Repository navigation
Fuzz Tests
A fuzz test is specifically designed for web pages. There are three main types of fuzz tests.
Essentially, cross site scripting is the act of injecting your code into someone else's webpage. Currently, Agent7 only works with stored xss, but seeing as that's the most dangerous form of xss, we decided to point our efforts towards that first. Stored xss can be used to steal user information, download viruses, and has many other malicious uses. Agent7, when targeted towards a webpage, will scan for possible vulnerabilities, and attempt to inject invisible, harmless payloads into your webpage. You can easily remove these payloads, as they are easily identifiable. Agent7 will also alert you if any of these payloads were successfully injected. Currently, results of Agent7 identifying non-stored XSS are inconsistent.
SQL injection is one of the most popular web vulnerabilities. Essentially, it allows users to inject SQL code, allowing for things like stealing all user information, and even deleting your entire database. Agent7 uses common attack strings to determine if your site is vulnerable. We do not edit your databases,tables, or schemas, store any of your sql information, or delete sql data. One problem you may run into, is that for a short amount of time after testing occurs, this will lock up the vulnerable webpage(20 seconds for each vulnerable string found).
Still very much a work in progress, this feature, when finished, will allow you to test your site for possibly one of the most devistating attacks possible. It can be used for sql injection, xss, and can simply act as whatever the malicious user wants it to. It can be a virus. It can be a phishing site, essentially, it allows attackers almost total control over your computer. Php injection is tested for in a similar way to sql injection.
This is still in the early stages, but our CSRF features allow you to target a page, and any possibly sensitive information sent directly through the url will be notified by the program, and the program will subsequently notify you.