Results tagged “ewts” from Just Another Hacker

The recent DeleGate robot.txt User-Agent String Handling Remote Overflow Vulnerability is a perfect example of the type of vulnerabilities that I hope the Evil Website Testing Suite will eventually be able to expose. This particular vulnerability would not be detected with the current version of ewts and writing a robots.txt fuzzer isn't on the top of my todo list, but it is on the list. I just saw the vulnerability release and was happy to see that these type of vulnerabilities do get some exposure.

I have nominated EWTS (evil website testing suite) for best new project on sourceforge. It's optimistic as ewts is still in its early infancy, but I am hoping that it will make some more noise.
If you agree with the idea behind ewts then please show your support by clicking on the vote button in the side bar or this link.

You might have noticed that we had an outage over the weekend. It was caused by hardware problems followed by one of the stranger linux bugs I have encountered to date. Never the less we're back in the tubes with some minor configuration tasks left until the morning. The good news is that we had the option to upgrade during the outage and got that out of the way.

Apart from that I am working on a new CPAN module and ewts has a few more tests committed. This month is pretty busy for me, but I will try to release some of the older work I've been sitting on for over a year.

Granted, it's a horrible pun, but I needed to post something about ewts. I have been procrastinating over how to reliably collect and measure metrics with ewts and have finally reached the conclusion that there isn't really a good way to do it that encompasses everything I want. Therefor I have decided to scrap the idea of measuring performance against a baseline and will just add tests at random. Once I have more tests in there I will have a better idea of what can and cannot be measured and will revisit the idea of metrics, but for now, lets break some crawlers.

I am sorry to say that I haven't done much work on any of my projects lately. It is partially related to the hosting move, but mostly due to lack of time and wanting to do other things with my spare time. I am however ending this hiatus.

Ewts really needs a harness for measuring test success, which is proving to be trickier due to some of the tests having peculiar ways of failing or succeeding. I am thinking of using TAP. There seems to be a shortage of php TAP code, so that might not work.

The N810 is suffering from a temperamental touch screen so I have had little motivation to work on that too. I did open the unit up (finding size 4&5 torx bits is tricker than you think) and checked the touch screen connection, but it wasn't loose. I also checked for stuck bits along the edge of the touch screen, but alas no luck. I might have to get it repaired. I did however come across some useful links/files for anyone that intends to open or tamper with the physical side of the N810

• N810 Service Manual - Level 1&2.zip [PDF - 2.3MB]
  
• N810 Service Manual - Level 3 & 4.zip [PDF - 41.8MB]
• N810 Schematics.pdf [PDF - 665KB]
• Attaching a serial port to the N810
  

The Evil Website Testing Suite (ewts for short) was created to fill a gap in available testing solutions for developers of software that interacts with web pages, such as crawlers. I had been playing with the idea of making a coverage test suite for automated vulnerability scanners and figured that the similarities between the testing harness I would need to test both a crawler and a vulnerability scanner were largely the same.

The evil website testing suite is currently hosted by sourceforge at http://www.sourceforge.net/projects/ewts/

There is no official download for ewts yet, but you can grab the latest version from CVS

svn co https://ewts.svn.sourceforge.net/svnroot/ewts ewts 

So the next Melbourne OWASP meeting is just around the corner. Unfortunately it seems they are inclined to keep most meetings at times where I cannot attend. My own fault for not being a city rat I guess. I will try to make it onto the circuit this year. Perhaps I should do a presentation on ewts once I get some useful data in there.

Since my previous biweekly project has come to a halt I have decided to shelve it for now. In it's stead I have started a new sourceforge project to keep me busy. The new project is called "Evil Website Testing Suite" or ewts for short.. It was initially envisioned as a coverage testing suite for web application vulnerabilities, but after picking apart some commercial crawlers I came to the conclusion that there aren't enough malformed and evil websites out there that will allow any web interfacing code to be thoroughly security tested. This is the gap that ewts aim to fill.

These are projects that we work on;

Evil Website Testing Suite
A collection of web pages that behave badly or provide malicious content in an attempt to break web based applications or cause malicious code inclusions in third party output, for example a RSS feed reader, link checker report, etc.


Graudit
Graudit is a simple script and signature sets that allows you to find potential security flaws in source code using the GNU utility grep. It's comparable to other static analysis applications like RATS, SWAAT and flaw-finder.