7

Does anyone have any recommendations for a good Java library which can be used for penetration testing?

I once read about a library which I think was called 'Attack lib' but I can't find it anymore.

EDIT: This library should have easy ways to make many HTTP requests, parsing / grep'ing HTML / XML / JSON (and maybe more?).

I know Burp Suite has an interface you can code against, but this is not exactly what I'm looking for.

I'm tempted to just start writing my own library, but I'm sure there are many people who already have a library for pen testing already laying around :)

Improve this question
5
  • can you explain better what you're looking for? It's not quite clear.
    – AviD ♦
    Nov 28, 2010 at 21:58
  • 1
    it doesnt sound like anything special for attacks or pentesting, you just want a java library for HTTP requests and handling HTML/XML/JSON/etc - there are many builtin java classes for this, but nothing to do specifically with security.
    – AviD ♦
    Nov 29, 2010 at 9:37
  • @AviD, I guess you are correct. I just would think there was a recommended lib to use for easy web pentesting. With lots of helpfull classes, enums with user-agents, gzip decoding and such. Maybe some convienence methods like findTags, findPaths. Maybe noone made this because its so easy to get started with the default java classes :)
    – Chris Dale
    Nov 29, 2010 at 20:32
  • while that all sounds real useful, it doesnt seem to be limited specifically to pentesting. Any kind of request handling or content parsing would benefit from this... That said it looks like @Ams is familiar with such a framework...
    – AviD ♦
    Nov 29, 2010 at 20:44
  • @Avid, Im sure there is a framework/library to make my tasks easier. If you have any suggestions in how I could make the questions more clear/on point I would appriciate the help :) You are correct when it does not have to be geared towards pentesting.
    – Chris Dale
    Dec 6, 2010 at 11:34

1 Answer 1

Reset to default
8

I think this is what you need: http://watij.com/. As written on their site:

Watij (pronounced wattage) stands for Web Application Testing in Java. Watij is a Java API created to allow for the automation of web applications. Inspired by the simplicity of Watir and enhanced by the power of Java, Watij automates functional testing of web applications through real web browsers.

Hope that helps.

Improve this answer
4
  • Nice.. I will investigate this. Hopefully you dont have to use the browser to use the API, because I need to process the data in other Java classes.
    – Chris Dale
    Nov 29, 2010 at 13:39
  • Wow Watij is amazing! However this it seems to be more of a compatability testing framework than an attacking framework
    – Chris Dale
    Nov 29, 2010 at 19:53
  • I would imagine it would be pretty easy to fuzz or run tailorable sql injections from it.
    – Tim G
    Apr 27, 2016 at 0:11
  • watij is "coming soon" from that link. Might selenium be used for web app testing in this context?
    – Thufir
    Nov 30, 2017 at 13:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .