The Professional Security Testers Warehouse for the GPEN GSEC GCIH GREM CEH QISP Q/ISP OPST CPTS

2nd. OWASP Ibero-American Web-Applications Security conference 2010 (IBWAS’10)
ISCTE – Lisbon University Institute
25th – 26th November 2010
Lisboa, Portugal
http://www.ibwas.com

Call for Papers

Introduction
There is a change in the information systems development paradigm. The emergence of Web 2.0 technologies led to the extensive deployment and use of web-based applications and web services as a way to developed new and flexible information systems. Such systems are easy to develop, deploy and maintain and demonstrate impressive features for users, resulting in their current wide use.
As a result of this paradigm shift, the security requirements have also changed. These web-based information systems have different security requirements, when compared to traditional systems. Important security issues have been found and privacy concerns have also been raised recently. In addition, the emerging Cloud Computing paradigm promises even greater flexibility; however corresponding security and privacy issues still need to be examined. The security environment should involve not only the surrounding environment but also the application core.
This conference aims to bring together application security experts, researchers, educators and practitioners from the industry, academia and international communities such as OWASP, in order to discuss open problems and new solutions in application security. In the context of this track academic researchers will be able to combine interesting results with the experience of practitioners and software engineers.

Conference Topics
Suggested topics for papers submission include (but are not limited to):
• Secure application development
• Security of service oriented architectures
• Security of development frameworks
• Threat modelling of web applications
• Cloud computing security
• Web applications vulnerabilities and analysis (code review, pen-test, static analysis etc.)
• Metrics for application security
• Countermeasures for web application vulnerabilities
• Secure coding techniques
• Platform or language security features that help secure web applications
• Secure database usage in web applications
• Access control in web applications
• Web services security
• Browser security
• Privacy in web applications
• Standards, certifications and security evaluation criteria for web applications
• Application security awareness and education
• Security for the mobile web
• Attacks and Vulnerability Exploitation

Paper Submission Instructions
Authors should submit an original paper in English, carefully checked for correct grammar and spelling, using the on-line submission procedure (http://www.easychair.org/conferences/?conf=ibwas10). Please check the paper formats so you may be aware of the accepted paper page limits (12 pages, in accordance to a supplied template: ftp://ftp.springer.de/pub/tex/latex/llncs/word/LNCS-Office2007.zip).
The guidelines for paper formatting provided at the conference web site must be strictly used for all submitted papers. The submission format is the same as the camera-ready format. Please check and carefully follow the instructions and templates provided.
Each paper should clearly indicate the nature of its technical/scientific contribution, and the problems, domains or environments to which it is applicable.
Papers that are out of the conference scope or contain any form of plagiarism will be rejected without reviews.
Remarks about the on-line submission procedure:
1. A "double-blind" paper evaluation method will be used. To facilitate that, the authors are kindly requested to produce and provide the paper, WITHOUT any reference to any of the authors. This means that is necessary to remove the author’s personal details, the acknowledgements section and any reference that may disclose the authors identity
2. Papers in ODF, PDF, DOC, DOCX or RTF format are accepted
3. The web submission procedure automatically sends an acknowledgement, by e-mail, to the contact author.

Paper submission types

Regular Paper Submission
A regular paper presents a work where the research is completed or almost finished. It does not necessary means that the acceptance is as a full paper. It may be accepted as a "full paper" (30 min. oral presentation), a "short paper" (15 min. oral presentation) or a "poster".
Position Paper Submission
A position paper presents an arguable opinion about an issue. The goal of a position paper is to convince the audience that your opinion is valid and worth listening to, without the need to present completed research work and/or validated results. It is, nevertheless, important to support your argument with evidence to ensure the validity of your claims. A position paper may be a short report and discussion of ideas, facts, situations, methods, procedures or results of scientific research (bibliographic, experimental, theoretical, or other) focused on one of the conference topic areas. The acceptance of a position paper is restricted to the categories of "short paper" or "poster", i.e. a position paper is not a candidate to acceptance as "full paper".

Camera-ready
After the reviewing process is completed, the contact author (the author who submits the paper) of each paper will be notified of the result, by e-mail. The authors are required to follow the reviews in order to improve their paper before the camera-ready submission.

Publications
All accepted papers will be published in the conference proceedings, under an ISBN reference. Conference proceedings will be published by Springer in the Communications in Computer and Information Science (CCIS) series.

