Web-Sorrow - An Enumerating Remote Security Scanner

Web-Sorrow is a remote security scanner that is used in the information gaining phase of penetration testing. It is open source and written in Perl. It helps you with detecting mis-configuration, version detection, enumeration, and server information scanning. Web-Sorrow is a “safe to run” program. Meaning it is not designed attempt to exploit or preform any kind of injection, DDoS/DoS, CSRF, XSS, or any harmful attacks. It’s entirely focused on enumeration and collecting information from the target server. Web-Sorrow also has false positives checking on most of it’s requests.

Current functionality provided by Web-Sorrow:

-S – scans for a set of standard tests. They include: index directory testing, banner grabbing, language detection (should be obvious), robots.txt, 200 response testing (some servers send a 200 ok for every req), and thumbs.db scanning
-auth – looks for login pages with a list of some of the most common login files and dirs and admin consoles. don’t need to be very big list of URLs because what else are going to name it? notAlogin.php???
-Cp – scan with a huge list of plugins dirs. the list is a bit old (Drupal and wordpress plugins databases are now current but sorry joomla’s still a bit old)
-I – Web-Sorrow searches the responses for interesting strings
-Ws – looks for web services such as hosting provider, blogging services, favicon fingerprinting, and cms version info
-Fd – look for generally things people don’t want you to see. The list is generated form a TON of robot.txt so whatever it finds should be interesting.
-ninja – A light weight and undetectable scan that uses bits and pieces from other scans
-R – use HTTP range headers to make scans faster
-Shadow – Use Google cache instead of requesting from the target host
-Sd – Bruteforce sub-domains in a Web-Sorrow scan
-Db – Bruteforce Directories with the big dirbuster Database
-ua – use a custom UserAgent. Add QUOTES if there are spaces in the string.
-proxy – send all HTTP reqs via a proxy. example: 255.255.255.254:8080
-e – run all the scans in the tool
-Ws - Scan for Web Services on host such as: cms version info, blogging services, favicon fingerprints, and hosting provider.

Web-Sorrow grabs banners when you get responses such as server:, x-powered-by:, x-meta-generator:, x-meta-framework:, x-meta-originator:, x-aspnet-version:, via: and MIME-Version:. Since it has been programmed in Perl and the source code is available, you can surely edit it to suit your needs.

Download Web-Sorrow v1.3.9

Subscribe to our Daily Newsletter via email - Be First to know about Security and Penetration testing tools. or Join our Huge Hackers Community on Facebook , Google+ and Twitter .

Subscribe Top Hacker Stories via email