Hi, all! What do you think about making some kind of port of host-extract tool described below in w3af? It can be a grep plugin. We already have privateIP grep plugin but it is useful in some cases to extract also hosts/IPs which are different than target (not only private IPs).
-------- Forwarded Message -------- From: YGN Ethical Hacker Group <li...@yehg.net> To: full-disclosure <full-disclos...@lists.grok.org.uk>, websecur...@webappsec.org Subject: [WEB SECURITY] [new tool announcement] host-extract Date: Mon, 14 Mar 2011 00:46:18 +0800 Host-Extract | Host/IP Pattern Extractor =============================== category: /pentest/enumeration/www useful area: blackbox testing This little ruby script tries to extract all IP/Host patterns in page response of a given URL and JavaScript/CSS files of that URL. With it, you can quickly identify internal IPs/Hostnames, development IPs/ports, cdn, load balancers, additional attack entries related to your target that are revealed in inline js, css, html comment areas and js/css files. This is unlike web crawler which looks for new links only in anchor tags (<a) or the like. In some cases, host-extract may give you false positives when there are some words like - main-site_ver_10.2.1.3.swf. With -v option, you can ask the tool to output html view-source snippets for each IP/Domain extracted. This will shorten your manual analysis time. Please go to http://host-extract.googlecode.com/ for more info. Download/Update ============== svn co http://host-extract.googlecode.com/svn/trunk/ host-extract Tutorial Wiki ========== Sebastien Damaye from aldeid.com has prepared a thorough host-extract tutorial with real-world famous web sites. http://aldeid.com/index.php/Host-extract -- Taras http://oxdef.info ---- "Software is like sex: it's better when it's free." - Linus Torvalds ------------------------------------------------------------------------------ Colocation vs. Managed Hosting A question and answer guide to determining the best fit for your organization - today and in the future. http://p.sf.net/sfu/internap-sfd2d _______________________________________________ W3af-develop mailing list W3af-develop@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/w3af-develop
