Average Ratings 0 Ratings

Total
ease
features
design
support

No User Reviews. Be the first to provide a review:

Write a Review

Average Ratings 0 Ratings

Total
ease
features
design
support

No User Reviews. Be the first to provide a review:

Write a Review

Description

ToothPicker serves as an innovative in-process, coverage-guided fuzzer specifically designed for iOS, focusing on the Bluetooth daemon and various Bluetooth protocols. Utilizing FRIDA as its foundation, this tool can be tailored to function on any platform compatible with FRIDA. The repository also features an over-the-air fuzzer that showcases an example implementation for fuzzing Apple's MagicPairing protocol through InternalBlue. Furthermore, it includes the ReplayCrashFile script, which aids in confirming any crashes identified by the in-process fuzzer. This simple fuzzer operates by flipping bits and bytes in inactive connections, lacking coverage or injection, yet it serves effectively as a demonstration and is stateful. It requires only Python and Frida to operate, eliminating the need for additional modules or installations. Built upon the frizzer codebase, it's advisable to establish a virtual Python environment for optimal performance with frizzer. Notably, with the introduction of the iPhone XR/Xs, the PAC (Pointer Authentication Code) feature has been implemented. This advancement underscores the necessity for continuous adaptation of fuzzing tools like ToothPicker to keep pace with evolving iOS security measures.

Description

Wapiti is a tool designed for scanning vulnerabilities in web applications. It provides the capability to assess the security of both websites and web applications effectively. By conducting "black-box" scans, it avoids delving into the source code and instead focuses on crawling through the web pages of the deployed application, identifying scripts and forms that could be susceptible to data injection. After compiling a list of URLs, forms, and their associated inputs, Wapiti simulates a fuzzer by inserting various payloads to check for potential vulnerabilities in scripts. It also searches for files on the server that may pose risks. Wapiti is versatile, supporting attacks via both GET and POST HTTP methods, and handling multipart forms while being able to inject payloads into uploaded filenames. The tool raises alerts when it detects anomalies, such as server errors or timeouts. Moreover, Wapiti differentiates between permanent and reflected XSS vulnerabilities, providing users with detailed vulnerability reports that can be exported in multiple formats including HTML, XML, JSON, TXT, and CSV. This functionality makes Wapiti a comprehensive solution for web application security assessments.

API Access

Has API

API Access

Has API

Screenshots View All

Screenshots View All

Integrations

Drupal
Google Chrome
Google Sheets
HTML
JSON
Microsoft Excel
Mozilla Firefox
Python
SQL
WordPress
XML

Integrations

Drupal
Google Chrome
Google Sheets
HTML
JSON
Microsoft Excel
Mozilla Firefox
Python
SQL
WordPress
XML

Pricing Details

Free
Free Trial
Free Version

Pricing Details

Free
Free Trial
Free Version

Deployment

Web-Based
On-Premises
iPhone App
iPad App
Android App
Windows
Mac
Linux
Chromebook

Deployment

Web-Based
On-Premises
iPhone App
iPad App
Android App
Windows
Mac
Linux
Chromebook

Customer Support

Business Hours
Live Rep (24/7)
Online Support

Customer Support

Business Hours
Live Rep (24/7)
Online Support

Types of Training

Training Docs
Webinars
Live Training (Online)
In Person

Types of Training

Training Docs
Webinars
Live Training (Online)
In Person

Vendor Details

Company Name

Secure Mobile Networking Lab

Website

github.com/seemoo-lab/toothpicker

Vendor Details

Company Name

Wapiti

Website

wapiti-scanner.github.io

Product Features

Product Features

Alternatives

Atheris Reviews

Atheris

Google

Alternatives

LibFuzzer Reviews

LibFuzzer

LLVM Project
syzkaller Reviews

syzkaller

Google
Jazzer Reviews

Jazzer

Code Intelligence
API Fuzzer Reviews

API Fuzzer

Fuzzapi