Sandcat by Syhunt – Web Server & Application Vulnerability Scanner

Use Netsparker


Sandcat allows web administrators to perform aggressive and comprehensive scans of an organization’s web server to isolate vulnerabilities and identify security holes.

The Sandcat scanner requires basic inputs such as host names, start URLs and port numbers to scan a complete web site and test all the web applications for security vulnerabilities.

This is a pretty nifty and complete tool, there is a ‘pro’ version available too.

Sandcat

Key Features

  • Provides over 260 web application security checks, covering over 38 types of web security attacks — a target server can be local or remote
  • Crawls web sites and detects cross-site scripting, directory transversal problems, attempts to execute commands and multiple other attacks
  • Scans web servers for the SANS Top Twenty (C1), the OWASP Top 10 and the OWASP PHP Top 5 vulnerabilities
  • Allows to scan for specific vulnerabilities, such as Fault Injection, SQL Injection and XSS (Cross-Site Scripting) vulnerabilities
  • Allows to define a range or list of IP addresses to be scanned
  • Allows to define multiple start URLs
  • Allows to perform destructive and non-destructive scans
  • Allows to edit the crawling depth: maximum number of links per server, maximum links per page, maximum URL length and maximum response size and more
  • Allows to create user signatures for detecting application vulnerabilities
  • Prevents logout
  • Tests intrusion detection systems
  • Exploits AJAX-based web applications
  • Supports host authentication (basic and web form authentication)
  • Supports OSVDB, NVD, CVE and CWE
  • Stores and allows you to view the HTTP request and response for each successful test
  • Automatically discovers and analyzes the server’s configuration to determine which tests are needed
  • Analyzes robots.txt file and javascript
  • Includes a Baseline Security Scanner — ensures security against outdated server software

Download Sandcat Standard Edition v3.08 here:

Download (EXE-Installer)
Download PDF Manual

Downloads Page.

Windows only I’m afraid.

Or you can read more here.

Posted in: Hacking Tools, Web Hacking

, , , , ,


Latest Posts:


Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.
testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.


3 Responses to Sandcat by Syhunt – Web Server & Application Vulnerability Scanner

  1. SN July 18, 2007 at 1:04 pm #

    nice

  2. Sandeep nain July 21, 2007 at 6:17 am #

    Hi All

    Any stats on the accuracy of this tool.. I tried this tool on 2 different php websites last night. Both are highly vulnerable to XSS & SQL Injection atacks (I know for sure as i developed these websites for testing purposes).. Although this tool correctly found the web server information but reported 0 XSS vulnerabilities and 0 sql injection vulnerabilities.

    Please let me know if anyone else found it more useful.

  3. Darknet July 23, 2007 at 6:59 am #

    Interesting results Sandeep.

    Has anyone else had chance to try it out and verify it’s reliability?