2

When someone is using a penetration test tool on my site sometimes I can find out what tool is that by looking at the user agent strings in the logs. But sometimes I can't because the tool uses a browser's user agent.

Is there a database with common URL patterns that each penetration tool uses?

For example here are some URLs for which I'd like to know which tool was used:

/server-info
/jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.system:type%3DServer
/Account/Register.aspx?ReturnUrl=
/roller-ui/login.rol?pageTitle=${new%20java.lang.Integer(100244%2b99553)}
/solr/select/?q=test
Improve this question
  • Are you trying to figure out if someone is scanning your web application without permission? Or are you trying to correlate incidents triggered by security systems with scanners? – sir_k Dec 5 '14 at 15:25
  • No and no. No harm was done on the site and I do know that someone is scanning it by looking at the logs. What I want is to be able to tell what penetration tool was used (without having to find out who the person is and what tool he/she used). – cherouvim Dec 5 '14 at 15:30
  • This would only matter with regards to the push-here-dummy tools (and the data can get stale as the tools change over time). Won't help with manual testing... which provides the highest degree of success. I rely very little on PHD tools. Like taking candy from a baby. – user1801810 Jan 3 '15 at 1:01
1

In all of your examples, those URIs can (or, well, should) generally be reached by every penetration testing tool. Most tools such as web application security scanners (and often even web application security proxies) implement a crawler (sometimes called a spider).

Crawlers perform link extraction. Link extraction can be benchmarked using a tool such as WIVET. Some tools perform automated form submission, or utilize fault injection. You can sometimes signature penetration testing tools based on this latter information. As an example, Burp Suite submits forms that often contain the name Peter Wiener.

Don't underestimate the power of adversaries to deny or deceive you. Identifying advesary weapons is a common military practice called TECHINT. It could be that an adversary wants you to think that he or she is running a certain tool when they are not -- and it could be that they are noticing that defenses are changing to block their specific tool, so an adversary response would typically be to change things up, i.e., use different tools.

UPDATE (after questioner's comments on why and well as looking at his list again):

Based on the roller-ui URI attack, this is based on an exploit for Apache Roller that relies on OGNL injection (CVE-2013-4212). The exploit was written for Metasploit, but based on some of the other attacks, such as the Solr select check, I can't conclude that Metasploit was used against your website. It looks like it may be a custom tool. Strangely, the JBoss jmx-console/HtmlAdaptor vulnerability appears to be CVE-2007-1157, but that's a strange check for CSRF when compared to the others which are geared towards remote code execution.

SECOND UPDATE -- based on the following two blog posts, I can conclude that Acunetix does check for /solr/select, /server-info and /Account/Register.aspx?ReturnUrl :

Improve this answer
  • 1
    "In all of your examples, those URIs can (or, well, should) generally be reached by every penetration testing tool" Yes, but this is not the case. For example, AFAIK acunetix does not search for the existence of solr or jmx. – cherouvim Dec 5 '14 at 15:31
  • 1
    I'd like to know which tool was used so I can run it myself (in case it is free) so I can fix potential problems on the site without having to find out who the person was and which tool he/she used. – cherouvim Dec 5 '14 at 15:33
  • You are looking for tools that implement forced browsing in addition to link extraction. Interesting. There should be a database that supports what you ask for -- if I had access to the tools I'd build the db myself and release to the Internet. The sectoolmarket guy would be a good bet -- he has access to all of the tools – atdre Dec 5 '14 at 16:00
  • Updated as to guesses of tools or potential for multiple tools and checks that could have been used based on the URIs given by the author. Do you have more examples? – atdre Dec 5 '14 at 21:31
  • Updated on speculation that it was Acunetix – atdre Dec 5 '14 at 21:40
0

There isn't going to be a 'database' for this because it is possible to modify the default search parameters or create one's own.

At best, a search engine query will likely turn up other people looking to understand the same log entries.

On the other hand, if you want to know what free Web App Scanners find by default, you could always simply run those free scanners yourself.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.