WebSurgery - Web Application Security Testing Suite

WebSurgery is a suite of tools that are designed for web application security testing.

It contains several web tools such as Crawler, Bruteforcer, Fuzzer, Proxy, and Editor, and also some extra functionality tools such as Scripting Filters, List Generator, and External Proxy.

There are 3 versions of WebSurgery: Non-commercial (Free) Edition, Enterprise Edition, and Consultant Edition.

The Free Edition doesn't require any license fee, but it cannot be used to scan sites of customers or third parties.

The Enterprise Edition is extended to organizations owning and operating more than one website. Ideal for small and larger organizations, this allows you to scan an unlimited number of websites. But it cannot be used to scan sites of customers or third parties.

The Consultant Edition is extended to organizations scanning any number of websites owned by their customers to provide them with penetration testing and vulnerability assessment services. Ideal for Security Consultants, Web Development Agencies, and ISPs.

Note: Multiple installations require multiple licenses.

Web Tools:

Crawler: It is designed to be fast, accurate, stable and completely parameterized using advanced techniques to extract links from HTML, CSS, Javascript and AJAX.

High Performance Multi-Threading and Completely Parameterized Crawler
Extracts Links from HTML / CSS / JavaScript / AJAX / XHR
Hidden Structure Identification with Embedded Bruteforcer
Parameterized Timing Settings (Timeout, Threading, Max Data Size, Retries)
Parameterized Limit Rules (Case Sensitive, Process Above / Below, Dir Depth, Max Same File / Script Parameters / Form Action File)
Parameterized Extra Rules (Fetch Indexes/Sitemaps, Submit Forms, Custom Headers)
Supports Advanced Filters with Scripting & Regular Expressions (Process, Exclude, Page Not Found, Search Filters)

Bruteforcer: For files and directories within the web application which helps to identify the hidden structure.

High Performance Multi-Threading Bruteforcer for Hidden Structure (Files / Directories)
Parameterized Timing Settings (Timeout, Threading, Max Data Size, Retries)
Parameterized Rules (Base Dir, Bruteforce Dirs / Files, Recursive, File Extension, Custom Headers)
Parameterized Advanced Rules (Send GET / HEAD, Follow Redirects, Process Cookies)
Supports Advanced Filters with Scripting & Regular Expressions (Page Not Found, Search Filters)
Supports List Generator with Advanced Rules

Fuzzer: It is a highly advanced tool to create a number of requests based on one initial request. Fuzzer has no limits and can be used to exploit (Blind) SQL Injections, Cross Site Scripting (XSS), Denial of Service (DOS), Bruteforce for Username / Password Authentication Login Forms and identification of Improper Input Handling and Firewall / Filtering Rules.

High Performance Multi-Threading Fuzzer Generates Requests based on Initial Request Template
Exploitation for (Blind) SQL Injections, Cross Site Scripting (XSS), Denial of Service (DOS), Bruteforce for Username / Password Authentication Login Forms
Identification of Improper Input Handling and Firewall / Filtering Rules
Parameterized Timing Settings (Timeout, Threading, Max Data Size, Retries)
Parameterized Advanced Rules (Follow Redirects, Process Cookies)
Supports Advanced Filters with Scripting & Regular Expressions (Stop / Reset Level, Search Filters)
Supports List Generator with Advanced Rules
Supports Multiple Lists with Different Levels

Proxy: It is a server running locally and will allow you to analyze, intercept and manipulate HTTP/HTTPS requests coming from your browser or other application which support proxies.

Proxy Server to Analyze, Intercept and Manipulate Traffic
Parameterized Listening Interface IP Address & Port Number
Supports Advanced Filters with Scripting & Regular Expressions (Process, Intercept, Match-Replace, Search Filters)

Editor: A simple Editor to send individual requests. It also contains a HEX Editor for more advanced requests.

Advanced ASCII/HEX Editor to Manipulate Individual Requets
Parameterized Timing Settings (Timeout, Max Data Size, Retries)
Automatically Fix Request (Content-Length, New Lines at End)

Extra Tools:

Scripting Filters: Filters can be used to filtered the Crawler's, Bruteforcer's, Fuzzer's search results. You can also use filters to specify a custom 'Page not found', 'Process', 'Exlude' filter for Crawler and Bruteforcer.

Advanced Scripting Filters to Filter Specific Requests / Responses
Main Variables (url, proto, hostport, host, port, pathquery, path, query, file, ext)
Request Variables (size, hsize, dsize, data, hdata, ddata, method, hasparams, isform)
Response Variables (size, hsize, dsize, data, hdata, ddata, status, hasform)
Operators =, !=, ~, !~, >=, <=, >, <
Conjunctions &, |
Supports Reverse Filters and Parenthesis

List Generator: List Generator produces a list(s) for Bruteforcer and Fuzzer.

List Generator for Different List Types (File, Charset, Numbers, Dates, IP Addresses, Custom)
Parameterized Rules (Prefix, Suffix, Case, Reverse, Fixed-Length, Match-Replace)
Parameterized Crypto / Hash Rules (URL, URL All, HTML, BASE-64, ASCII, HEX, MD5, SHA-512)

External Proxy: You can configure WebSurgery to send all the traffic generated through a proxy. Currently, supports HTTP proxies without authentication or with basic authentication, Socks4 proxies without authentication, Socks5 with without authentication or with username/password authentication and DNS Lookups at the proxy's side. You could also configure Proxy to listen locally and then configure it also as external so you can review which packets exactly were sent from WebSurgery Suite.