Blazer v-02 released : AMF Testing Made Easy!

Blazer is a custom AMF messages generator with fuzzing capabilities, developed as Burp Suite plugin. It is designed and implemented to make AMF testing easy, and yet allows researchers to control fully the entire security testing process.

Using Blazer, testing AMF-based applications is easier and more robust. As it is highly integrated in a well-known testing suite, web security practitioners can start to use the tool with minimal setup in few seconds.
Blazer implements a new testing approach, introduced at Black Hat USA 2012. This automated gray-box testing technique allows security researchers to improve the coverage and the effectiveness of fuzzing efforts targeting complex applications.

For further details, please refer to the original whitepaper and presentation.
Features

• Automatic Java objects generation from method signatures via Java reflection and “best-fit” heuristics
• Fuzzing capabilities, with customizable data pools and attack vectors
• Ability to start, pause, restore and stop testing
• Easy-to-use internal methods to construct custom AMF messages
• Embedded BeanShell for manual testing
• Highly integrated in Burp Suite
• Support for Java server-side remoting technologies (Adobe BlazeDS, Adobe LiveCycle Data Services, GraniteDS, …)
• Blazer has been developed in Java as a Burp Suite plugin and released under the GNU General Public License. Burp plugins are supported by both versions (free and professional) of the Burp Suite. All major operating systems (Windows, Mac, Linux) with standard Oracle JRE installed are supported by Blazer.

Download In here | Read more right here

SFuzz – Simple Fuzzer V0.7.0 released

Simple Fuzzer is a simple fuzzing framework which allows rapid development of protocol fuzzers for blackbox testing. It can fuzz across networks using TCP/UDP, IP4/IP6, and can be extended via plugins to perform in-depth fuzzing.

Release Notes v0.7.0: Block-based fuzzing has been added, and is still implemented in a simple fashion. A number of memory corruption bugs in the string replacement engine have been resolved. A basic browser-fuzzer is included in this release. The start of a fuzzing oracle to monitor program health is included. While it is not close to the design of the final version, it should be functional to save off crashes

Download :

Windows : sfuzz-0.7.0.zip | Linux : sfuzz-0.7.0.tar.bz2

Read more in here : http://aconole.brad-x.com/programs/sfuzz.html

PHP Vulnerability Hunter v.1.1.4.6

PHP Vulnerability Hunter is an advanced automated whitebox fuzz testing tool.  

PHP Vulnerability Hunter v.1.1.4.6

This is the application that detected almost all of the web application 

vulnerabilities listed on the advisories page. PHP Vulnerability Hunter is an advanced automated whitebox fuzz testing tool capable of triggering a wide range of exploitable faults in PHP web applications. Minimal configuration is necessary to begin a scan; PHP Vulnerability Hunter doesn’t even need a user specified starting URI. 

ChangeLog: 
Added code coverage report
Updated GUI validation
Several instrumentation fixes
Fixed lingering connection issue
Fixed GUI and report viewer crashes related to working directory

Download : http://code.google.com

More :  http://www.autosectools.com

rtspFUZZ 0.1 a The Real Time Streaming Protocol (RTSP)

The Real Time Streaming Protocol (RTSP) is a network control protocol designed for use in entertainment and communications systems to control streaming.The Real Time Streaming Protocol, or RTSP, is an application-level protocol for control over the delivery of data with real-time properties. RTSP provides an extensible framework to enable controlled, on-demand delivery of real-time data, such as audio and video.

Key Features:
1)This fuzzer uses 6 basic crafting technique with OPTIONS,DESCRIBE,SETUP,PLAY,GET_PARAMETER,TEARDOWN,PAUSE etc rtsp commands and 9 advanced crafting technique to test any target application.
2)Ability to fuzz with Metasploit Pattern (pattern_create.rb) can be helpful to find offset.

Download : rtspFUZZ 0.1

Wfuzz v.2.0 released

Web application bruteforcer

Wfuzz is a tool designed for bruteforcing Web Applications, it can be used for finding resources not linked (directories, servlets, scripts, etc), bruteforce GET and POST parameters for checking different kind of injections (SQL, XSS, LDAP,etc), bruteforce Forms parameters (User/Password), Fuzzing,etc.

Highlights in this version:

– Infinite payloads. You can now define as many FUZnZ words as you need .
– Multiple encoders per payload. You can now define as many encoders as you need for each payload independently.
– Payload combination. You can now combine your payloads in different ways by specifying iterators.
– Increased flexibility. You can now define in an easy way new payloads,iterators,encoders and output handlers and they will be part of wfuzz straight away.
– Baseline support. You can now define a default value for each payload and compare the results against them.

Download: http://code.google.com