 700; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Grendel-Scan</span></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Grendel-Scan is another nice open source web application security tool. This is an automatic tool for finding security vulnerabilities in web applications. Many features are also available for manual penetration testing. This tool is available for Windows, Linux and Macintosh. This tool was developed in Java.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Download the tool and source code: <a href="http://sourceforge.net/projects/grendel/" style="border: 0px; box-sizing: border-box; color: #297aa0; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; color: blue; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">http://sourceforge.net/projects/grendel/</span></a></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: 700; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Watcher</span></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Watcher is a passive web security scanner. It does not attack with loads of requests or crawl the target website. It is not a separate tool but is an add-on of Fiddler. So you need to first install Fiddler and then install Watcher to use it.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">It quietly analyzes the request and response from the user-interaction and then makes a report on the application. As it is a passive scanner, it will not affect the website’s hosting or cloud infrastructure.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Download watcher and its source code: <a href="http://websecuritytool.codeplex.com/" style="border: 0px; box-sizing: border-box; color: #297aa0; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; color: blue; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">http://websecuritytool.codeplex.com/</span></a></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: 700; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">X5S</span></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">X5s is also a Fiddler add-on which aims to provide a way to find cross-site scripting vulnerabilities. This is not an automatic tool. So, you need to understand how encoding issues can lead to XSS. You need to manually find the injection point and then check where XSS can be in the application.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">We have covered the X5S in a previous post. So, you can refer to that article to read more about X5S and XSS.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Download X5S and source code from codeplex: <a href="http://xss.codeplex.com/" style="border: 0px; box-sizing: border-box; color: #297aa0; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; color: blue; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">http://xss.codeplex.com/</span></a></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">You can also refer to this official guide to know how to use X5S:<a href="http://xss.codeplex.com/wikipage?title=tutorial" style="border: 0px; box-sizing: border-box; color: #297aa0; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; color: blue; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">http://xss.codeplex.com/wikipage?title=tutorial</span></a></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: 700; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Arachni</span></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Arachni is an open source tool developed for providing a penetration testing environment. This tool can detect various web application security vulnerabilities. It can detect various vulnerabilities like SQL Injection, XSS, Local File inclusion, remote file inclusion, unvalidated redirect, and many others.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">Download this tool here: <a href="http://www.arachni-scanner.com/" style="border: 0px; box-sizing: border-box; color: #297aa0; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; color: blue; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">http://www.arachni-scanner.com/</span></a></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;"><span style="border: 0px; box-sizing: border-box; font-family: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: 700; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Final Word</span></div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">These are the best open source web application security testing tools. I tried my best to list all the tools available online. If a tool was not updated for many years, I did not mention it here. Because if a tool is more than 10 years old, it can create compatibility issues in the recent environment. If you are a developer, you can also join the developers’ community of these tools and help these tools to grow. By helping these tools, you will also increase your knowledge and expertise.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">If you want to start penetration testing, I will recommend using Linux distributions which have been created for penetration testing. These environments are backtrack, gnacktrack, backbox and blackbuntu. All these tools come with various free and opensource tools for website penetration testing. So, you can go with those environments.</div><div style="border: 0px; box-sizing: border-box; color: #474747; font-family: Montserrat, sans-serif; font-size: 14px; font-stretch: inherit; line-height: 25.8999996185303px; margin-bottom: 1em; padding: 0px; vertical-align: baseline;">If you think I forgot to mention an important tool, you can drop a comment and I will try to add it.</div></div>

Top 14 Web Vulneranlity Scanners

In the past, many popular websites have been hacked. Hackers are now active and always try to hack websites and leak data. This is why secur...

+ Read more »