export_requests

This plugin exports all discovered HTTP requests URL, Method, Params to the given file CSV which can then be imported in another scan by using the crawl.importresults. One configurable parameter exists: outputfile Plugin type Output Options Name | Type | Default Value | Description | Help...

password_profiling

This plugin creates a list of possible passwords by reading responses and counting the most common words. Plugin type Grep Options This plugin doesnt have any user configured options. Source For more information about this plugin and the associated tests, theres always the source code to understa...

wordnet

This plugin finds new URLs using wn. An example is the best way to explain what this plugin does, lets suppose that the input for this plugin is: http://a/index.asp?color=blue The plugin will search the wordnet database for words that are related with "blue", and return for example: "black" and...

dns_wildcard

This plugin compares the contents of www.site.com and site.com and tries to verify if the target site has a DNS wildcard configuration or not. Plugin type Infrastructure Options This plugin doesnt have any user configured options. Source For more information about this plugin and the associated...

rnd_param

This evasion plugin adds a random parameter. Example: Input: /bar/foo.asp Output : /bar/foo.asp?alsfkj=f09 Plugin type Evasion Options This plugin doesnt have any user configured options. Source For more information about this plugin and the associated tests, theres always the source code to...

redos

This plugin finds ReDoS regular expression DoS vulnerabilities as explained here: http://en.wikipedia.org/wiki/ReDoS Plugin type Audit Options This plugin doesnt have any user configured options. Source For more information about this plugin and the associated tests, theres always the source code...

phishtank

This plugin searches the domain being tested in the phishtank database. If your site is in this database the chances are that you were hacked and your server is now being used in phishing attacks. Plugin type Crawl Options This plugin doesnt have any user configured options. Source For more...

sqli

This plugin finds SQL injections. To find this vulnerabilities the plugin sends the string dz"0 to every injection point, and searches for SQL errors in the response body. Plugin type Audit Options This plugin doesnt have any user configured options. Source For more information about this plugin...

bing_spider

This plugin finds new URLs in Bing search engine. One configurable parameters exist: resultlimit This plugin searches Bing for : "site:domain.com", requests all search results and parses them in order to find new URLs. Plugin type Crawl Options Name | Type | Default Value | Description | Help...

ldapi

This plugin will find LDAP injections by sending a specially crafted string to every parameter and analyzing the response for LDAP errors. Plugin type Audit Options This plugin doesnt have any user configured options. Source For more information about this plugin and the associated tests, theres...

ssl_certificate

This plugin audits SSL certificate parameters. One configurable parameter exists: minExpireDays CA PEM file path Note: Its only usefull when testing HTTPS sites. Plugin type Audit Options Name | Type | Default Value | Description | Help ---|---|---|---|--- minExpireDays | integer | 30 | Set minim...

error_pages

This plugin scans every page for error pages, and if possible extracts the web server or programming framework information. Plugin type Grep Options This plugin doesnt have any user configured options. Source For more information about this plugin and the associated tests, theres always the sourc...

credit_cards

This plugins scans every response page to find the strings that are likely to be credit card numbers. It can be tested against the following URL: https://www.paypal.com/enUS/vhelp/paypalmanagerhelp/creditcardnumbers.htm Plugin type Grep Options This plugin doesnt have any user configured options...

digit_sum

This plugin tries to find new URLs by changing the numbers that are present on it. Two configurable parameters exist: fuzzImages maxDigitSections An example will clarify what this plugin does, lets suppose that the input for this plugin is: http://host.tld/index1.asp This plugin will request:...

url_fuzzer

This plugin will try to find new URLs based on the input. If the input is for example: http://a/a.html The plugin will request: http://a/a.html.tgz http://a/a.tgz http://a/a.zip … etc If the response is different from the 404 page whatever it may be, automatic detection is performed, then we have...

oracle_discovery

This plugin retrieves Oracle Application Server URLs and extracts information available on them. Plugin type Crawl Options This plugin doesnt have any user configured options. Source For more information about this plugin and the associated tests, theres always the source code to understand exact...

html_comments

This plugin greps every page for HTML comments, special comments like the ones containing the words "password" or "user" are specially reported. Plugin type Grep Options This plugin doesnt have any user configured options. Source For more information about this plugin and the associated tests,...

email_report

This plugin sends short report only vulnerabilities by email to specified addresses. There are some configurable parameters: smtpServer smtpPort toAddrs fromAddr Plugin type Output Options Name | Type | Default Value | Description | Help ---|---|---|---|--- smtpServer | string | localhost | SMTP...

detect_transparent_proxy

This plugin tries to detect transparent proxies. The procedure for detecting transparent proxies is simple, I try to connect to a series of IP addresses, to the port 80, if all of them return an opened socket, then its the proxy server responding. Plugin type Infrastructure Options This plugin...

fingerprint_os

This plugin fingerprints the remote web server and tries to determine the Operating System family Windows, Unix, etc.. The fingerprinting is at this moment really trivial, because it only uses one technique: windows path separator in the URL. For example, if the input URL is...