Web-site: http://www.ibwas.com

Secretariat: E-mail: secretariat@ibwas.com

Important Dates
Submission of papers and all other contributions due: 8th October 2010
Notification of acceptance: 22nd October 2010
Camera-ready version of accepted contributions: 29th October 2010
Conference: 25th – 26th November 2010

Conference Chairs
Vicente Aguilera Días, Internet Security Auditors, OWASP Spain, Spain
Carlos Serrão, ISCTE-IUL Instituto Universitário de Lisboa, OWASP Portugal, Portugal

Organization Committee
Fabio Cerullo, OWASP Global Education Committee, Ireland
Dinis Cruz, OWASP Board Member, UK
Paulo Coimbra, OWASP Project Manager, UK
Miguel Correia, Universidade de Lisboa, Portugal
Paulo Sousa, Universidade de Lisboa, Portugal
Lucas C. Ferreira, Câmara dos Deputados, Brasil
Arturo Busleiman, OWASP Argentina, Argentina
Martin Tartarelli, OWASP Argentina, Argentina
Paulo Querido, Portugal

Conference Program Committee
André Zúquete, Universidade De Aveiro, Portugal
Candelaria Hernández-Goya, Universidad De La Laguna, Spain
Carlos Costa, Universidade De Aveiro, Portugal
Carlos Ribeiro, Instituto Superior Técnico, Portugal
Eduardo Neves, OWASP Education Committee, OWASP Brazil, Brazil
Francesc Rovirosa i Raduà, Universitat Oberta de Catalunya (UOC), Spain
Gonzalo Álvarez Marañón, Consejo Superior de Investigaciones Científicas (CSIC), Spain
Isaac Agudo, University of Malaga, Spain
Jaime Delgado, Universitat Politecnica De Catalunya, Spain
Javier Hernando, Universitat Politecnica De Catalunya, Spain
Javier Rodríguez Saeta, Herta Security, Spain
Joaquim Castro Ferreira, Universidade de Lisboa, Portugal
Joaquim Marques, Instituto Politécnico de Castelo Branco, Portugal
Jorge Dávila Muro, Universidad Politécnica de Madrid (UPM), Spain
Jorge E. López de Vergara, Universidad Autónoma de Madrid, Spain
José Carlos Metrôlho, Instituto Politécnico de Castelo Branco, Portugal
José Luis Oliveira, Universidade De Aveiro, Portugal
Kuai Hinojosa, OWASP Global Education Committee, New York University, United States
Leonardo Chiariglione, Cedeo, Italy
Leonardo Lemes, Unisinos, Brasil
Manuel Sequeira, ISCTE-IUL Instituto Universitário de Lisboa, Portugal
Marco Vieira, Universidade de Coimbra, Portugal
Mariemma I. Yagüe, University of Málaga, Spain
Miguel Correia, Universidade de Lisboa, Portugal
Miguel Dias, Microsoft, Portugal
Nuno Neves, Universidade de Lisboa, Portugal
Osvaldo Santos, Instituto Politécnico de Castelo Branco, Portugal
Panos Kudumakis, Queen Mary University of London, United Kingdom
Paulo Sousa, Universidade de Lisboa, Portugal
Rodrigo Roman, University of Malaga, Spain
Rui Cruz, Instituto Superior Técnico, Portugal
Rui Marinheiro, ISCTE-IUL Instituto Universitário de Lisboa, Portugal
Sérgio Lopes, Universidade do Minho, Portugal
Tiejun Huang, Pekin University, China
Víctor Villagrá, Universidad Politécnica de Madrid (UPM), Spain
Vitor Filipe, Universidade de Trás-os-Montes e Alto Douro, Portugal
Vitor Santos, Microsoft, Portugal
Vitor Torres, Universitat Pompeu Fabra, Spain
Wagner Elias, OWASP Brazil Chapter Leader, Brazil

WhatWeb

website fingerprinting

Next generation web scanner. Identify what websites are running.

Download whatweb-0.4.5.tar.gz
Latest Version 0.4.5, 17th August 2010
License GPLv2
Author urbanadventurer aka Andrew Horton from Security-Assessment.com

Introduction

Identify content management systems (CMS), blogging platforms, stats/analytics packages, javascript libraries, servers and more. When you visit a website in your browser the transaction includes many unseen hints about how the webserver is set up and what software is delivering the webpage. Some of these hints are obvious, eg. “Powered by XYZ” and others are more subtle. WhatWeb recognises these cues and reports what it finds.

WhatWeb has over 250 plugins and needs community support to develop more. Plugins can identify systems with obvious identifying hints removed by also looking for subtle clues. For example, a WordPress site might remove the tag but the WordPress plugin also looks for “wp-content” which is less easy to disguise. Plugins are flexible and can return any datatype, for example plugins can return version numbers, email addresses, account ID’s and more.

There are both passive and aggressive plugins, passive plugins use information on the page, in cookies and in the URL to identify the system. A passive request is as light weight as a simple GET / HTTP/1.1 request. Aggressive plugins guess URLs and request more files. Plugins are easy to write, you don’t need to know ruby to make them.

