Navigation



Pantera – Web Application Analysis Engine

Last updated: September 9, 2015 | 5,582 views

Pantera is actually using an improved version of SPIKE Proxy and is a project under the umbrella of OWASP.

It’s aiming to be a more automated method for testing Web Application Security.

Features

  • User-friendly custom web GUI. (CSS): Pantera itself is a web application that runs inside the browser and can be customized using CSS by the user. Some of the customizations are visual style, colors, fonts, views for easy information access, etc.
  • 100% python: Python is cross-platform, easy to install and use. Making it the perfect language of choice to use.
  • Multi-platform (Windows, Linux, etc.) and multi-browser (IE, Firefox, etc.): By using Python, Pantera is cross-platform. And we have made sure Pantera works fine with the most common browsers.
  • Supports SSL, NTLM, HTTP Basic: All this is supported by Pantera, still most open source tools have problems with things like NTLM.
  • Powerful analysis engine: Pantera has a powerful analysis engine, meaning that each web page that Pantera sees is analyzed for several things like comments, scripts, vulnerabilities, hidden tags and more. All this is done in background and transparent for the user while testing the website manual and of course all this info is stored in the database.
  • XML data files for configuration and attacks: Pantera uses XML files for configuration but also all the attacks and tests are stored in XML files, so it’s easy to add content to these files.
  • MySQL support: Most tools do not allow you to save the assessment. While performing an assessment with Pantera you can create a session, so all the info generated while the assessment is stored in the database. You can edit, delete and modify the content of the assessment at your will. You can continue the next day on the same point you stopped. Currently only MySQL is supported, more databases will be supported in the future.
  • Project Management: Each assessment is a session. Pantera offers project management to create new, open and delete projects.
  • Plug-in support: Pantera offers plug-in support so advanced users can add and extent its features.
  • Report generation: As Pantera can save assessments it can generate reports with all the gather data and vulnerabilities found. Some reports formats are HTML, XML, PDF, etc. Reports can also be customized!!

Requirements

  • Python 2.4
  • MySQL 5 (Due to the use of triggers)
  • pyOpenSSL
  • FormBuild (install script inside Pantera zip)

You can download Pantera v0.1.3 here:

Pantera_Release_0.1.3

Or read more here.

Share
Tweet
Share
Share
Buffer
WhatsApp
Reddit
Flip
Vote
Email
0 Shares
Posted in: Hacking News

, , , , ,


Latest Posts:


ZigDiggity - ZigBee Hacking Toolkit ZigDiggity – ZigBee Hacking Toolkit
ZigDiggity a ZigBee Hacking Toolkit is a Python-based IoT (Internet of Things) penetration testing framework targeting the ZigBee smart home protocol.
August 23, 2019 - 30 Shares
RandIP - Network Mapper To Find Servers RandIP – Network Mapper To Find Servers
RandIP is a nim-based network mapper application that generates random IP addresses and uses sockets to test whether the connection is valid or not with additional tests for Telnet and SSH.
July 27, 2019 - 101 Shares
Nipe - Make Tor Default Gateway For Network Nipe – Make Tor Default Gateway For Network
Nipe is a Perl script to make Tor default gateway for network, this script enables you to directly route all your traffic from your computer to the Tor network.
July 18, 2019 - 232 Shares
Mosca - Manual Static Analysis Tool To Find Bugs Mosca – Manual Static Analysis Tool To Find Bugs
Mosca is a manual static analysis tool written in C designed to find bugs in the code before it is compiled, much like a grep unix command.
July 11, 2019 - 242 Shares
Slurp - Amazon AWS S3 Bucket Enumerator Slurp – Amazon AWS S3 Bucket Enumerator
Slurp is a blackbox/whitebox S3 bucket enumerator written in Go that can use a permutations list to scan externally or an AWS API to scan internally.
July 1, 2019 - 274 Shares
US Government Cyber Security Still Inadequate US Government Cyber Security Still Inadequate
Surprise, surprise, surprise - an internal audit of the US Government cyber security situation has uncovered widespread weaknesses, legacy systems and poor adoption of cyber controls and tooling.
June 27, 2019 - 41 Shares


3 Responses to Pantera – Web Application Analysis Engine

  1. pablo July 9, 2008 at 12:20 am #

    It seems like a very nice job, although I suggest adding sqlite support (python has native sqlite 3 support), because it’s nice and easy to maintain a separate DB for each auditing project and it’s also a requirement sometimes…

    Anyway, nice tool!

  2. Cor-Paul July 9, 2008 at 7:40 am #

    Seems like a nice project, unfortunately I cannot get it to work in Vista with Python 2.5. Also I’m not sure about the development status (like with many OWASP projects :) ), last version dates from early 2007.

  3. Pantagruel July 11, 2008 at 11:01 am #

    A nice tool but as Cor-Paul mentions, rather dated.

    For some more on web app security (check list, etc) point your favorite browser to:

    http://portswigger.net/wahh (checklist, tools,etc)

    http://www.softwareqatest.com/qatweb1.html (huge list of tools amongst others web app security)

    and for some good reading (albeit very dated)

    http://www.cgisecurity.com/pen-test/