Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Does anyone have any recommendations for a good Java library which can be used for penetration testing?

I once read about a library which I think was called 'Attack lib' but I can't find it anymore.

EDIT: This library should have easy ways to make many HTTP requests, parsing / grep'ing HTML / XML / JSON (and maybe more?).

I know Burp Suite has an interface you can code against, but this is not exactly what I'm looking for.

I'm tempted to just start writing my own library, but I'm sure there are many people who already have a library for pen testing already laying around :)

share|improve this question
    
can you explain better what you're looking for? It's not quite clear. –  AviD Nov 28 '10 at 21:58
1  
it doesnt sound like anything special for attacks or pentesting, you just want a java library for HTTP requests and handling HTML/XML/JSON/etc - there are many builtin java classes for this, but nothing to do specifically with security. –  AviD Nov 29 '10 at 9:37
    
@AviD, I guess you are correct. I just would think there was a recommended lib to use for easy web pentesting. With lots of helpfull classes, enums with user-agents, gzip decoding and such. Maybe some convienence methods like findTags, findPaths. Maybe noone made this because its so easy to get started with the default java classes :) –  Chris Andrè Dale Nov 29 '10 at 20:32
    
while that all sounds real useful, it doesnt seem to be limited specifically to pentesting. Any kind of request handling or content parsing would benefit from this... That said it looks like @Ams is familiar with such a framework... –  AviD Nov 29 '10 at 20:44
    
@Avid, Im sure there is a framework/library to make my tasks easier. If you have any suggestions in how I could make the questions more clear/on point I would appriciate the help :) You are correct when it does not have to be geared towards pentesting. –  Chris Andrè Dale Dec 6 '10 at 11:34

1 Answer 1

up vote 8 down vote accepted

I think this is what you need: http://watij.com/. As written on their site:

Watij (pronounced wattage) stands for Web Application Testing in Java. Watij is a Java API created to allow for the automation of web applications. Inspired by the simplicity of Watir and enhanced by the power of Java, Watij automates functional testing of web applications through real web browsers.

Hope that helps.

share|improve this answer
    
Nice.. I will investigate this. Hopefully you dont have to use the browser to use the API, because I need to process the data in other Java classes. –  Chris Andrè Dale Nov 29 '10 at 13:39
    
Wow Watij is amazing! However this it seems to be more of a compatability testing framework than an attacking framework –  Chris Andrè Dale Nov 29 '10 at 19:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.