Example Usage

Using WhatWeb on a handful of websites. (This is a screenshot of an older version)

whatweb-examples

Help

HELP
WhatWeb - Next generation web scanner.
Version 0.4.5 by Andrew Horton aka urbanadventurer from Security-Assessment.com
Homepage: http://www.morningstarsecurity.com/research/whatweb

Usage: whatweb [options] 

                  Enter URLs or filenames. Use /dev/stdin to pipe HTML
                        directly
--input-file=FILE, -i   Identify URLs found in FILE, eg. -i /dev/stdin
--aggression, -a        1 passive - on-page
                        2 polite - unimplemented
                        3 impolite - guess URLs when plugin matches
                        (smart, guess a few urls)
                        4 aggressive - try guess URLs for every plugin
                        (guess a lot of urls like nikto)
--recursion, -r         Follow links recursively. Only follows links under the
                        path (default: off)
--depth, -d             Maximum recursion depth (default: 10)
--max-links, -m         Maximum number of links to follow on one page
                        (default: 250)
--spider-skip-extensions Redefine extensions to skip.
                        (default: zip,gz,tar,jpg,exe,png,pdf)
--list-plugins, -l      List the plugins
--run-plugins, -p       Run comma delimited list of plugins. Default is all
--info-plugins, -I      Display information plugins. Optionally specific a comma
                        delimited list.
--example-urls, -e      Add example urls for each plugin to the target list
--colour=[WHEN],
--color=[WHEN]          control whether colour is used. WHEN may be `never',
                        `always', or `auto'
--log-full=FILE         Log verbose output
--log-brief=FILE        Log brief, one-line output
--log-xml=FILE          Log XML format
--user-agent, -U        Identify as user-agent instead of WhatWeb/0.4.5.
--max-threads, -t       Number of simultaneous threads. Default is 25.
--no-redirect           Do not follow HTTP 3xx redirects.
--proxy                  Set proxy hostname and port
                        (default: 8080)
--proxy-user             Set proxy user and password
--open-timeout          Time in seconds
--read-timeout          Time in seconds
--custom-plugin         Define a custom plugin call Custom,
                        Examples: ":text=>'powered by abc'"
                        ":regexp=>/powered[ ]?by ab[0-9]/"
                        ":ghdb=>'intitle:abc "powered by abc"'"
                        ":md5=>'8666257030b94d3bdb46e05945f60b42'"
                        "{:text=>'powered by abc'},{:regexp=>/abc [ ]?1/i}"
--url-prefix            Add a prefix to target URLs
--url-suffix            Add a suffix to target URLs
--url-pattern           Insert the targets into a URL. Requires --input-file,
                        eg. www.example.com/%insert%/robots.txt
--help, -h              This help
--verbose, -v           Increase verbosity, use twice for debugging.
--version               Display version information.

Verbose Output

./whatweb -v www.morningstarsecurity.com
www.morningstarsecurity.com/ [200]
http://www.morningstarsecurity.com [200] WordPress[3.0.1], Google-API[ajax/libs/jquery/1.3.2/jquery.min.js ],
Google-Analytics[GA][791888], HTTPServer[Apache], UncommonHeaders[x-pingback], JQuery[1.4.2], Title[MorningSt
ar Security], MetaGenerator[WordPress 3.0.1], RSSFeed[http://www.morningstarsecurity.com/wp-content/themes/py
rmont-v2-white/style.css], MD5[2b47722f6e9ad3add669f5a4d2267642], Tag-Hash[bce4fdbac307d13d570d3a0d2d45b078],
Header-Hash[dba021c0aa225c8eede02c7dcc45b0d8], Footer-Hash[bd8866bbab7e53b19e03131a041d451a]
Footer-Hash                    => hash
Google-API                     => google javascript API (version: ajax/libs/jquery/1.3.2/jquery.min.js )
Google-Analytics               => pageTracker = ...UA-123-1231
HTTPServer                     => server string
Header-Hash                    => hash
JQuery                         => script (version: 1.4.2)
MD5                            => md5 hash of html
MetaGenerator                  => meta generator tag
RSSFeed                        => rss link type, rss link
Tag-Hash                       => tag pattern hash
Title                          => page title
UncommonHeaders                => headers
WordPress                      => wp-content (certainty: 75), meta generator tag (version: 3.0.1)

Log Output

There are currently 3 types of log output. They are:
–log-brief Brief logging. Default output
–log-full Full logging. Complete output from each plugin
–log-xml XML logging. Same information as default output but in XML format

You can output to multiple logs simulatenously by specifying muliple command line logging options.

Brief Logging

Example usage: whatweb –log-brief b.log digg.com

http://digg.com [200] Cookies[1337,PHPSESSID,ccc], X-Powered-By[PHP/5.2.9-digg8], HTTPServer[Apache], UncommonHe
aders[keep-alive], Title[Digg - The Latest News Headlines, Videos and Images], RSSFeed[/opensearch.xml], OpenSea
rch[/opensearch.xml], Tag-Hash[4b33049ce0f31283b90597352194c9be], MD5[2b624548bc61501dcdca9639f2f9f338], Header-
Hash[2df7eaaa4480f28013aaf48ae9266b84], Footer-Hash[6e2c99013c0f12a0b9493ad54d2db2da]

Full Logging (may be removed in future)

