Re: Website "Scanner"

Whisker, Metis, nikto (whisker-based) CGI scanners have open libraries that would allow you to add these kinds of checks.

http://www.wiretrip.net/rfp/

If you're interested in a commerical solution, WebInspect does this also.

Kevin Spett
SPI Labs
http://www.spidynamics.com/

• Original Message ----- From: <backed.up.by.2048.bit.encryption@hushmail.com> To: <webappsec@securityfocus.com> Cc: <vuln-dev@securityfocus.com> Sent: Wednesday, January 08, 2003 3:53 PM Subject: Website "Scanner"

>
> -----BEGIN PGP SIGNED MESSAGE-----
dictionary attacks the files. For example you plug in the domain:
>
> http://www.foo.com
(and even) directories). If so, one could certainly hit on some sensitive information, say where the administrator has been testing something, or internal product infos etc.
>
> If there is nothing out there like this, why not?
Received on Wed Jan 8 17:54:46 2003