freewvs released

Thursday, October 18. 2007

freewvs released

One of the biggest threats in computer security today are web applications. There's a vast number of issues found in popular web apps, mostly cross site scripting, cross site request forgery and sql injection. For a long time I had the idea of a tool scanning through webroots and looking for popular web applications, comparing them with a database of their latest security issues. In the past weeks, I finaly managed to get some code done.

It's a quite simple python-script (don't cry about the source quality, I haven't done real coding for ages), together with a database of some popular applications. I'm looking forward to hear feedback. The usage is simple, just do something like this:
freewvs /home/joe/websites/foo /home/guest/websites/bar
Typical output looks like this:
WebsiteBaker 2.4.3 (2.6.5) CVE-2007-0527 /home/hanno/freewvs/test/websitebaker
Drupal 5.1 (5.3) CVE-2007-5416 /home/hanno/freewvs/test/drupal
PhpWebGallery 1.5.1 () CVE-2007-5012 /home/hanno/freewvs/test/phpwebgallery
Mostly self explaining. The found app at the beginning, the version where the issue was fixed in brackets, the CVE-ID (or some other vulnerability id, in doubt an URL) and the path.

The biggest work to do is probably to get more applications added to the database and to keep the database updated. It's format is pretty self-explaining, so I'm waiting for your patches.

Get it here: https://freewvs.schokokeks.org/
Posted by Hanno Böck in Code, English, Linux, Security at 19:04 | Comments (3) | Trackbacks (0)
Defined tags for this entry: , , , , , ,
Related entries by tags:

Trackbacks
Trackback specific URI for this entry

No Trackbacks

Comments
Display comments as (Linear | Threaded)

Hat ja ewig gedauert. Die Idee von dir ist ja nun wahrlich nicht mehr taufrisch. ;)

Abgesehen davon aber zwei Fragen:
1.) Läuft Freewvs bereits als systemweiter Cronjob auf dem Keks, weil ich mir sonst einen erstellen würde ? (Da könnte es u.U. auch Probleme mit dem Datenschutz geben.)
2.) Ich bin immer noch dafür, dass du mit Freewvs einen Version-String für Web-Applications einführst. Sinnvollerweise besser als Datei namens version, die dann ge-regex-t wird. Natürlich in der Hoffnung, dass in Zukunft immer mehr Entwickler einfach so eine Datei (nicht welt-lesbar) anlegen.
#1 Alex (Homepage) on 2007-10-18 22:27 (Reply)
Schick wäre eine User-Notification. Also wenn in meinem Homedir eine verwundbare Webapplikation liegt, möchte ich das gerne erfahren.
#2 Lars Strojny (Homepage) on 2007-10-19 12:18 (Reply)
In Verbindung mit Cron hast du doch bereits eine. Aber mir ist schon klar, was du meinst.
#2.1 Alex (Homepage) on 2007-10-19 12:55 (Reply)

Add Comment

E-Mail addresses will not be displayed and will only be used for E-Mail notifications.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA
 
 

About me

You can find my web page with links to my work as a journalist at https://hboeck.de/.

You may also find my newsletter about climate change and decarbonization technologies interesting.

Hanno Böck
mail: hanno@hboeck.de

Hanno on Mastodon

Impressum

schokokeks.org

Creative Commons

CC0
Unless noted otherwise, all content is CC Zero / public domain

Show tagged entries

Frontpage
Datenschutz / Privacy