Example usage: whatweb –log-full f.log digg.com

Identifying: http://digg.com
HTTP-Status: 200
[["Cookies",
[{:probability=>100,
:name=>"cookie names",
:string=>["1337", "PHPSESSID", "ccc"]}]],
["Div-Span-Structure",
[{:probability=>100,
:name=>"div structure",
:string=>"828d809947c3c760d41c720c9203993b"}]],
["Footer-Hash",
[{:probability=>100,
:name=>"hash",
:string=>"ca2ffbc939969a2246cde196f0fc4841"}]],
["HTTPServer",
[{:probability=>100, :name=>"server string", :string=>"Apache"}]],
["Header-Hash",
[{:probability=>100,
:name=>"hash",
:string=>"2df7eaaa4480f28013aaf48ae9266b84"}]],
["MD5",
[{:probability=>100,
:name=>"page title",
:string=>"455e6da4264cc6334b78a72c083ced77"}]],
["Mailto",
[{:emails=>
["?subject=Digg Story: Jennifer Aniston,wins the battle of the bikini with Model 23&body=I wanted to share this story with you: http://digg.com/d31RvOK?ern --- rn"Jennifer Aniston,wins the battle of the bikini with Model 23"rnActresses peeled off to reveal a two-piece as they filmed romantic comedy Just Go With It in Hawaii.rn+156 people dugg this story."]
:probability=>100,
:name=>"mailto:"}]],
["Title",
[{:probability=>100,
:name=>"page title",
:string=>"Digg - The Latest News Headlines, Videos and Images"}]],
["UncommonHeaders",
[{:probability=>100, :name=>"headers", :string=>"keep-alive"}]],
["X-Powered-By",
[{:probability=>100,
:name=>"x-powered-by string",
:string=>"PHP/5.2.9-digg8"}]]]
XML Logging

The XML logging is currently naive and may change. Please contact me if you have suggestions.

Example usage: ./whatweb –log-full f.log –log-xml x.log digg.com

<target>
<uri>http://digg.com</uri>
<http-status>200</http-status>
<plugin>
<name>Cookies</name>
<string>1337</string>
<string>PHPSESSID</string>
<string>ccc</string>
</plugin>
<plugin>
<name>Div-Span-Structure</name>
<string>828d809947c3c760d41c720c9203993b</string>
</plugin>
<plugin>
<name>Footer-Hash</name>
<string>ca2ffbc939969a2246cde196f0fc4841</string>
</plugin>
<plugin>
<name>HTTPServer</name>
<string>Apache</string>
</plugin>
<plugin>
<name>Header-Hash</name>
<string>2df7eaaa4480f28013aaf48ae9266b84</string>
</plugin>
<plugin>
<name>MD5</name>
<string>455e6da4264cc6334b78a72c083ced77</string>
</plugin>
<plugin>
<name>Mailto</name>
</plugin>
<plugin>
<name>Title</name>
<string>Digg - The Latest News Headlines, Videos and Images</string>
</plugin>
<plugin>
<name>UncommonHeaders</name>
<string>keep-alive</string>
</plugin>
<plugin>
<name>X-Powered-By</name>
<string>PHP/5.2.9-digg8</string>
</plugin>
</target>
Plugins

Plugins are easy to make.

Matches are made with:
* Text strings (case sensitive)
* Regular expressions
* Google Hack Database queries (limited set of keywords)
* MD5 hashes
* URL recognition
* HTML tag patterns
* Custom ruby code for passive and aggressive operations

