Visit our Resources
Wir bauen echte Partnerschaften mit unseren Kunden auf
Log view
Most of the different panels that make up the CAT tool use a log to record the results of the various activities. This log has various features that are common and allow the different components to interact.
The log is driven by the user from the right click dropdown menu. An item or items are selected (multiple via shift or control key), then the right button provides various options.
- Copy HTTP Request – Used to move requests from one log to another log/repeater/fuzzer etc. (works on multiple items).
- Paste HTTP Request – Adds the current clipboard request or requests to the log
- Copy URL – Adds the URL of the current single request to the clipboard so it can be pasted into a web browser or notepad.
- Remove Log Item(s) – Remove the selected items from the log.
- Diff Request/Response – Does a visual diff between the two selected requests or responses.
- View All Extracted Data – Goes through all entries in the log and displays the HTML comments and the decoded viewstates.
- Find / Extract All – Displays the search box for searching the log for certain keywords or to regexing out certain values.
- Repeat Request – Send the request again and add the result to the end of the log.
- Export Summary Results – Creates a HTML file in the specified location which contains all the details in the log list (summary details no content).
- Add Column – Adds extracted columns with certain extra information.
- Reflected Parameters – Shows which of the supplied parameter’s values appear in the response page. This is used to indentify potential non-persistent XSS. Be aware that a parameter with a very short value will often appear in the page quite frequently but not necessary be from the actual parameter.
- Contains String – Shows a true/false value from a grep for the string specified.
- Test All – Will perform the XSS, SQL Injection and backup tester on the request(s).
- XSS – A basic cross site scripting checker, looking for reflected parameters and then determining if there is a XSS attack string that match is reflected. If an attack string is matched then it will be marked as (Red), if a parameter is just reflected then it will be listed separately.
- QL Injection – Enters a series of SQL injection strings into each parameter and then determiners if a SQL error message is returned (Red), the response took more than 20 seconds after three retries (Orange), some responses were different than the original (Yellow) or no change from the original (Green).
- File Backup Tester – Tests the request(s) to see if there is another version with a backup type extension e.g. .bak, .old, .tmp.
- CSRF Tester – Tools to aid in testing for Cross Site Request Forgery. The create the URL version and the HTML for an auto-posting form.
- Open…, Save… - Allows for all log items to be saved to a XML or CAT file and then reloaded in any log tab at a later date.
- Export Page Summary – Creates a list of information about the pages in the log and any links that have not been followed in a HTML file in the location specified.
- Clear Log – Deletes all entries.
- Spider – Follows all links discovered on that host starting from the links on the request selected. A control box will appear at the bottom showing progress and a stop button. The result of the links and form submissions will be added into the same log view. Any pages with logout in the name will not be followed. Cookies from the original selected request will be used for the spider.
Wie wir helfen können
Wir sind ein eigenständiges Sicherheitsberatungsunterne-hmen, das sich auf den Bereich der technischen Sicherheit spezialisiert hat.
CAT
Unser Flagship-
Tool CAT ist für die
Ermittlung von
Anwendungsschwachstellen
bestens geeignet.
