untidy – XML Fuzzer

Use Netsparker


Seen as though untidy was mentioned again fairly recent, it sparked my memory that I have a fairly old draft regarding untidy the XML Fuzzer.

Fuzzing is definitely becoming an important part of Pen Testing and especially application security – we’ve published about quite a few and I’m sure there are more in development.

Anyway, back to topic.

I’m glad to release the second beta version of untidy; untidy is general purpose XML Fuzzer. It takes a string representation of a XML as input and generates a set of modified, potentially invalid, XMLs based on the input. It’s released under GPL v2 and written in python.

It’s currently in it’s second release (Beta 2).

There are no prerequisites for running untidy, you will have to change it slightly though as it will output a LOT of XML to the screen, you’ll need to find the “print i” and change it to something more appropriate (sending to the server you want to test or outputing to a file with a newline for each iteration).

You can download untidy here:

untidy-beta2.tgz

Or read more here.

Posted in: Hacking Tools, Secure Coding, Web Hacking

, , , , , ,


Latest Posts:


HTTP Security Considerations - An Introduction To HTTP Basics HTTP Security Considerations – An Introduction To HTTP Basics
HTTP is ubiquitous now with pretty much everything being powered by an API, a web application or some kind of cloud-based HTTP driven infrastructure. With that HTTP Security becomes paramount and to secure HTTP you have to understand it.
Cangibrina - Admin Dashboard Finder Tool Cangibrina – Admin Dashboard Finder Tool
Cangibrina is a Python-based multi platform admin dashboard finder tool which aims to obtain the location of website dashboards by using brute-force, wordlists etc.
Enumall - Subdomain Discovery Using Recon-ng & AltDNS Enumall – Subdomain Discovery Using Recon-ng & AltDNS
Enumall is a Python-based tool that helps you do subdomain discovery using only one command by combining the abilities of Recon-ng and AltDNS.
RidRelay - SMB Relay Attack For Username Enumeration RidRelay – SMB Relay Attack For Username Enumeration
RidRelay is a Python-based tool to enumerate usernames on a domain where you have no credentials by using a SMB Relay Attack with low privileges.
NetBScanner - NetBIOS Network Scanner NetBScanner – NetBIOS Network Scanner
NetBScanner is a NetBIOS network scanner tool that scans all computers in the IP addresses range you choose, using the NetBIOS protocol.
Metta - Information Security Adversarial Simulation Tool Metta – Information Security Adversarial Simulation Tool
Metta is an information security preparedness tool in Python to help with adversarial simulation and assess security defense preparation and alerts.


2 Responses to untidy – XML Fuzzer

  1. dirty November 8, 2007 at 4:10 pm #

    “as it will output a LOT of XML to the screen”
    Wow, you werent kidding! jk LOL
    Neat tool though

  2. Reticent November 12, 2007 at 10:22 pm #

    Just a FYI for those that arent so familar with the term, ‘fuzzing’ – http://en.wikipedia.org/wiki/Fuzz_testing – Seems to be a bit of a buzz word at the moment.