List Plugins ./whatweb -l
Plugins Loaded
------------------------------
360-Web-Manager,0.1
ANECMS,0.1
ASP-Nuke,0.2
AVTech-Video-Web-Server,0.1
AWStats,0.1
Aardvark-Topsites-PHP,0.1
Acclipse,0.2
AdobeFlash,0.1
Advanced-Guestbook,0.2
Alcatel-Lucent-Omniswitch,0.1
Allinta-CMS,0.1
Antiboard,0.1
Apache-Default,0.3
ArGoSoft-Mail-Server,0.1
Arab-Portal,0.1
AtomFeed,0.1
Axis-Network-Camera,0.1
BM-Classifieds,0.1
BXR,0.1
Barracuda-Spam-Firewall,0.1
Basilic,0.1
BeEF,0.1
Belkin-Modem,0.2
Bing-SearchEngine,0.1
Biromsoft-WebCam,0.1
BlogSmithMedia,0.2
Blogger,0.1
BlognPlus,0.1
BlueNet-Video-Server,0.1
Brother-Printer,0.1
Burning-Board-Lite,0.1
BusinessSpace,0.1
CGI Backdoor,0.1
CGIProxy,0.1
CMSQLite,0.1
CMScontrol,0.1
CMSimple,0.1
CPanel,0.2
Campsite,0.1
Canon-Network-Camera,0.1
Cisco-VPN-3000-Concentrator,0.1
Citrix-Metaframe,0.2
CodeIgniterProfiler,0.1
ColdFusion,0.1
Comersus,0.2
CommonSpot,0.1
Concrete5,0.2
Confluence,0.1
Cookies,0.1
Coppermine,0.2
CruxCMS,0.1
CruxPA,0.1
CushyCMS,0.2
D-Link-Network-Camera,0.1
DMXReady,0.1
DT-Centrepiece,0.1
DUclassified,0.1
DUforum,0.1
DUgallery,0.1
Dell-Printer,0.1
DiBos,0.2
DotCMS,0.2
DotNetNuke,0.3
Drupal,0.2
DublinCore,0.1
EMO-Realty-Manager,0.1
EarlyImpact-ProductCart,0.2
EazyCMS,0.1
Echo,0.2
Empire-CMS,0.1
Evo-Cam,0.1
ExpressionEngine,0.2
F3Site,0.1
FestOS,0.1
File-Upload-Manager,0.1
Flax-Article-Manager,0.1
FluentNET,0.1
FluxBB,0.3
FontFace,0.1
Footer-Hash,0.2
Forest-Blog,0.1
FormMail,0.2
FrogCMS,0.3
GoAhead-Webs,0.2
Google-API,0.1
Google-Analytics,0.2
Google-Hack-Honeypot,0.1
GuppY,0.1
HP-LaserJet-Printer,0.1
HTML5,0.2
HTTPServer,0.2
Header-Hash,0.1
IIS-SiteNotFound,0.2
IIS-UnderConstruction,0.2
IMGallery,0.1
IPCop-Firewall,0.1
IQeye-Netcam,0.1
ISPConfig,0.2
Index-Of,0.2
Intellinet-IP-Camera,0.1
Interspire-Shopping-Cart,0.1
InvisionPowerBoard,0.2
JAMM-CMS,0.1
JGS-Portal,0.1
JQuery,0.2
Jamroom,0.1
Jboss,0.1
Joomla,0.4
Kloxo Single Server,0.1
Liferay,0.1
Lightbox,0.2
Lime-Survey,0.1
Linksys-NAS,0.1
Linksys-Network-Camera,0.1
Linksys-USB-HDD,0.1
Linksys-Wireless-G-Camera,0.1
LocazoList-Classifieds,0.1
Loggix,0.1
Lucky-Tech-iGuard,0.1
MD5,0.2
MailSiteExpress,0.2
Mailman,0.1
Mailto,0.2
Mambo,0.2
MediaWiki,0.1
MetaGenerator,0.2
MetaPoweredBy,0.2
Microsoft-Sharepoint,0.1
MicrosoftODBCError,0.1
MikroTik,0.2
Minify,0.1
MnoGoSearch,0.2
Mobotix-Network-Camera,0.1
ModxCMS,0.2
Moodle,0.2
MovableType,0.2
My-PHP-Indexer,0.1
My-WebCamXP-Server,0.1
MyioSoft-Ajax-Portal,0.1
MysqlSyntaxError,0.1
NetBotz-Network-Monitoring-Device,0.1
Netious-CMS,0.1
Netsnap-Web-Camera,0.1
NovellGroupwise,0.2
Nukedit,0.1
ORCA-Platform,0.1
ORITE-301-Camera,0.1
OSCommerce,0.3
Oce,0.2
OkiPBX,0.2
Open-Blog,0.1
Open-Freeway,0.1
Open-Source-Ticket-Request-System,0.1
OpenCms,0.1
OpenGraphProtocol,0.1
OpenID,0.1
OpenSearch,0.1
PG-Roomate-Finder-Solution,0.1
PHP-Fusion,0.1
PHP-Layers,0.1
PHP-Link-Directory,0.1
PHP-Shell,0.1
PHPCake,0.2
PHPDirector,0.1
PHPEasyData,0.1
PHPError,0.2
PHPFM,0.1
PHPNuke,0.2
PHPraid,0.1
PageUp-People,0.1
Panasonic-Network-Camera,0.1
Parked-Domain,0.1
PasswordField,0.1
PhilBoard,0.1
Piwik,0.1
Pixel-Ads-Script,0.1
Pixie,0.1
Plesk,0.2
Pligg-CMS,0.1
Plone,0.2
PortalApp,0.1
PoweredBy,0.2
Pressflow,0.1
Prototype,0.2
QNAP-NAS,0.1
Quantcast,0.1
RSSFeed,0.1
RedirectLocation,0.2
RoundCube,0.2
RunCMS,0.1
SHOUTcast-Administrator,0.1
SMF,0.2
Saurus-CMS,0.1
Scriptaculous,0.2
SearchFitShoppingCart,0.2
SiemensSpeedStreamRouter,0.2
SilverStripe,0.2
SimpNews,0.1
Site-Sift,0.1
SkaLinks,0.1
SmodCMS,0.1
Snap-Appliance-Server,0.1
SnomPhone,0.2
Softbiz-Freelancers-Script,0.1
Softbiz-Online-Auctions-Script,0.1
Softbiz-Online-Classifieds,0.1
Sony-Network-Camera,0.1
Sony-Video-Network-Station,0.1
SquirrelMail,0.2
Star-Network,0.1
StarDot-NetCam,0.1
Stardot-Express,0.1
Subdreamer-CMS,0.1
Subrion-CMS,0.1
SyndeoCMS,0.1
TWiki,0.1
Tag-Hash,0.2
TaskFreak,0.1
Team-Board,0.1
Textpattern,0.1
The-PHP-Real-Estate-Script,0.1
Title,0.2
TomatoCMS,0.1
Tomcat,0.2
Toshiba-Network-Camera,0.1
ToshibaPrinter,0.2
Trac,0.1
Turbo-Seek,0.1
TypePad,0.2
TypoLight,0.2
Umbraco,0.1
UncommonHeaders,0.2
VBulletin,0.2
VP-ASP,0.2
VSNSLemon,0.2
Veo-Observer,0.1
VideoShareEnterprise,0.1
Virtualmin,0.1
VisionGS-Webcam,0.1
Vulnerable-To-XSS,0.1
WWWBoard,0.1
Web-Calendar-System,0.1
Web-Data-Administrator,0.1
WebDVR,0.1
WebEye-Network-Camera,0.1
WebGuard,0.2
WebPress,0.1
WhiteBoard,0.1
Winamp-Web-Interface,0.1
Windows-Internet-Printing,0.1
WindowsSBS,0.2
WoW-Raid-Manager,0.1
WordPress,0.2
WordPressSpamFree,0.2
WordPressSuperCache,0.3
X-ASPNetVersion,0.2
X-Powered-By,0.2
X7-Chat,0.1
XHP-CMS,0.1
Xerox-Printers,0.1
XtraBusinessHosting,0.2
Zen-Cart,0.1
Zeus-Cart,0.1
Zikula,0.1
Zoph,0.1
Zyxel-Vantage-Service-Gateway,0.1
anyInventory,0.1
boastMachine,0.1
coWiki,0.1
cpCommerce,0.1
eLitius,0.1
eSyndiCat,0.1
envezion~media,0.1
ezBOO-WebStats,0.1
i-Catcher-Console,0.1
iDVR,0.1
iRealty,0.1
iScripts-CyberMatch,0.1
iScripts-EasySnaps,0.1
iScripts-MultiCart,0.1
iScripts-ReserveLogic,0.1
iScripts-SocialWare,0.1
ispCP-Omega,0.2
jobberBase,0.1
mojoPortal,0.1
phPhotoAlbum,0.1
php-ping,0.1
phpBB,0.2
phpFreeChat,0.1
phpMyAdmin,0.1
phpPgAdmin,0.1
phpSysInfo,0.1
phpinfo,0.1
sabros.us,0.1
samPHPweb,0.1
syntaxCMS,0.1
uPortal,0.1
xGB,0.1
To view more detail about a plugin or plugins ./whatweb -I Joomla
Plugin Information
------------------------------
Joomla version 0.4 by Andrew Horton
[14] examples, [3] matches, [x] aggressive, [x] passive.
Description: Opensource CMS written in PHP. Homepage: http://joomla.org. Plugin can aggresively identify
version by comparing md5 hashes of 4 files. Valid up to version 1.5.15.
--------------------------------------------------------------------------------
Aggressive Plugins

