AspAuditor

AspAuditor

El objetivo del auditor es identificar ASP ASP.NET servidores vulnerables y configurado débilmente.

ASP Auditor v1.0 BETA
Author: David Kierznowski (david.kierznowski_at_gmail.com)
http://michaeldaw.org/
The purpose of ASP Auditor is to identify vulnerable and weakly
configured ASP.NET servers.

En Backtrack:
/pentest/web/asp-auditor
Ejemplo:
root@bt:/pentest/web/asp-auditor# ./asp-audit.pl

[ASP Auditor v2.2]
Usage:   ./asp-audit.pl [http://target/app/file.aspx] (opts)
(opts)
-bf brute force ASP.NET version using JS Validate
directories.

root@bt:/pentest/web/asp-auditor# ./asp-audit.pl http://ip-address/login.aspx -bf
[*] Sending initial probe request…
[*] Sending path discovery request…
[*] Sending ASP.NET validate discovery request…
[*] Sending ASP.NET Apr/07 XSS Check
[*] Sending application trace request…
[*] Sending null remoter service request…

[ .NET Configuration Analysis ]

Server    -> Microsoft-IIS/5.1
AppTrace    -> LocalOnly
Application    -> /login.aspx
ADNVersion    -> 1.1.4322
CustomErrors    -> On

matches    -> 1.1.4322.2032 Version 1.1 SP1 Aug 2004
matches    -> 1.1.4322.2300 Version 1.1 Post-SP1 (Windows Server 2003 SP1)  Mar 2005
matches    -> 1.1.4322.510 Version 1.1 Final Beta Oct 2002
matches    -> 1.1.4322.573 Version 1.1 RTM (Visual Studio.NET 2003 / Windows Server 2003) Feb 2003

Descarga: http://www.mobile-download.net/Soft/Soft_2906.htm