Full Disclosure mailing list archives
RE: FW: [PTsecurity] MaxPatrol Network Security Scanner - Free unlimited version has been released.
From: "alex" <pigrelax () yandex ru>
Date: Mon, 25 Jul 2005 22:29:45 +0400
Hi! Maxpatrol analyzes responses for some specially crafted http-requests. For example, you have script default.asp?ID=blablabla. Program send many http-requests like default.asp?ID=', default.asp?ID=<script>alert()</script> and more.. (20-50 unique requests) and analyze response from Web-server (more than 2000 signatures). Some little example automatically discovered vulnerabilities you can see here: http://www.maxpatrol.com/mp_advisory.asp May I testing any site you want? :) -----Original Message----- From: Daniel [mailto:deeper () gmail com] Sent: Monday, July 25, 2005 9:57 PM To: alex Cc: full-disclosure () lists grok org uk Subject: Re: [Full-disclosure] FW: [PTsecurity] MaxPatrol Network Security Scanner - Free unlimited version has been released. I'm intrigued.. "Automatically detects web vulnerabilities: - SQL injection - Blind SQL injection - Cross Site Scripting So how do you go about doing this? Is this a case of sending a request to some input mechanism and grep'ing the response back from the server? Now if you did this against an application which returned 200 for every single request, surely it would light up like a christmas tree? On 7/25/05, alex <pigrelax () yandex ru> wrote:
MaxPatrol Network Security Scanner Free unlimited version 7.0.1401 has
been
released. Download URL: http://www.maxpatrol.com/tb_demo.asp --- Maxpatrol Core Features: [+] Web-server and Web Application structure analysis. Maxpatrol analyzes the structure of Web Applications to determine weaknesses and potential vulnerabilities in both the Web Server Configuration and the Web Application. Discovers available web server technologies. Inspects the HTTP version banners and looks for vulnerable products and other... [+] Maxpatrol uses intelligent searching to detect vulnerabilities in non-standard web-server scripts. [+] Intelligent recognition of vulnerabilities in known web-server
scripts.
Automatically detects web vulnerabilities: - SQL injection - Blind SQL injection - Cross Site Scripting - UTF-7 Cross Site Scripting - HTTP Response Splitting - Code execution - File inclusion - Directory traversal - Input validation - Authentication attacks (bruteforce login/password and etc) - Script source code disclosure - Discovers directories with weak permissions (finds directory listings and etc) - Looks for common files, back-up files, logs or directories [+] Full Identification of Service Regardless of Port Configuration. Maxpatrol uses Intelligent Scanning to determine complex server configuration Permits vulnerability testing for servers with complex, non-standard configurations, where port numbers are assigned to services in arbitrary combinations, in other words Maxpatrol does not assume Port 21 is a FTP service or that and FTP service cannot be listening to other ports. [+] Heuristic method for detecting types and names of services,
independent
of responses to standard queries. [+] Hidden-directory search for FTP servers. [+] Bruteforce "login/password" for many services. [+] Detection of vulnerabilities arising from configuration errors
including
cases of unprotected authorization, revealing of information by services, etc. [+] Full identification and testing of RPC services in Windows and *nix. [+] Intelligent precision algorithms to minimize false detection. [+] Inspects the service version banners and looks for vulnerable
products.
For more details: http://www.maxpatrol.com/po_kf.asp http://www.maxpatrol.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- FW: [PTsecurity] MaxPatrol Network Security Scanner - Free unlimited version has been released. alex (Jul 25)
- Re: FW: [PTsecurity] MaxPatrol Network Security Scanner - Free unlimited version has been released. Daniel (Jul 25)
- RE: FW: [PTsecurity] MaxPatrol Network Security Scanner - Free unlimited version has been released. alex (Jul 25)
- Re: FW: [PTsecurity] MaxPatrol Network Security Scanner - Free unlimited version has been released. Daniel (Jul 25)