There are currently aggressive plugins for Joomla, phpBB, FluxBB, OSCommerce and Tomcat.
With the passive plugin we know that ardentcreative.co.nz is running Joomla version 1.5

Be cafeful when using aggressive plugins with recursive site crawling. WhatWeb has no understanding of a website, instead it currently treats each URL separately. It also has no caching so if you use aggressive plugins with recursion you will fetch the same files multiple times.

Writing Plugins

View the tutorial on writing WhatWeb plugins at www.morningstarsecurity.com/downloads/How-to-develop-WhatWeb-plugins-1.1.txt.

A typical plugin looks like this:

There are 3 levels to a plugin. Simple matches, passive and agressive tests. You don’t need to know ruby to write plugins with simple matches. Passive and aggressive tests are written in ruby.

If you port a GHDB match, use :ghdb. I usually rewrite the GHDB matches with regular expressions, especially if they require inurl:

Example:

# http://johnny.ihackstuff.com/ghdb?function=detail&id=1840
 {:name=>”GHDB: ”Powered by Vsns Lemon” intitle:”Vsns Lemon”",
 :probability=>100,
 :ghdb=>’”Powered by Vsns Lemon” intitle:”Vsns Lemon”‘}

Note the GHDB queries are case insensitive, as a Google query is. Support codes are intitle:, inurl: and filetype:.

Each plugin can access @body, @meta, @status and @base_uri variables.

Passive tests add matches to the m array, each match is a hash containing the name of the match, probability and more.
The entire hash is returned with Full output, Brief output returns just the match, :version and :string

To discover the regular expressions to match against, wget about 20-30 examples into the tests/ folder. Be aware that some software can have dramatic variations between versions.
First view the META data and HTML of a few examples.
The find-common-stuff tool can help discover unexpected similarities in the examples.

Recursive Spider

The recursion option is used to scan some or all of a website with whatweb. Recursive spidering will follow each link on a webpage if it is within the same website, then repeat the process on the followed pages.

The configurable settings for recursive spidering are:
–recursion, -r Follow links recursively. Only follows links under the path (default: off)
–depth, -d Maximum recursion depth (default: 3)
–max-links, -m Maximum number of links to follow on one page (default: 25)

Limitations of the spidering. This follows links in <a> tags, these are the HTML tags designed specifically for links. The spider does not obtain urls from other sources. Some good choices for future improvement are image tags, eg. <img src=”/images/boats.jpg”>, form tags, eg. <form action=”/vote.php”>, url paths in CSS files, etc.

Related Projects

WhatWeb is unique however there are some web projects with the same goal of identifying a website.

Blind Elephant
The BlindElephant Web Application Fingerprinter attempts to discover the version of a (known) web application by comparing static files at known locations against precomputed hashes for versions of those files in all all available releases. The technique is fast, low-bandwidth, non-invasive, generic, and highly automatable.
http://blindelephant.sourceforge.net/

WAFP – Web Application Finger Printing
Wafp identifies systems by requesting a large quantity of URLs and comparing md5 sums of the results against a database. This method is reliable for known systems in the database and it is simple to add new ones. Unlike whatweb, this method is intrusive and will create a lot of webserver log entries.
http://www.mytty.org/wafp

Wappalyzer
This is the most similar project to WhatWeb.
Firefox plugin identifies sites using 1 regexp each. Only looks for obvious identifiers like meta generator tags. Sends all recognized urls to a DB. Has nice icons
https://addons.mozilla.org/en-US/firefox/addon/10229

w3af
http://w3af.sourceforge.net
Very slight overlap of features in the grep and discovery scripts section.

HTTPRecon
No feature overlap, fingerprints the HTTP Server
http://w3dt.net/tools/httprecon/

http://www.net-square.com/httprint/httprint_paper.html

http://www.darknet.org.uk/2007/09/httprint-v301-web-server-fingerprinting-tool-download/

Nmap version scan
Nmap shows some info about HTTP servers when using version scan, eg. nmap -sV -p80 treshna.com

THC’s Amap
This tool is an application fingerprint scanner which can identify an HTTP protocol server. It doesn’t identify types of HTTP servers.

What’s that web server running 1.0 (whatweb.exe)
This shares the same name and goal but is shit. It ONLY uses the HTTP Server string. For example ‘Apache/2.0.55 (Ubuntu) PHP/5.1.2′
http://www.spambutcher.com/whatweb.html

www.http-stats.com
Lots of info about HTTP server names

Funny & Unusual

Slashdot.org
X-Fry: You mean Bender is the evil Bender? I’m shocked! Shocked! Well not that shocked.

popurls.com
X-popurls-a: in the future every url will be popular for 1.5 seconds

reddit.com
HTTPServer:’; DROP TABLE servertypes; –

Notes

Version 0.3 Released at Kiwicon III (kiwicon.org), 2009.
Version 0.4, March 14th 2010
Version 0.4.1, April 28th 2010
Version 0.4.2, April 30th 2010
Version 0.4.3, May 24th 2010
Version 0.4.4, June 29th 2010

Credits

Written by urbanadventurer aka Andrew Horton from Security-Assessment.com
Homepage: http://www.morningstarsecurity.com
License: GPLv2

Anemone library (used for spidering) is written by Chris Kite
Homepage: http://anemone.rubyforge.org/
License: MIT

Community Plugins

Thank you to the following people who have contributed a plugin to WhatWeb.

Brendan Coles
Emilio Casbas
Louis Nyffenegger
Patrik Wallström

Thank you to Michal Ambroz for writing the Makefile and Man pages

Video Library

CyberSecurity NBISE

Forums Posts

Methodologies

Recommended PodCasts

Recommended Sites

Security Blogs

Security Forums

Best Downloads

Best Web Links

Survey

Who's Online

I am in need of good question writersPosted by cdupuis on Friday, 03 September 2010 @ 22:34:02 EDT (53 reads)Topic Quiz

(Read More... | Score: 0)

2nd. OWASP Ibero-American Web-Applications Security conference 2010 (IBWAS 10)Posted by cdupuis on Friday, 03 September 2010 @ 14:32:58 EDT (71 reads)Topic Training

(Read More... | Score: 0)

New NBISE Cyber Security Certifications will set HIGH BAR for Security ProsPosted by cdupuis on Thursday, 02 September 2010 @ 10:20:22 EDT (125 reads)Topic NBISE

(Read More... | Score: 0)

Insecure Magazine issue 27 has been releasedPosted by cdupuis on Wednesday, 01 September 2010 @ 20:25:19 EDT (101 reads)Topic Insecure Magazine

(Read More... | Score: 0)

nullcon GOA Dwitiya (2.0) The Jugaad (hacking) ConferencePosted by cdupuis on Wednesday, 01 September 2010 @ 09:57:29 EDT (118 reads)Topic Training

(comments? | Score: 0)

September issue of Hakin9 magazine: Mobile Malware – the new cyber threatPosted by cdupuis on Tuesday, 31 August 2010 @ 09:18:46 EDT (351 reads)Topic Hakin9

(Read More... | Score: 0)

New website announcement - www.itsecdb.comPosted by cdupuis on Sunday, 29 August 2010 @ 22:02:45 EDT (166 reads)Topic Vulnerabilities Database

(Read More... | Score: 0)

FREE Cisco CCNP TSHOOT WebcastPosted by cdupuis on Sunday, 29 August 2010 @ 09:29:36 EDT (145 reads)Topic CISCO

(Read More... | Score: 0)

A new advanced security certification from CompTIA -- Fill the surveyPosted by cdupuis on Friday, 27 August 2010 @ 22:09:15 EDT (234 reads)Topic Security+

(Read More... | Score: 0)

Air Force Lt. Gen. says: The enemy is banging away at our applicationsPosted by cdupuis on Monday, 23 August 2010 @ 08:14:05 EDT (207 reads)Topic Web Applications Security

(comments? | Score: 0)

HP To Acquire Code Security Software Maker FortifyPosted by cdupuis on Monday, 23 August 2010 @ 07:43:18 EDT (170 reads)Topic Web Applications Security

(Read More... | Score: 0)

WhatWeb -- The next generation web scannerPosted by cdupuis on Sunday, 22 August 2010 @ 18:33:03 EDT (228 reads)Topic Web Applications Security

(Read More... | Score: 0)

BinPack: Las Vegas Edition ReleasePosted by cdupuis on Friday, 20 August 2010 @ 17:37:53 EDT (293 reads)Topic Web Applications Security

(Read More... | Score: 0)

Better Security Through Sacrificing MaidensPosted by cdupuis on Friday, 20 August 2010 @ 04:39:46 EDT (252 reads)Topic Web Applications Security

(Read More... | Score: 0)

Hakin9 August Issue: Securing the cloudPosted by cdupuis on Tuesday, 03 August 2010 @ 16:46:19 EDT (472 reads)Topic Hakin9

(Read More... | Score: 0)

Our Sponsors

Login

Latest Windows Tools

Latest Linux Tools

Virtual Machines VM's

Hacker's Magazine

Web & Apps Security

Scanning Service

Reverse Engineering

Vulnerabilities Research

Big Story of Today

Old Articles

I am in need of good question writers
Posted by cdupuis on Friday, 03 September 2010 @ 22:34:02 EDT (53 reads)
Topic Quiz

2nd. OWASP Ibero-American Web-Applications Security conference 2010 (IBWAS 10)
Posted by cdupuis on Friday, 03 September 2010 @ 14:32:58 EDT (71 reads)
Topic Training

New NBISE Cyber Security Certifications will set HIGH BAR for Security Pros
Posted by cdupuis on Thursday, 02 September 2010 @ 10:20:22 EDT (125 reads)
Topic NBISE

Insecure Magazine issue 27 has been released
Posted by cdupuis on Wednesday, 01 September 2010 @ 20:25:19 EDT (101 reads)
Topic Insecure Magazine

nullcon GOA Dwitiya (2.0) The Jugaad (hacking) Conference
Posted by cdupuis on Wednesday, 01 September 2010 @ 09:57:29 EDT (118 reads)
Topic Training

September issue of Hakin9 magazine: Mobile Malware – the new cyber threat
Posted by cdupuis on Tuesday, 31 August 2010 @ 09:18:46 EDT (351 reads)
Topic Hakin9

New website announcement - www.itsecdb.com
Posted by cdupuis on Sunday, 29 August 2010 @ 22:02:45 EDT (166 reads)
Topic Vulnerabilities Database

FREE Cisco CCNP TSHOOT Webcast
Posted by cdupuis on Sunday, 29 August 2010 @ 09:29:36 EDT (145 reads)
Topic CISCO

A new advanced security certification from CompTIA -- Fill the survey
Posted by cdupuis on Friday, 27 August 2010 @ 22:09:15 EDT (234 reads)
Topic Security+

Air Force Lt. Gen. says: The enemy is banging away at our applications
Posted by cdupuis on Monday, 23 August 2010 @ 08:14:05 EDT (207 reads)
Topic Web Applications Security

HP To Acquire Code Security Software Maker Fortify
Posted by cdupuis on Monday, 23 August 2010 @ 07:43:18 EDT (170 reads)
Topic Web Applications Security

WhatWeb -- The next generation web scanner
Posted by cdupuis on Sunday, 22 August 2010 @ 18:33:03 EDT (228 reads)
Topic Web Applications Security

BinPack: Las Vegas Edition Release
Posted by cdupuis on Friday, 20 August 2010 @ 17:37:53 EDT (293 reads)
Topic Web Applications Security

Better Security Through Sacrificing Maidens
Posted by cdupuis on Friday, 20 August 2010 @ 04:39:46 EDT (252 reads)
Topic Web Applications Security

Hakin9 August Issue: Securing the cloud
Posted by cdupuis on Tuesday, 03 August 2010 @ 16:46:19 EDT (472 reads)
Topic Hakin9